Distributed authorization management system and implementation method thereof

Abstract

The invention discloses an authorization management system, which belongs to the technical field of information security. The system comprises an authorization management server, at least one application device and at least one user device which are connected with one another through a network, wherein the authorization management server at least comprises an authority management device, a purchase management system (PMS) manager, an attribute certificate signing and issuing device, a certificate agency (CA) directory server, a purchase management index (PMI) directory server and a middleware device. The invention can provide the authorization management system and an implementation method of the system. A user group is authorized in the way of a rule group, a working group and an individual, support can be provided for a large number of users who do not register in the system and authorization information is released by an attribute certificate, so that the possibility of personal tampering can be effectively avoided, and uniform user authorization information and security access control can be provided for a plurality of application systems.

Description

technical field The present invention relates to the technical field of information security, in particular to a distributed authorization management system and an implementation method thereof. Background technique With the improvement of government and enterprise informatization, the number of application systems has gradually increased. When the number of users is very large, the geographical distribution is relatively wide, and the number of application systems is large, the authorization of application systems becomes a very difficult problem. In a large government or enterprise, the following situations often occur: an employee has left the job, but can still access some very important application systems normally; an employee's position has changed, and the application system still corresponds to the old permissions; Due to temporary business needs, I registered an account for someone from other places in an application system and opened the application permissions, ...

AI Technical Summary

Problems solved by technology

(2), patent application CN 200610076491.3 (application date: 2006.04.26, name: information system or equipment security protection system and its working method), CN 200810040672.X (application date: 2008.07.17, name: digital certificate-based technology system user access management system and method), CN 200810040674.9 (application date: 2008.07.17, name: an access control method and device for an information system based on digital certificate technology), CN 200620100455.1 (application date: 2006.01.18, name : a network security authentication and authorization system) and CN 200710147233.4 (application date: 2007.08.30, name: distributed business operation support system and method for realizing distributed business) both disclose a kind of identity authentication for login users, and in Technical solutions for obtaining corresponding access rights after passing authentication, but these technical solutions lack security management of user rights information, cannot effectively avoid the possibility of human tampering, and support a limited number of users, which cannot solve a large number of users (especially A large number of users who are not registered in the system) unified authorization and security access control issues

The disadvantage of the above technical solutions is that they cannot authorize a large number of user groups, and publish the authorization information in a reliable form of attribute certificates, so as to realize unified user authorization management and security access control of multiple application systems

Images