WO2018145546A1

WO2018145546A1 - Authentication method, device and storage medium

Info

Publication number: WO2018145546A1
Application number: PCT/CN2018/071503
Authority: WO
Inventors: 袁哲
Original assignee: 腾讯科技（深圳）有限公司
Priority date: 2017-02-07
Filing date: 2018-01-05
Publication date: 2018-08-16
Also published as: CN106790262A; CN106790262B

Abstract

Provided in the embodiments of the present application are an authentication method, device and storage medium, the method comprising the following steps: receiving a target resource access request which is sent by a user terminal and which carries a target user identifier, a target access resource and a target operation mode for the target access resource; looking up whether an authentication result of the target resource access request is present in a cache table; and when no authentication result of the target resource access request is present in the cache table, using a first policy table to authenticate the target resource access request, and outputting the authentication result of the target resource access request, wherein the first policy table is a relation table comprising the corresponding relations between the user identifier, accessible resources corresponding to the user identifier and the operable modes of the accessible resources, and classification of the first policy table is carried out using the user identifier.

Description

Authentication method, device and storage medium

The present application claims priority to Chinese Patent Application No. JP-A No. No. No. No. No. No. No. No. No. No. No. No. .

Technical field

The present application relates to the field of information security technologies, and in particular, to an authentication method, apparatus, and storage medium.

Background of the invention

In the cloud service authentication system, users can access cloud resources through the cloud service management platform. However, not every user has the right to access the cloud resources. The cloud service management platform needs to authenticate the user who sends the resource access request, and only the user who passes the authentication can access the cloud resource.

In the authentication process, it is necessary to separately identify the resources accessed by the user and the operation modes of the accessed resources.

Summary of the invention

The embodiment of the present invention provides an authentication method, an apparatus, and a storage medium. By searching data related to a resource access request from a policy table classified according to a user identifier, the search time of the resource access request related data is saved, thereby improving The authentication efficiency of the resource access request avoids the waste of processing resources of the computing device caused by searching related data of the resource access request in the plurality of relation tables.

An embodiment of the present application provides an authentication method, which is applied to a computing device, including:

Receiving a target resource access request sent by the user terminal, where the target resource access request carries a target user identifier, a target access resource, and a target operation mode for accessing the resource to the target;

Querying, in the cache table, whether an authentication result of the target resource access request exists, where the cache table includes an authentication result of multiple resource access requests within a preset time period before receiving the target resource access request;

When the authentication result of the target resource access request does not exist in the cache table, the target resource access request is authenticated by using the first policy table, and the authentication result of the target resource access request is output;

The first policy table is a relationship table including a user identifier, an accessible resource corresponding to the user identifier, and a corresponding relationship between the operable modes of the accessible resource, where the first policy table is Classified by the user identifier, each user identifier corresponds to at least one accessible resource, and each accessible resource corresponds to at least one operable manner.

An embodiment of the present application provides an authentication apparatus, including:

a processor and a memory coupled to the processor, the memory having machine readable instructions executable by the processor; the processor executing the machine readable instructions to: receive a user terminal to transmit a target resource access request, where the target resource access request carries a target user identifier, a target access resource, and a target operation mode for accessing the resource to the target;

Embodiments of the present application also provide a non-transitory computer readable storage medium in which machine readable instructions are stored, the machine readable instructions being executable by a processor to:

Receiving a target resource access request sent by the user terminal, where the target resource access request carries a target user identifier, a target access resource, and a target operation mode for accessing the resource by the target;

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings used in the description of the embodiments will be briefly described below. It is obvious that the drawings in the following description are only some embodiments of the present application, Those skilled in the art can also obtain other drawings based on these drawings without paying any creative work.

1A is a schematic diagram of an implementation environment of an authentication method provided by an embodiment of the present application;

1B is a schematic flowchart of an authentication method provided by an embodiment of the present application;

2 is a schematic flowchart of another authentication method provided by an embodiment of the present application;

FIG. 3 is a schematic flowchart of a step 205 according to an embodiment of the present application;

4 is a schematic structural diagram of an authentication apparatus according to an embodiment of the present application;

FIG. 5 is a schematic structural diagram of another authentication apparatus according to an embodiment of the present disclosure;

FIG. 6 is a schematic structural diagram of a first authentication unit according to an embodiment of the present disclosure;

FIG. 7 is a schematic structural diagram of a policy table updating unit according to an embodiment of the present application;

FIG. 8 is a schematic structural diagram of another authentication apparatus according to an embodiment of the present application.

detailed description

The technical solutions in the embodiments of the present application are clearly and completely described in the following with reference to the drawings in the embodiments of the present application. It is obvious that the described embodiments are only a part of the embodiments of the present application, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present application without departing from the inventive scope are the scope of the present application.

It should be noted that the terminology used in the embodiments of the present application is for the purpose of describing the specific embodiments, and is not intended to limit the application. The singular forms "a", "the", and "the" It should also be understood that the term "and/or" used in the embodiments of the present application refers to and encompasses any and all possible combinations of one or more associated listed items. In addition, the terms "first", "second", "third", and "fourth" and the like in the specification and claims of the present application and the above drawings are used to distinguish different objects, and are not used to describe specific order. Furthermore, the terms "comprises" and "comprising" and "comprising" are intended to cover a non-exclusive inclusion. For example, a process, method, system, product, or device that comprises a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units not listed, or alternatively Other steps or units inherent to these processes, methods, products or equipment.

In the authentication process of the traditional cloud service, when the user accesses the resource and the operation mode of the accessed resource, the user identifier, the user group, the accessible resource corresponding to the user identifier, the operable mode, etc. The relationship between the two is stored and managed separately. For example, the relationship table between the user ID and the user group, the relationship table of the user group and the policy group, the relationship table of the policy group and the accessible resource, the policy group, and the actionable relationship are saved. Tables, etc., can intuitively reflect the relationship between the two sets of data. However, in the authentication process, it is necessary to perform one-to-one matching from each relationship table. For example, first check the relationship between the user ID and the user group to determine the group in which the user is located, and then look up the relationship table between the user group and the policy group to determine A policy related to the user group, and then look up the relationship table of the policy group and the accessible resource to find out whether the resource requested by the user is included in the accessible resource corresponding to the policy; and also need to find a relationship table between the policy group and the operable mode to correspond to the policy. In the actionable mode, confirm whether the user's operation is included. Therefore, the prior art solution needs to search multiple times from multiple relational tables to determine the authentication result, which reduces the authentication efficiency of the user access request, and wastes the processing resources of the authentication device.

The authentication method provided by the embodiment of the present application may be applied to a scenario for accessing a cloud service resource, for example, receiving a target cloud resource access request sent by a user terminal, where the target cloud resource access request carries a target user identifier, a target access cloud resource, and a target operation mode for accessing the cloud resource to the target; searching for a verification result of the target cloud resource access request in the cache table, where the cache table includes a preset time before receiving the target cloud resource access request An authentication result of the plurality of cloud resource access requests in the segment; when the authentication result of the target cloud resource access request does not exist in the cache table, the first policy table is used to check the target cloud resource access request And outputting the authentication result of the target cloud resource access request, where the first policy table is a user identifier, an accessible cloud resource corresponding to the user identifier, and the accessible cloud resource A relational table of correspondence between operable modes, since the first policy table is classified by user identifier and contains user tags And a relationship table between the accessible cloud resource corresponding to the user identifier and the operable relationship between the accessible cloud resource, so that the related data of the target cloud resource access request can be searched in a relational table, thereby saving The time for finding the related data of the target cloud resource access request, thereby improving the authentication efficiency of the cloud resource access request, and avoiding the processing resource of the computing device caused by searching the related data of the target cloud resource access request in the plurality of relation tables. Waste. The processing resources include, but are not limited to, central processor consumption, memory consumption, bandwidth transmission consumption, and the like.

The authentication device in the embodiment of the present application may be a background device that authenticates a resource access request, and the authentication device may be a physical device that is separately set up, such as a computing device such as a server. Not limited.

The implementation environment of the authentication method provided by the embodiment of the present application may be as shown in FIG. 1A, wherein the server device 111 is integrated with the authentication device 1111 provided by any embodiment of the present application. The server device 111 and the user terminal 112 are connected by a network 113. The network 113 may be a wired network or a wireless network.

FIG. 1B is a schematic flowchart diagram of an authentication method according to an embodiment of the present application. As shown in FIG. 1B, the method in the embodiment of the present application may be performed by an authentication apparatus provided in any embodiment of the present application, and may include the following steps 101-103.

Step 101: Receive a target resource access request sent by a user terminal.

Specifically, the authentication device receives the target resource access request sent by the user terminal. The target resource access request carries a target user identifier, a target access resource, and a target operation mode for accessing the resource to the target.

For example, the user can initiate a target resource access request by logging into the resource management platform. The target user identifier is used to mark the user who performs the target operation mode on the target access resource. For example, the target access resource may be a file, data, or the like in the server, and the target operation mode may be a read instruction, a delete instruction, a write instruction, or the like. The embodiment of the present application does not limit the manner in which the target operation mode is included.

Step 102: Search, in the cache table, whether an authentication result of the target resource access request exists.

Specifically, the authentication device searches for a result of the authentication of the target resource access request in the cache table, where the authentication result includes the authentication pass and the authentication fail. If the authentication result is authenticated, the authentication device is configured to perform the target operation mode on the target access resource according to the target resource access request, and if the authentication result is that the authentication fails, the authentication device rejects The target resource access request.

According to an embodiment of the present application, the cache table includes an authentication result of multiple resource access requests within a preset time period before receiving the target resource access request. The preset time period is preset by the authentication device. For example, in a case where the resource access request is frequent, the authentication device may set a cache in the cache table to receive the target resource access request. The authentication result of all resource access requests in the hour; in the case where the resource access request is sparse, the authentication device may set all the resources in the cache table to buffer the time within the first 24 hours of receiving the target resource access request. The time range of the authentication result cached by the cache table is not limited in the embodiment of the present application.

According to an embodiment of the present application, the cache table includes data of a user identifier, an accessible resource, an operable manner of the accessible resource, an authentication result, and the like of each of the plurality of resource access requests. The target authentication result of the target resource access request is determined by comparing the target user identifier in the target resource access request, the target access resource, and the target operation mode of the target access resource with the data in the cache table.

Step 103: When the authentication result of the target resource access request does not exist in the cache table, use the first policy table to authenticate the target resource access request, and output the authentication of the target resource access request. result.

Specifically, when the authentication result of the target resource access request does not exist in the cache table, the authentication device uses the first policy table to authenticate the target resource access request, and outputs the target resource. Access the authentication result of the request. The first policy table is a relationship table including a user identifier, an accessible resource corresponding to the user identifier, and a corresponding relationship between the operable modes of the accessible resource, where the first policy table is According to the user identifier, each user identifier corresponds to at least one accessible resource, and each accessible resource corresponds to at least one operable manner.

Table 1: First Strategy Table

For example, refer to the above table, which is a policy table in a form, including a user identifier, an accessible resource, and an operable manner for the accessible resource. Table 1 is classified according to the user identifier, so that when the target resource access request is authenticated, the accessible resource corresponding to the target user identifier and the operable mode can be quickly found from the user identifier in the first policy table, thereby improving the The efficiency of authentication of target resource access requests.

Further, when the authentication result of the target resource access request exists in the cache table, the authentication device outputs the authentication result found in the cache table.

According to an embodiment of the present application, if the authentication result of the target resource access request is authenticated, the authentication device processes the target resource access request, that is, according to the target in the target resource access request. The operation mode processes the target access resource, and after the processing is completed, the authentication device may output the processing result.

In the embodiment of the present application, when receiving the target resource identifier that is sent by the user terminal, the target access resource, and the target operation mode of the target access resource, the cache table is used to find whether the target resource access request exists. As a result of the authentication, when the authentication result of the target resource access request does not exist in the cache table, the target resource access request is authenticated by using the first policy table, and the authentication result of the target resource access request is output. The first policy table is a relationship table that is classified by the user identifier and is a correspondence relationship between the user identifier, the accessible resource corresponding to the user identifier, and the operable mode of the accessible resource, so that the relationship can be in a relationship. The data in the table for finding the target resource access request saves the time for finding the related data of the target resource access request, thereby improving the authentication efficiency of the resource access request and avoiding finding the target resource access request in multiple relational tables. Waste of processing resources of computing devices caused by related data.

FIG. 2 is a schematic flowchart diagram of another authentication method according to an embodiment of the present application. As shown in FIG. 2, the method in the embodiment of the present application may be performed by the authentication apparatus provided in any embodiment of the present application, and may include the following steps 201-207.

Step 201: Receive a target resource access request sent by the user terminal.

Step 202: Search, in the cache table, whether an authentication result of the target resource access request exists.

Step 203: When the authentication result of the target resource access request exists in the cache table, the authentication device outputs the authentication result found in the cache table.

Step 204: When the authentication result of the target resource access request does not exist in the cache table, check whether the current version number of the second policy table is higher than the current version number of the first policy table.

Specifically, when the authentication result of the target resource access request does not exist in the cache table, the authenticating device detects whether the current version number of the second policy table is higher than the current version number of the first policy table.

The first policy table is a relationship table including a user identifier, an accessible resource corresponding to the user identifier, and a corresponding relationship between the operable modes of the accessible resource, where the first policy table is According to the user identifier, each user identifier corresponds to at least one accessible resource, and each accessible resource corresponds to at least one operable manner.

According to an embodiment of the present application, the second policy table includes a relationship table between a user identifier and a user group, a relationship table between the user group and the policy identifier, a mapping table of the policy identifier and the accessible resource, and a mapping between the policy identifier and the operable mode. Tables and other relational tables. The policy identifier in the second policy table is used to correspond to a resource group composed of a plurality of accessible resources, or the policy identifier is used to correspond to a permission group composed of multiple operable modes.

According to an embodiment of the present application, the current version number of the first policy table and the current version number of the second policy table may be represented by an update time. The version number may indicate updated data, such as changed accessible resources, changed user identification, changed operational modes, and the like. For the second policy table, a changed user group identifier, a changed policy identifier, and the like may also be included.

According to an embodiment of the present application, since the second policy table is distinguished by each policy identifier, when the user identifier or the accessible resource or the operable mode changes such as increase, decrease, etc., the second policy table may be updated first, because The second policy table includes a plurality of relation tables, and the data update can be completed by modifying one of the relationship tables, the update efficiency of the policy table can be improved, and the version number of the second policy table is updated after the second policy table is updated. After the second policy table is updated, the first policy table is updated according to the second policy table to ensure the accuracy of the first policy table, and the version number of the first policy table is updated after the first policy table is updated.

Step 205: If the current version number of the second policy table is not higher than the current version number of the first policy table, use the first policy table to authenticate the target resource access request, and output the target. The authentication result of the resource access request.

Specifically, if the current version number of the second policy table is not higher than the current version number of the first policy table, the authentication device uses the first policy table to check the target resource access request. And output an authentication result of the target resource access request. The first policy table is a relationship table classified according to the user identifier, and a relationship table includes multiple data, and the target resource access request is authenticated by using the first policy table, thereby improving the authentication efficiency and avoiding the cause. The waste of processing resources of the computing device caused by finding related data of the target resource access request in the plurality of relation tables.

Please refer to FIG. 3 , which is a schematic flowchart of step 205 provided by the embodiment of the present application. As shown in FIG. 3 , step 205 may include step 2051 to step 2055 .

Step 2051: Search for an accessible resource corresponding to the target user identifier and an operable manner for the accessible resource from the first policy table.

Specifically, the authentication device searches, from the first policy table, an accessible resource corresponding to the target user identifier and an operable manner for the accessible resource.

Step 2052: Determine whether the target access resource exists in the accessible resource.

Specifically, the authentication device searches for at least one accessible resource corresponding to the target user identifier to find whether the target access resource exists. If the target access resource exists in the accessible resource corresponding to the target user identifier, step 2053 is performed; if the target access resource does not exist in the accessible resource corresponding to the target user identifier, step 2055 is performed. .

Step 2053: If the target access resource exists in the accessible resource, determine whether the target operation mode exists in an operable manner of the target access resource.

Specifically, the determining device determines that the target access resource exists in the accessible resource, and further determines whether the target operation mode exists in an operable manner of the target access resource, if the operable mode If the target operation mode exists, step 2054 is performed. If the target operation mode does not exist in the operable mode, step 2055 is performed.

In step 2054, if the target operation mode exists in the operability mode of the target access resource, the authentication result of the target resource access request is determined to be authenticated, and the authentication of the target resource access request is output. result.

Specifically, if the target operation mode exists in an operative mode for accessing the resource, the authentication device determines that the authentication result of the target resource access request is authentication, and outputs the target resource. Access the authentication result of the request.

Step 2055: Determine that the authentication result of the target resource access request is that the authentication fails.

Specifically, if the target access resource does not exist in the accessible resource corresponding to the target user identifier, or if the target operation mode does not exist in the operable mode of the target access resource, The authentication device determines that the authentication result of the target resource access request is that the authentication fails, and outputs the authentication result, so that the user understands the authentication result.

Step 206: If the current version number of the second policy table is higher than the current version number of the first policy table, use the second policy table to authenticate the target resource access request, and output the The authentication result of the target resource access request.

Specifically, if the current version number of the second policy table is higher than the current version number of the first policy table, the authentication device uses the second policy table to authenticate the target resource access request. And outputting an authentication result of the target resource access request.

According to an embodiment of the present application, the authentication device may complete the authentication by searching whether the data corresponding to the target resource access request exists in the plurality of relationship tables included in the second policy table.

Step 207: If the current version number of the second policy table is higher than the current version number of the first policy table, update the first policy table according to the second policy table.

Specifically, when the current version number of the second policy table is higher than the current version number of the first policy table, the authentication device updates the first policy table according to the second policy table. Specifically, the current version number of the first policy table is compared with the historical version information of the second policy table, and the unupdated data of the first policy table is determined. And updating, according to the unupdated data, the first policy table, and changing a current version number of the first policy table to a current version number of the second policy table.

For example, for a user identifier, it may correspond to two or more user groups, and different user groups correspond to different resource identifiers. Different resource identifiers may have different accessible resources or different operable modes, for example: The second strategy table includes the following Table A, Table B, Table C, and Table D.

Table A: Relationship between user groups and user IDs

用户组user group	用户标识User ID
G1G1	ID-1；ID-2ID-1; ID-2
G2G2	ID-1；ID-3；ID-4ID-1; ID-3; ID-4

Table B: Relationship table between user groups and resource identifiers

用户组user group	资源标识Resource identification
G1G1	RID-1；RID-2；RID-1; RID-2;
G2G2	RID-3RID-3

Table C: Relationship table between resource IDs and accessible resources

资源标识Resource identification	可访问资源Accessible resources
RID-1RID-1	R-A、R-BR-A, R-B
RID-2RID-2	R-CR-C
RID-3RID-3	R-C；R-DR-C; R-D

Table D: Relationship Table between Resource Identification and Operational Mode

资源标识Resource identification	可操作方式Operational mode
RID-1RID-1	O1；O3；O1; O3;
RID-2RID-2	O1；O1;
RID-3RID-3	O2；O2;

The first policy table corresponding to the current second policy table is Table E.

Table E: First Strategy Table

It can be seen that when the target resource access request is authenticated by the second policy table, the authentication result needs to be determined through multiple relationship tables, and when the target resource access request is authenticated through the first policy table, only one relationship needs to be obtained. The authentication result can be determined in the table, which greatly reduces the time for opening the relationship table, closing the relationship table, and searching for data, which can improve the authentication efficiency and avoid the related data of finding the target resource access request in multiple relation tables. The waste of processing resources of the computing device. Therefore, if the current version number of the second policy table is not higher than the current version number of the first policy table, the first policy table is used for authentication, and the current version number of the second policy table is higher than the first policy table. In the case of the current version number, the second policy table is used for authentication.

According to an embodiment of the present application, since the second policy table intuitively reflects the relationship between the data, when the user group adds the user identifier, the user group and the user identifier included in the second policy table can be directly and quickly updated. The relationship table, and the first policy table also needs to update the accessible resource and the operable mode of the newly added user identifier, so when there is new data to be updated, the second policy table is preferentially updated, so that the update efficiency is higher. And updating the version number of the second policy table after the second policy table is updated.

According to an embodiment of the present application, after updating the second policy table, the first policy table may be updated according to the updated content of the second policy table.

According to an embodiment of the present application, when the change request of the policy table is received, the method of preferentially updating the first policy table may be adopted, and after updating the first policy table, updating the second policy according to the updated first policy table. table. Or, when the change request of the policy table is received, the first policy table and the second policy table are updated in synchronization, which is not limited by the embodiment of the present application.

In the embodiment of the present application, when receiving the target resource identifier that is sent by the user terminal, the target access resource, and the target operation mode of the target access resource, the target resource access request does not exist in the cache table. If the version number of the second policy table is not higher than the version number of the first policy table, the first policy table is used to authenticate the target resource access request, if the version number of the second policy table is higher than the first The version number of the policy table is used to authenticate the target resource access request by using the second policy table, and output the authentication result of the target resource access request. The first policy table is a relationship table that is classified by the user identifier and is a correspondence relationship between the user identifier, the accessible resource corresponding to the user identifier, and the operable mode of the accessible resource, so that the first policy table can be in a relationship table. The data related to the target resource access request is searched, which saves the time for finding the related data of the target resource access request, thereby improving the authentication efficiency of the resource access request and avoiding the related data of the target resource access request in multiple relational tables. The resulting processing resources of the computing device are wasted. In addition, since the second policy table includes multiple relationship tables, the update can be completed relatively quickly. In the case that the second policy table stores the latest data and the first policy table is not updated, the target resource can be accessed through the second policy table. Request for authentication to ensure the accuracy of authentication.

FIG. 4 is a schematic structural diagram of an authentication apparatus according to an embodiment of the present application. As shown in FIG. 4, the authentication apparatus 1 of the embodiment of the present application may include: a request receiving unit 11, a result finding unit 12, and a first authentication unit 13.

The request receiving unit 11 is configured to receive a target resource access request sent by the user terminal, where the target resource access request carries a target user identifier, a target access resource, and a target operation mode for the target access resource.

Specifically, the request receiving unit 11 receives a target resource access request sent by the user terminal. The target resource access request carries a target user identifier, a target access resource, and a target operation mode for accessing the resource to the target.

The result finding unit 12 is configured to search, in the cache table, whether an authentication result of the target resource access request exists, where the cache table includes multiple resource accesses within a preset time period before receiving the target resource access request The requested authentication result.

Specifically, the result searching unit 12 searches the cache table for the existence of the authentication result of the target resource access request, where the authentication result includes the authentication pass and the authentication fail. If the authentication result is authenticated, the authentication device 1 is allowed to perform a target operation mode on the target access resource according to the target resource access request, and if the authentication result is that the authentication fails, the authentication device is represented. 1 reject the target resource access request.

According to an embodiment of the present application, the cache table includes an authentication result of multiple resource access requests within a preset time period before receiving the target resource access request. The preset time period is preset by the authentication device 1. For example, in a case where the resource access request is frequent, the authentication device 1 may set a time in the cache table to buffer the time when the target resource access request is received. The authentication result of all the resource access requests in the previous hour; in the case where the resource access request is sparse, the authentication device 1 may set the cache within the first 24 hours of the time when the cache resource is received. The time range of the authentication result cached by the cache table is not limited in the embodiment of the present application.

According to an embodiment of the present application, the cache table includes data of a user identifier, an accessible resource, an operable manner of the accessible resource, an authentication result, and the like of each of the plurality of resource access requests. Determining whether there is an authentication result of the target resource access request by comparing the target user identifier in the target resource access request, the target access resource, and the target operation mode of the target access resource with the data in the cache table. .

The first authentication unit 13 is configured to: when the authentication result of the target resource access request does not exist in the cache table, use the first policy table to authenticate the target resource access request, and output the target The authentication result of the resource access request.

Specifically, when the authentication result of the target resource access request does not exist in the cache table, the first authentication unit 13 uses the first policy table to authenticate the target resource access request, and outputs the The authentication result of the target resource access request. The first policy table is a relationship table including a user identifier, an accessible resource corresponding to the user identifier, and a corresponding relationship between the operable modes of the accessible resource, where the first policy table is Classified by the user identifier, each user identifier corresponds to at least one accessible resource, and each accessible resource corresponds to at least one operable manner.

According to an embodiment of the present application, when the authentication result of the target resource access request exists in the cache table, the authentication apparatus 1 outputs the authentication result found in the cache table.

According to an embodiment of the present application, if the authentication result of the target resource access request is authenticated, the authentication apparatus 1 processes the target resource access request, that is, according to the target resource access request. The target operation mode processes the target access resource, and after the processing is completed, the authentication apparatus 1 can output the processing result.

FIG. 5 is another schematic structural diagram of an authentication apparatus according to an embodiment of the present application. As shown in FIG. 5, the authentication apparatus 1 of the embodiment of the present application may include: a request receiving unit 11, a result finding unit 12, a first authentication unit 13, a version number detecting unit 14, a second authentication unit 15, and Policy table update unit 16.

Specifically, the result searching unit 12 searches the cache table for the existence of the authentication result of the target resource access request, where the authentication result includes the authentication pass and the authentication fail, and if the authentication result is the authentication pass Indicates that the authentication device 1 allows the target operation mode to be performed on the target access resource according to the target resource access request. If the authentication result is that the authentication fails, the authentication device 1 rejects the target resource access request. .

The version number detecting unit 14 is configured to detect, when the authentication result of the target resource access request does not exist in the cache table, whether the current version number of the second policy table is higher than a current version number of the first policy table. .

Specifically, if the authentication result of the target resource access request does not exist in the cache table, the version number detecting unit 14 detects whether the current version number of the second policy table is higher than the current version number of the first policy table. .

According to an embodiment of the present application, since the second policy table is distinguished by each policy identifier, when the user identifier or the accessible resource or the operable mode changes such as increase, decrease, etc., the second policy table may be updated first, because The second policy table includes a plurality of relation tables, and the data update can be completed by modifying one of the relationship tables, the update efficiency of the policy table can be improved, and the version number of the second policy table is updated after the second policy table is updated. After the second policy table is updated, the first policy table is updated according to the second policy table to ensure the accuracy of the first policy table, and after the first policy table is updated, the version number of the first policy table is updated.

The first authentication unit 13 is configured to adopt the first policy if the version number detecting unit 14 detects that the current version number of the second policy table is not higher than the current version number of the first policy table. The table authenticates the target resource access request and outputs an authentication result of the target resource access request.

Specifically, please refer to FIG. 6 , which is a schematic structural diagram of a first authentication unit 13 according to an embodiment of the present application. As shown in FIG. 6 , the first authentication unit 13 includes a data search sub-unit 131 and a first The judgment sub-unit 132, the second judgment sub-unit 133, and the result determination sub-unit 134.

The data search sub-unit 131 is configured to search, from the first policy table, an accessible resource corresponding to the target user identifier and an operable manner for the accessible resource.

Specifically, the data search sub-unit 131 searches the first policy table for an accessible resource corresponding to the target user identifier and an operable manner for the accessible resource.

The first determining sub-unit 132 is configured to determine whether the target access resource exists in the accessible resource.

Specifically, the first determining sub-unit 132 searches for at least one accessible resource corresponding to the target user identifier to find whether the target access resource exists. If the target access resource exists in the accessible resource corresponding to the target user identifier, the second determining sub-unit 133 is executed.

The second determining sub-unit 133 is configured to determine, if the first access sub-unit 132 determines that the target access resource exists in the accessible resource, determine whether the target exists in an operable manner of the target access resource Operation method.

Specifically, if the first determining sub-unit 132 determines that the target access resource exists in the accessible resource, the second determining sub-unit 133 determines whether the operating mode of the target access resource exists. The target operation mode, if the target operation mode exists in the operable mode, the result determination sub-unit 134 is executed.

a result determining sub-unit 134, configured to determine, when the second determining sub-unit 133 determines that the target operating mode exists in an operable manner of accessing the target resource, determining an authentication result of the target resource access request The right passes, and outputs the authentication result of the target resource access request.

Specifically, if the target operation mode exists in an operable mode for accessing the resource, the result determining sub-unit 134 determines that the authentication result of the target resource access request is an authentication pass, and outputs the The authentication result of the target resource access request.

The second authentication unit 15 is configured to adopt the second policy table if the version number detecting unit 14 detects that the current version number of the second policy table is higher than the current version number of the first policy table. And authenticating the target resource access request, and outputting an authentication result of the target resource access request.

Specifically, if the current version number of the second policy table is higher than the current version number of the first policy table, the second authentication unit 15 uses the second policy table to access the target resource. The authentication is performed, and the authentication result of the target resource access request is output. The second authentication unit 15 may perform the authentication by searching whether the data corresponding to the target resource access request exists in the plurality of relationship tables included in the second policy table.

The policy table updating unit 16 is configured to: if the version number detecting unit 14 detects that the current version number of the second policy table is higher than the current version number of the first policy table, according to the second policy table, Update the first policy table.

Specifically, please refer to FIG. 7 , which is a schematic structural diagram of a policy table updating unit 16 according to an embodiment of the present application. As shown in FIG. 7 , the policy table updating unit 16 includes an update data determining subunit 161 and a policy table update. Subunit 162.

The update data determining subunit 161 is configured to compare the first policy table if the version number detecting unit 14 detects that the current version number of the second policy table is higher than the current version number of the first policy table. The current version number and the historical version information of the second policy table determine the unupdated data of the first policy table.

The policy table update sub-unit 162 is configured to update the first policy table according to the unupdated data, and change a current version number of the first policy table to a current version number of the second policy table. .

FIG. 8 is a schematic structural diagram of another authentication apparatus according to an embodiment of the present application. As shown in FIG. 8, the authentication apparatus 1000 may include at least one processor 1001, such as a CPU (Central Processing Unit), at least one network interface 1004, a memory 1005, and at least one communication bus 1002. The network interface 1004 can optionally include a standard wired interface, a wireless interface (such as a WI-FI interface). The memory 1005 may be a high speed RAM memory or a non-volatile memory such as at least one disk memory. According to an embodiment of the present application, the memory 1005 may also be at least one storage device located away from the processor 1001. Among them, the communication bus 1002 is used to implement connection communication between these components.

According to an embodiment of the present application, the authentication device 1000 includes a user interface 1003, wherein the user interface 1003 may include a display 10031 and a keyboard 10032. As shown in FIG. 8, an operating system 10051, a network communication module 10052, a user interface module 10053, and machine readable instructions, such as an authentication application 10054, may be included in the memory 1005 as a computer storage medium.

In the authentication device 1000 shown in FIG. 8, the user interface 1003 is mainly used to receive a user-initiated target resource access request and the like; and the processor 1001 can be used to invoke an authentication application stored in the memory 1005, and specifically execute the following: operating:

In an embodiment of the present application, the processor 1001 performs the following operations before performing the authentication on the target resource access request by using the first policy table, and outputting the authentication result of the target resource access request:

Detecting whether a current version number of the second policy table is higher than a current version number of the first policy table;

If the current version number of the second policy table is not higher than the current version number of the first policy table, the target resource access request is authenticated by using the first policy table, and the target resource is output Access the authentication result of the request;

The second policy table includes a plurality of relationship tables, where the relationship table includes a relationship between the user identifier and the user group, a relationship table between the user group and the policy identifier, a mapping table of the policy identifier and the accessible resource, and a policy. A mapping table of identification and actionable methods.

In an embodiment of the present application, the processor 1001 further performs the following operations:

And if the current version number of the second policy table is higher than the current version number of the first policy table, the target resource access request is authenticated by using the second policy table, and the target resource access is output The requested authentication result.

And if the current version number of the second policy table is higher than a current version number of the first policy table, updating the first policy table according to the second policy table.

In an embodiment of the present application, the processor 1001 performs updating the first policy table according to the second policy table, and specifically performs the following operations:

Comparing a current version number of the first policy table with historical version information of the second policy table to determine unupdated data of the first policy table;

And updating, according to the unupdated data, the first policy table, and changing a current version number of the first policy table to a current version number of the second policy table.

In an embodiment of the present application, the processor 1001 performs the authentication of the target resource access request by using the first policy table, and outputs the authentication result of the target resource access request, and specifically performs the following operations:

Finding, by the first policy table, an accessible resource corresponding to the target user identifier and an operable manner for the accessible resource;

Determining whether the target access resource exists in the accessible resource;

If the target access resource exists in the accessible resource, determining whether the target operation mode exists in an operable manner of accessing the resource to the target;

If the target operation mode exists in the operable mode of accessing the resource, the authentication result of the target resource access request is determined to be authenticated, and the authentication result of the target resource access request is output.

It should be noted that the steps performed by the processor 1001 in the embodiment of the present application to invoke the authentication application stored in the memory 1005 may be specifically implemented according to the method in the method embodiment shown in FIG. 1B to FIG. I won't go into details here.

The module or unit in the embodiment of the present application may be implemented by a general-purpose integrated circuit, such as a CPU, or by an ASIC (Application Specific Integrated Circuit).

The steps in the method of the embodiment of the present application may be sequentially adjusted, merged, and deleted according to actual needs.

The modules or units in the terminal device in this embodiment of the present application may be combined, divided, and deleted according to actual needs.

One of ordinary skill in the art can understand that all or part of the process of implementing the foregoing embodiments can be completed by a computer program to instruct related hardware, and the program can be stored in a computer readable storage medium. When executed, the flow of an embodiment of the methods as described above can be implemented. The storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

The above is only the preferred embodiment of the present application, and the scope of the application is not limited thereto. Therefore, the equivalent changes made in the claims of the present application are still within the scope of the embodiments of the present application.

Claims

An authentication method applied to a computing device, including:

Receiving a target resource access request sent by the user terminal, where the target resource access request carries a target user identifier, a target access resource, and a target operation mode for accessing the resource by the target;

Querying, in the cache table, whether an authentication result of the target resource access request exists, where the cache table includes an authentication result of multiple resource access requests within a preset time period before receiving the target resource access request;

When the authentication result of the target resource access request does not exist in the cache table, the target resource access request is authenticated by using the first policy table, and the authentication result of the target resource access request is output;

The first policy table is a relationship table including a user identifier, an accessible resource corresponding to the user identifier, and a corresponding relationship between the operable modes of the accessible resource, where the first policy table is Classified by the user identifier, each user identifier corresponds to at least one accessible resource, and each accessible resource corresponds to at least one operable manner.
The method of claim 1, before the authenticating the target resource access request by using the first policy table, and outputting the authentication result of the target resource access request, the method further includes:

Detecting whether a current version number of the second policy table is higher than a current version number of the first policy table;

If the current version number of the second policy table is not higher than the current version number of the first policy table, the target resource access request is authenticated by using the first policy table, and the target resource is output Access the authentication result of the request;

The second policy table includes a plurality of relationship tables, where the relationship table includes a relationship between the user identifier and the user group, a relationship table between the user group and the policy identifier, a mapping table of the policy identifier and the accessible resource, and a policy. A mapping table of identification and actionable methods.
The method of claim 2 further comprising:

And if the current version number of the second policy table is higher than the current version number of the first policy table, the target resource access request is authenticated by using the second policy table, and the target resource access is output The requested authentication result.
The method of claim 2 or 3, further comprising:

And if the current version number of the second policy table is higher than a current version number of the first policy table, updating the first policy table according to the second policy table.
The method of claim 4, the updating the first policy table according to the second policy table, comprising:

Comparing a current version number of the first policy table with historical version information of the second policy table to determine unupdated data of the first policy table;

And updating, according to the unupdated data, the first policy table, and changing a current version number of the first policy table to a current version number of the second policy table.
The method according to any one of claims 1-5, wherein the authenticating the target resource access request by using the first policy table, and outputting the authentication result of the target resource access request, includes:

Finding, by the first policy table, an accessible resource corresponding to the target user identifier and an operable manner for the accessible resource;

Determining whether the target access resource exists in the accessible resource;

If the target access resource exists in the accessible resource, determining whether the target operation mode exists in an operable manner of accessing the resource to the target;

If the target operation mode exists in the operable mode of accessing the resource, the authentication result of the target resource access request is determined to be authenticated, and the authentication result of the target resource access request is output.
An authentication device includes:

a processor and a memory coupled to the processor, the memory having machine readable instructions executable by the processor; the processor executing the machine readable instructions to:

Receiving a target resource access request sent by the user terminal, where the target resource access request carries a target user identifier, a target access resource, and a target operation mode for accessing the resource by the target;

Querying, in the cache table, whether an authentication result of the target resource access request exists, where the cache table includes an authentication result of multiple resource access requests within a preset time period before receiving the target resource access request;

When the authentication result of the target resource access request does not exist in the cache table, the target resource access request is authenticated by using the first policy table, and the authentication result of the target resource access request is output;

The first policy table is a relationship table including a user identifier, an accessible resource corresponding to the user identifier, and a corresponding relationship between the operable modes of the accessible resource, where the first policy table is Classified by the user identifier, each user identifier corresponds to at least one accessible resource, and each accessible resource corresponds to at least one operable manner.
The apparatus of claim 7, the processor executing the machine readable instructions to:

When the authentication result of the target resource access request does not exist in the cache table, detecting whether the current version number of the second policy table is higher than the current version number of the first policy table;

If the current version number of the second policy table is not higher than the current version number of the first policy table, the target resource access request is authenticated by using the first policy table, and the The authentication result of the target resource access request;

The second policy table includes a plurality of relationship tables, where the relationship table includes a relationship between the user identifier and the user group, a relationship table between the user group and the policy identifier, a mapping table of the policy identifier and the accessible resource, and a policy. A mapping table of identification and actionable methods.
The apparatus of claim 8 wherein said processor executes said machine readable instructions to:

If the current version number of the second policy table is higher than the current version number of the first policy table, the target resource access request is authenticated by using the second policy table, and the target is output The authentication result of the resource access request.
The apparatus of claim 8 or 9, said processor executing said machine readable instructions to:

If it is detected that the current version number of the second policy table is higher than the current version number of the first policy table, the first policy table is updated according to the second policy table.
The apparatus of claim 10, said processor executing said machine readable instructions to:

If it is detected that the current version number of the second policy table is higher than the current version number of the first policy table, compare the current version number of the first policy table with the historical version information of the second policy table, and determine The unupdated data of the first policy table;

And updating, according to the unupdated data, the first policy table, and changing a current version number of the first policy table to a current version number of the second policy table.
The apparatus of any one of claims 7-11, the processor executing the machine readable instructions to:

Finding, by the first policy table, an accessible resource corresponding to the target user identifier and an operable manner for the accessible resource;

Determining whether the target access resource exists in the accessible resource;

If it is determined that the target access resource exists in the accessible resource, determining whether the target operation mode exists in an operable manner of the target access resource;

If it is determined that the target operation mode exists in the operable mode of accessing the resource, the authentication result of the target resource access request is determined to be authenticated, and the authentication result of the target resource access request is output.
A non-transitory computer readable storage medium storing machine readable instructions, the machine readable instructions being executable by a processor to perform the following operations:

Receiving a target resource access request sent by the user terminal, where the target resource access request carries a target user identifier, a target access resource, and a target operation mode for accessing the resource by the target;

Querying, in the cache table, whether an authentication result of the target resource access request exists, where the cache table includes an authentication result of multiple resource access requests within a preset time period before receiving the target resource access request;

When the authentication result of the target resource access request does not exist in the cache table, the target resource access request is authenticated by using the first policy table, and the authentication result of the target resource access request is output;

The first policy table is a relationship table including a user identifier, an accessible resource corresponding to the user identifier, and a corresponding relationship between the operable modes of the accessible resource, where the first policy table is Classified by the user identifier, each user identifier corresponds to at least one accessible resource, and each accessible resource corresponds to at least one operable manner.
The non-transitory computer readable storage medium of claim 13, the machine readable instructions being executable by a processor to:

Before detecting the target resource access request by using the first policy table, and outputting the authentication result of the target resource access request, detecting whether the current version number of the second policy table is higher than the first policy The current version number of the table;

If the current version number of the second policy table is not higher than the current version number of the first policy table, the target resource access request is authenticated by using the first policy table, and the target resource is output Access the authentication result of the request;

The second policy table includes a plurality of relationship tables, where the relationship table includes a relationship between the user identifier and the user group, a relationship table between the user group and the policy identifier, a mapping table of the policy identifier and the accessible resource, and a policy. A mapping table of identification and actionable methods.
The non-transitory computer readable storage medium of claim 14, the machine readable instructions being executable by a processor to:

And if the current version number of the second policy table is higher than the current version number of the first policy table, the target resource access request is authenticated by using the second policy table, and the target resource access is output The requested authentication result.
A non-transitory computer readable storage medium according to claim 14 or 15, the machine readable instructions being executable by a processor to:

And if the current version number of the second policy table is higher than a current version number of the first policy table, updating the first policy table according to the second policy table.
The non-transitory computer readable storage medium according to claim 16, wherein the updating the first policy table according to the second policy table comprises:

Comparing a current version number of the first policy table with historical version information of the second policy table to determine unupdated data of the first policy table;

And updating, according to the unupdated data, the first policy table, and changing a current version number of the first policy table to a current version number of the second policy table.
The non-transitory computer readable storage medium according to any one of claims 13-17, wherein the target resource access request is authenticated by using a first policy table, and the reference of the target resource access request is output The results of the rights, including:

Finding, by the first policy table, an accessible resource corresponding to the target user identifier and an operable manner for the accessible resource;

Determining whether the target access resource exists in the accessible resource;

If the target access resource exists in the accessible resource, determining whether the target operation mode exists in an operable manner of accessing the resource to the target;

If the target operation mode exists in the operable mode of accessing the resource, the authentication result of the target resource access request is determined to be authenticated, and the authentication result of the target resource access request is output.