CN105100051A - Method and system for realizing data resource access right control - Google Patents

Abstract

The invention discloses a method and system for realizing data resource access right control. A server performs local cache on configuration files of the access right information of data resources used by each application example, and after an access data resource request of a corresponding application example is received, the data resource access right information locally cached and to be used by the application example is directly called for access verification, therefore, data resource access efficiency is improved.

Description

Method and system for realizing data resource access control

technical field

The invention relates to the field of computers, in particular to a method and system for realizing data resource access authority control.

Background technique

In a large-scale computer network system, such as an online production system, clients with many data resources often call data resources on servers in the computer network system at the same time or at different times. However, when the number of invoking access requests is large, it will cause an exception of the called server, and finally cause the server to crash. In order to solve this problem, priority can be set for the clients in the computer network system, and according to the priority, the server will serve these clients one by one and provide data resources for these clients, thus ensuring the normal operation of the computer system.

In the server in the computer network system, the configuration file is preset and stored on the system hard disk of the server, including information on access rights to data resources. When the server processes the data resource access request of the client, the server reads the configuration file on the system hard disk into the memory, and determines whether to provide data resources for the client according to the business logic set in the configuration file according to the data resource access information. When updating or adjusting the access permission information of a data resource, if the information corresponds to multiple application instances, the data resource access permission information under the multiple application instances in the configuration file needs to be updated or adjusted one by one , and after the update or adjustment is completed, the server needs to be restarted to reload the updated or adjusted application instances in the configuration file.

There are disadvantages in the above-mentioned server’s control method for data resource access rights: first, every time a data resource access request is received, the configuration file on the system hard disk needs to be loaded into the memory, and the read operation of the system hard disk is time-consuming. It affects the efficiency of the server in processing data resource access requests, thereby affecting the efficiency of data resource access in the computer network system; second, when updating or adjusting data resource access permissions, the configuration file needs to be modified and the server needs to be restarted to complete the configuration file In the process of restarting the server, the computer network system cannot provide access to data resources. This will cause a large number of requests to be rejected or bring greater traffic pressure to other servers in the computer network system in an environment with high concurrency and large access volume. ;Third, in the configuration file, the application instances related to the data resource access permission information need to be modified or updated one by one, and the risk of making mistakes or changing inconsistencies is relatively high.

Contents of the invention

In view of this, an embodiment of the present invention provides a method for implementing data resource access authority control, which can improve the efficiency of data resource access authority.

The embodiment of the present invention also provides a system for realizing data resource access authority control, which can improve the efficiency of data resource access.

According to above-mentioned purpose, the present invention is achieved like this:

A method for implementing data resource access control, the method comprising:

The server of the computer network system caches locally the configuration file to which the data resource access permission information to be used by each application instance belongs;

After receiving the data resource access request corresponding to the application instance sent by the client in the computer network system, it directly invokes the locally cached data resource access permission information to be used by the application instance for access verification, and returns the verification result.

The configuration file to which the data resource access authority information to be used by each application instance belongs is cached in the form of a hash table.

The method also includes:

The server includes a log-type key-value database, which stores data resource access permission information to be used by each application instance, and when updating, updates the data resource access permission information to be used by the application instance in the database and identifies an update flag.

The log-type key-value database is realized by the redis component, and the data resource access authority information and identification update flags to be used by the application instances in the database are stored in a hash table.

The method further includes: each application instance in the local cache regularly and asynchronously accesses the database, acquires the updated data resource access permission information used by the application instance, and overwrites the data resource access information used by the application instance in the cache permission information.

The asynchronous timing access of the application instance to the database is completed by using an asynchronous timing thread.

A system for implementing data resource access control, including: a local cache unit, a request response unit, and a verification unit, wherein,

The local cache unit is used to locally cache the configuration file to which the data resource access permission information to be used by each application instance belongs;

The request response unit receives the data resource access request corresponding to the application instance sent by the client in the computer network system;

The verification unit directly invokes the locally cached data resource access authority information to be used by the application instance to perform access verification, and returns a verification result.

It also includes a log-type key-value database, which is used to store the data resource access permission information to be used by each application instance. When updating, directly update the data resource access permission information to be used by the application instance and identify the update flag.

The local cache unit is also used for each application instance to regularly and asynchronously access the log-type key-value database to obtain the updated data resource access permission information used by the application instance, and to overwrite the data resources used by the application instance in the cache. The data resource access permission information of .

It can be seen from the above scheme that the server in the embodiment of the present invention caches locally the configuration file to which the data resource access authority information to be used by each application instance belongs, and directly calls the local The cached data resource access permission information to be used by the application instance is used for access verification. In this way, it is not necessary to read the configuration file from the system hard disk for verification every time a data resource access request is received, as in the background technology, which improves the data resource access efficiency. Further, the server also includes a log-type key-value database, which stores the data resource access permission information to be used by each application instance, and when updating, directly updates the data resource access permission information to be used by the application instance in the database And identify that the locally cached application instance regularly accesses the database to obtain the updated data resource access permission information used by the application instance, and overwrite the data resource access permission information used by the application instance in the cache, so that there is no need to update When accessing the data resource access rights information, restart the server to prevent access traffic pressure in the computer network system.

Description of drawings

FIG. 1 is a flow chart of a method for implementing data resource access authority control provided by an embodiment of the present invention;

FIG. 2 is a flow chart of a specific example of a method for implementing data resource access authority control provided by an embodiment of the present invention;

FIG. 3 is a schematic structural diagram of a system for implementing data resource access authority control provided by an embodiment of the present invention;

Fig. 4 is a schematic diagram of a specific example of a system for implementing data resource access authority control provided by an embodiment of the present invention.

Detailed ways

In order to make the object, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and examples.

In order to improve the efficiency of data resource access, the server in the embodiment of the present invention caches the configuration file of the data resource access authority information to be used by each application instance locally, and when receiving the data resource access request of the corresponding application instance, directly calls The locally cached data resource access permission information to be used by the application instance is used for access verification. In this way, it is not necessary to read the configuration file from the system hard disk for verification every time a data resource access request is received, as in the background technology, which improves the data resource access efficiency.

Here, the configuration file is a copy configuration file, and it is saved in the form of a hash table. Each hash table corresponds to an application instance, so that the application instance in the log-type key-value database can be located later.

Further, the server also includes a log-type key-value database, which stores the data resource access permission information to be used by each application instance, and when updating, directly updates the data resource access permission information to be used by the application instance in the database And identify the update flag.

Here, the database is developed using the redis component. Redis is an open-source, log-type key-value database that is written in ANSIC language, supports the network, and can be based on system memory or persists. It can provide various application programming interfaces (API ). In this database, there is a one-to-one correspondence structure between application instances and data resource access information, and all application instances corresponding to data resource access information with update identifiers are set in a hash table.

Each application instance in the local cache accesses the database regularly and asynchronously, obtains the updated data resource access permission information used by the application instance, and overwrites the data resource access permission information used by the application instance in the cache, so that there is no need to update When accessing the data resource access rights information, restart the server to prevent access traffic pressure in the computer network system. Furthermore, since all the data resource access rights information of the application instance in the local cache is updated by overwriting during the update, that is, the hash table of the application instance is replaced at one time, rather than the data resource access rights of all application instances The information is all replaced, so that in the concurrent request environment of the computer network system, it can prevent the old data resource access permission information of the application instance and the new data resource access permission information when verifying the request.

Fig. 1 is a flow chart of a method for realizing data resource access control provided by an embodiment of the present invention, and its specific steps are:

Step 101, the server of the computer network system caches locally the configuration file to which the data resource access authority information to be used by each application instance belongs;

Step 102: After receiving the data resource access request corresponding to the application instance sent by the client in the computer network system, directly call the locally cached data resource access authority information to be used by the application instance for access verification, and return the verification result to the client .

In this step, the verification result may be that the verification is passed, and the client is allowed to access the data resource; or the verification is not passed, and the client is not allowed to range the data resource.

In this method, the configuration file to which the data resource access authority information to be used by each application instance belongs is cached in the form of a hash table.

In the method, further comprising:

The server also includes a log-type key-value database, which stores the data resource access information to be used by each application instance. When updating, directly update the data resource access information to be used by the application instance in the database and identify the update sign.

The log-type key-value database is realized by the redis component, and the data resource access authority information and identification update flags to be used by the application instances in the database are stored in a hash table.

In this method, also include:

Each application instance in the local cache accesses the database regularly and asynchronously, obtains the updated data resource access permission information used by the application instance, and overwrites the data resource access permission information used by the application instance in the cache.

The asynchronous timing access of the application instance to the database is completed by using an asynchronous timing thread.

Fig. 2 is a flow chart of a specific example of a method for implementing data resource access authority control provided by an embodiment of the present invention. It can be seen that in the update phase, the configuration changer directly updates the data resource access authority to be used by the application instance in the database information and identify the update flag, configure the queryer to obtain the data resource access information used by the requested application instance from the local cache and verify it by the server, and the application instance of the local cache will be regularly and asynchronously obtained from the redis-based database after being updated The data resource access permission information of the application instance and overwrite it. In the query phase, configure the queryer to obtain the access permission information of the data resource used by the requested application instance from the local cache and verify it by the server.

FIG. 3 is a schematic structural diagram of a system for implementing data resource access control provided by an embodiment of the present invention, including: a local cache unit, a request response unit, and a verification unit, wherein,

The local cache unit is used to locally cache the configuration file to which the data resource access permission information to be used by each application instance belongs;

The request response unit receives the data resource access request corresponding to the application instance sent by the client in the computer network system, and returns the verification result to the client;

The verification unit directly invokes the locally cached data resource access permission information to be used by the application instance to perform access verification.

In the system, a log-type key-value database is also included, which is used to store the data resource access permission information to be used by each application instance. When updating, directly update the data resource access permission information to be used by the application instance and identify the update sign.

In this system, the local cache unit is also used for each application instance to regularly and asynchronously access the log-type key-value database, to obtain the updated data resource access permission information used by the application instance, and to overwrite the The data resource access permission information used by the application instance.

Fig. 4 is a schematic diagram of a specific example of a system for implementing data resource access control provided by an embodiment of the present invention. It can be seen from the figure that in the local cache of the server, a hash table is set for each application instance, and the hash The data resource access permission information of the application instance is stored in the table, and each application instance can receive data resource access requests. Each application uses an asynchronous thread to interact with the database based on the redis component. In the database, corresponding to each application instance, the data resource access information to be used is cached and stored in a hash table. When updating, it directly interacts with the database , update the data resource access authority information to be used by the application instance in the database and identify the update flag, and the application instance has a one-to-one correspondence with the updated data resource access authority information or the unupdated data resource access authority information.

In the embodiment of the present invention, if the update is performed, the data resource access authority information of the relevant application instance in the server will be updated, and it will take effect soon without restarting the service. The embodiments of the present invention greatly reduce the authority determination time, and improve the resource allocation efficiency of computer systems playing two games.

The preferred embodiments above are used to further describe the purpose, technical solutions and advantages of the present invention in detail. It should be understood that the above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. Within the spirit and principles of the present invention, any modifications, equivalent replacements and improvements, etc., shall be included within the protection scope of the present invention.

Claims (9)

1. realize a method for data resource access control of authority, it is characterized in that, the method comprises:

The configuration file belonging to data resource access authority information that each application example will use by the server of computer network system carries out local cache;

After receiving the visit data resource request of the corresponding application example that client in computer network system sends, the data resource access authority information that this application example directly calling local cache will use conducts interviews checking, returns the result.

2. the method for claim 1, is characterized in that, the configuration file belonging to data resource access authority information that each application example described will use adopts hash to show mode buffer memory.

3. the method for claim 1, is characterized in that, the method also comprises:

The key value database of a log type is comprised at server, store the data resource access authority information that each application example will use, when updated, data resource access authority information identification renewal mark that the application example in this database will use is upgraded.

4. method as claimed in claim 3, it is characterized in that, the key value database of described log type adopts redis assembly to realize, the data resource access authority information that the application example in this database described will use identification renewal mark adopts hash table mode to store.

5. method as claimed in claim 3, it is characterized in that, the method also comprises: database described in each application example timing asynchronous access of described local cache, obtain the data resource access authority information upgraded that this application example uses, cover the data resource access authority information that this application example in buffer memory uses.

6. method as claimed in claim 5, is characterized in that, database described in the asynchronous timer access of described application example completes for adopting asynchronous timed thread.

7. realize a system for data resource access control of authority, it is characterized in that, comprising: local cache unit, request-response unit and authentication unit, wherein,

Local cache unit, carries out local cache for the configuration file belonging to the data resource access authority information that will be used by each application example;

Request-response unit, receives the visit data resource request of the corresponding application example that the client in computer network system sends;

Authentication unit, the data resource access authority information that this application example directly calling local cache will use conducts interviews checking, returns the result.

8. system as claimed in claim 7, it is characterized in that, also comprise the key value database of log type, for storing the data resource access authority information that each application example will use, when updated, data resource access authority information identification renewal mark that application example will use directly is upgraded.

9. system as claimed in claim 8, it is characterized in that, described local cache unit, also for the key value database of log type described in each application example timing asynchronous access, obtain the data resource access authority information upgraded that this application example uses, cover the data resource access authority information that this application example in buffer memory uses.