Mutual trust switching method of remote applications driven by cloud native gateway

Abstract

The invention discloses a mutual trust switching method of remote applications driven by a cloud native gateway, which relates to the technical field of mutual trust switching and comprises the following steps: establishing a user identity authentication channel, and determining an access priority strategy; generating a station transfer token, and sending a first request instruction; analyzing the starting login site information of the user; detecting activity according to the operation state of the sequential system, generating a second request instruction, and sending the second request instruction to the central gateway; configuring an application system address, and forwarding the first request instruction to a target application system; judging whether the first request instruction is credible or not, if yes, obtaining a local application system user permission, loading a local application system function, and displaying a current service system identifier; and setting a public drop-down list component, and switching to different business system services in various regions through the component. According to the method and the device, the technical problems of low switching process response speed and unsafe cross-system access during remote application switching in the prior art are solved, and the technical effect of improving the cross-system access speed and safety is achieved.

Description

Technical Field

[0001] The present invention relates to the technical field of mutual trust switching, and in particular to a mutual trust switching method for remote applications driven by a cloud native gateway. Background Art

[0002] With the rapid development of cloud computing and distributed system technologies, the demand for interconnection between remote applications is growing, especially in cross-regional business collaboration and data sharing. Cloud-native gateway-driven application switching technology has been widely used in many fields. However, with the continuous expansion of business scale and the complexity of application architecture, the management and coordination of the mutual trust switching process between remote applications are also facing increasing challenges. Traditional remote application switching methods have problems such as slow response speed of the switching process and insecure cross-system access, which are difficult to meet the needs of modern business systems for efficient, secure, and flexible switching. Summary of the invention

[0003] The present application provides a mutual trust switching method for remote applications driven by a cloud native gateway, which is used to solve the technical problems of slow switching process response and insecure cross-system access when switching remote applications in the prior art.

[0004] In view of the above problems, the present application provides a mutual trust switching method for remote applications driven by a cloud native gateway.

[0005] The present application provides a mutual trust switching method for remote applications driven by a cloud native gateway, the method comprising:

[0006] Establish a user identity authentication channel, determine the access priority strategy according to the access connection relationship between the user and the application system site; encrypt the user identity and current site information to generate a transfer token, and send a first request instruction with the transfer token to the transfer logic intermediate interface; after the transfer logic intermediate interface receives the first request instruction, parse the user's initial login site information from the transfer token; according to the access priority strategy, perform activation according to the sequential system operation status, and send the application system address and key that have successfully activated and are in high priority as the second request instruction to the central gateway; after the central gateway receives the second request instruction, configure multiple application system addresses that agree to enter mutual trust access, and forward the first request instruction to the target application system according to the application system mapping table; the target application system determines whether the forwarded first request instruction is credible based on the parsed user information, and if it is credible, obtains the user rights of the local application system based on the parsed user information, loads the local application system function, and displays the current business system identifier in a prominent position; the current business system identifier sets a public drop-down list component, and the drop-down list content corresponding to the public drop-down list component is a list of all business systems that the user has permissions for, and switches to different business system services in different places through the public drop-down list component.

[0007] One or more technical solutions provided in this application have at least the following technical effects or advantages:

[0008] The present application establishes a user identity authentication channel, determines the access priority strategy according to the access connection relationship between the user and the application system site; encrypts the user identity and current site information to generate a transfer token, and sends a first request instruction with the transfer token to the transfer logic intermediate interface; after the transfer logic intermediate interface receives the first request instruction, parses the user's starting login site information from the transfer token; according to the access priority strategy, the system operation status is detected in sequence, and the address and key of the application system with high priority that has been successfully detected are sent to the central gateway as the second request instruction; after the central gateway receives the second request instruction, it configures multiple application system addresses that agree to enter mutual trust access, and forwards the first request instruction to the target application system according to the application system mapping table; the target application system determines whether the forwarded first request instruction is credible based on the parsed user information, and if it is credible, obtains the user rights of the local application system based on the parsed user information, loads the local application system function, and displays the current business system logo in a prominent position; the current business system logo sets a public drop-down list component, and the drop-down list content corresponding to the public drop-down list component is a list of all business systems that the user has permissions for, and switches to different business system services in different places through the public drop-down list component. The present invention solves the technical problems of slow response speed of the switching process and insecure cross-system access in the prior art when switching applications in different locations. Through user identity authentication, encrypted transmission of transfer tokens, priority policy detection, central gateway configuration and request forwarding, secure mutual trust switching between applications in different locations is realized, achieving the technical effect of improving the speed and security of cross-system access. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0010] Figure 1 A flow chart of a method for mutual trust switching of remote applications driven by a cloud-native gateway provided in an embodiment of the present application. DETAILED DESCRIPTION

[0011] This application provides a mutual trust switching method for remote applications driven by a cloud native gateway, which is used to solve the technical problems of slow switching process response and insecure cross-system access in the prior art when switching remote applications. Through user identity authentication, encrypted transmission of transfer tokens, priority policy detection, central gateway configuration and request forwarding, secure mutual trust switching between remote applications is achieved, achieving the technical effect of improving cross-system access speed and security.

[0012] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0013] It should be noted that any variations of the terms "include" and "have" are intended to cover non-exclusive inclusions. For example, a process, method, system, product or server that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or modules that are not explicitly listed or inherent to these processes, methods, products or devices.

[0014] like Figure 1 As shown, the present application provides a mutual trust switching method for remote applications driven by a cloud native gateway, and the method includes:

[0015] Step S100: Establish a user identity authentication channel and determine the access priority strategy according to the access connection relationship between the user and the application system site.

[0016] In the embodiment of the present application, first, a standard authentication protocol such as OAuth2.0, J, etc. is used to connect with the authentication server to create a secure authentication channel. This process includes receiving user credentials, such as user name, password or multi-factor authentication information, and generating an identity token. The identity token is an encrypted identifier of the user's identity, which is used to securely transmit the user's identity information between application systems. After the authentication channel is established, the connection relationship between the user and multiple application system sites is queried based on the user's identity information and access history. The connection relationship mainly includes data such as the address of the application system that the user has visited, the access frequency, the access duration, and the response speed of the application system. These data are automatically generated by the log analysis system. After obtaining the connection relationship between the user and the application system site, these sites are sorted and an access priority strategy is generated. Specifically, the calculation is performed based on the site response speed, user access frequency and site status. When calculating, the obtained site response speed, user access frequency and site status are first normalized, and then weighted calculation is performed through preset weights to obtain the priority value of each application system. Then a priority strategy table is generated based on these priority values ​​to record the access order of users between different application systems. Among them, sites with high priority are placed in front to ensure that users are connected to more suitable systems first when visiting.

[0017] Step S200: Encrypt the user identity and current site information to generate a transfer token, and send a first request instruction with the transfer token to the transfer logic intermediate interface.

[0018] In the embodiment of the present application, the user's identity information and current site information are first obtained. This information is the basic data for subsequent encryption. Then, the above data is encrypted using symmetric encryption technology, such as the AES algorithm, and the same key is used for encryption and decryption operations. Through encryption processing, a transfer token is generated, which contains the encrypted user identity information and current site information to ensure the security and integrity of the data during transmission.

[0019] After the transfer token is generated, it is used as a parameter to construct a first request instruction, and the instruction is sent to the transfer logic intermediate interface. The first request instruction contains the transfer token, which is used to transmit encrypted user identity and site information between different systems.

[0020] Step S300: After the transfer logic intermediate interface receives the first request instruction, the user's initial login site information is parsed from the transfer token.

[0021] In an embodiment of the present application, first, the transfer logic intermediate interface receives a first request instruction, which contains an encrypted transfer token. The token is passed through a specific field in the request header or request body. An HTTP request parsing tool or framework is used to parse the request content and extract the transfer token field.

[0022] Once the transfer token is extracted, the transfer logic intermediate interface uses symmetric decryption technology to decrypt the token. Using the same key as used for encryption, the interface decrypts and restores the original user data. In this step, ensure that the decryption key is consistent with the encryption key, and store and retrieve the key through a secure key management mechanism such as AWS KMS.

[0023] The decrypted transfer token contains a data structure in JSON format, which records the user's identity information and the initial login site information. Using the JSON parsing library, the interface extracts the user's initial login site information from the decrypted data. This includes the system ID, IP address, or other identifiers of the user's first login.

[0024] Through the above steps, the transfer logic intermediate interface decrypts and parses the user's initial login site information from the received first request instruction.

[0025] Step S400: According to the access priority strategy, the system operation status is detected in order, and the address and key of the application system with high priority that has been successfully detected are sent to the central gateway as a second request instruction.

[0026] In the embodiment of the present application, the pre-generated access priority policy table is first read, and then the application systems are probed one by one according to the priority order. The probing process uses HTTP / HTTPS request mode to access the health status check interface of the application system by sending a GET request or a HEAD request. The interface will return an HTTP status code, such as 200 for normal and 503 for unavailable.

[0027] After receiving the live detection response from each application system, parse the HTTP status code and response time to determine the health status of the system. Through analysis, if the returned status code is 200 and the response time is within the preset threshold, such as within 500ms, the application system is considered to be in a healthy state and the live detection is successful. If the status code is not 200 or the response time exceeds the threshold, the live detection fails and the next priority application system is continued to be detected.

[0028] When the detection is successful, the address information and key of the application system are recorded. The address information is used for target positioning of subsequent requests, and the key is the identity authentication information provided when accessing the API. The key is generated through the OAuth 2.0 authentication mechanism or JWT to ensure the security of data transmission between the application system. At this time, the key is encrypted through symmetric encryption technology to ensure the security of the key during transmission.

[0029] After recording the high-priority application system information that has been successfully activated, this information is encapsulated into a second request instruction. The second request instruction is a data structure in JSON format, which contains the address of the application system, the encrypted key, and other necessary access parameters. Use the JSON serialization library to package this information into a JSON string for transmission.

[0030] Then, an HTTP POST request is used to send the second request instruction to the API interface of the central gateway. The central gateway is a core component that manages and schedules access to multiple application systems, and uses a load balancer and API Gateway to receive and distribute requests.

[0031] Step S500: After receiving the second request instruction, the central gateway configures multiple application system addresses that agree to enter into mutual trust access, and forwards the first request instruction to the target application system according to the application system mapping table.

[0032] In the embodiment of the present application, the central gateway, as the core component for managing and scheduling requests, receives the second request instruction. The central gateway uses a built-in security verification module, such as the OAuth 2.0 verification mechanism, to decrypt the encrypted key to ensure the authenticity of the request and the legitimacy of the source. After decryption, the gateway confirms that the request comes from a verified application system to ensure the security of the data transmission process.

[0033] Next, the central gateway configures the application system addresses for mutual trust access. This step is completed by consulting the application system mapping table. The application system mapping table is a database table used to store different application system addresses and their mapping relationships. The table records the mutual trust relationship, access path and corresponding priority between each application system. The gateway obtains the application system address list in the mapping table through SQL query. These addresses represent the application systems that agree to enter mutual trust access. By querying these mapping relationships, it is determined to which target application system the user request should be forwarded in the current environment.

[0034] After completing the configuration of the application system address for mutual trust access, the central gateway forwards the first request instruction to the corresponding target application system according to the target address information in the second request instruction. To achieve this forwarding process, the central gateway uses the HTTP reverse proxy function to route the request to the specific address of the target application system. After the forwarding is completed, the first request instruction is successfully delivered to the target application system.

[0035] Step S600: The target application system determines whether the first request instruction forwarded is credible based on the parsed user information. If credible, it obtains user permissions of the local application system based on the parsed user information, loads local application system functions, and displays the current business system logo in a prominent position.

[0036] In the embodiment of the present application, the target application system first parses the user information from the first request instruction. The parsing process uses the JSON parsing method to parse the JSON data structure in the first request instruction, extracting the user ID, user role, and encrypted access credentials, such as JWT tokens. Through this step, the user identity information for subsequent verification is obtained.

[0037] The target application system then uses the JWT token verification method to determine whether the first request instruction is credible. JWT contains encrypted user information and signature. By verifying the signature part of the JWT, it is ensured that the token is generated by a credible issuer and is within the validity period. Successful verification indicates that the request source is reliable and the data has not been tampered with.

[0038] If the verification is successful, the user's local permissions are obtained from the user permissions database using a database query method. Specifically, the permission data of the user in the current application system is queried based on the parsed user ID through an SQL query statement. The result includes a list of functional modules that the user can access and executable operations.

[0039] After obtaining user permissions, use the module loading method to enable the corresponding local functions. According to the user's permission information, load or enable the corresponding function module so that the user can access the operation interface within his or her permission range. This step is achieved by dynamically enabling or disabling specific microservice modules in frameworks such as Spring Boot.

[0040] Finally, use the front-end rendering method to display the current business system logo in a prominent position. Through the front-end framework, the name and logo information of the current business system are rendered to the top or sidebar of the user interface so that users can clearly know the system they are currently using.

[0041] Step S700: The current business system identifier sets a public drop-down list component, and the drop-down list content corresponding to the public drop-down list component is a list of all business systems that the user has permission to use. The public drop-down list component is used to switch to different business system services in different places.

[0042] In an embodiment of the present application, a public drop-down list component is set in the current business system identifier, and the drop-down list content of the component displays a list of all business systems that the user has permission to access. By obtaining the user's permission information from the permission management database, the names and identifiers of these authorized business systems are loaded into the drop-down list. The user can click on the drop-down list on the interface to view and select different business systems. When the user selects a system, the front-end component captures the selection and sends a request to the back-end. After receiving the request, jump according to the business system identifier selected by the user to complete the user's switching between different business system services.

[0043] Through the above process, users can quickly access multiple business systems to which they have permissions through an integrated drop-down list interface.

[0044] Furthermore, the method provided in the application embodiment also includes:

[0045] The authentication constraint conditions of the user identity authentication channel are bidirectionally synchronized and unified for the main data.

[0046] In an embodiment of the present application, the authentication constraint of the user authentication channel is the unification of bidirectional synchronization of master data, that is, during the user authentication process, the user's master data, such as identity information, role, authority, etc., is required to be bidirectionally synchronized between all relevant systems. Bidirectional synchronization means that when user information changes in a certain system, the data will be automatically updated to other systems to ensure that the user's master data in each system is always consistent. This synchronization mechanism ensures that no matter which system the user authenticates through, it can be verified based on consistent identity information, thereby improving the accuracy of authentication and the consistency of data.

[0047] Furthermore, the method provided in the application embodiment also includes:

[0048] Configure access policies, which include the relationship between users and roles, the relationship between roles and application system addresses, and the access priority level of each application system.

[0049] In the embodiment of the present application, the relationship between users and roles is first established through a database configuration method. In this process, each user and its corresponding role information are stored in the database. The role represents the scope of authority of the user in the system, such as "administrator", "ordinary user", etc. The user is associated with the corresponding role by executing an SQL statement. Through this step, a user role relationship table is generated, which records each user and their corresponding role.

[0050] Next, configure the relationship between the role and the application system address, which can be achieved through permission management tools such as the system management interface or configuration files. Specifically, define a list of application system addresses that each role can access. These addresses are the URL, IP address, or API endpoint of the application system. Enter the role and the application system address that it is allowed to access in the system configuration interface, and store this information in the role-system relationship table.

[0051] Then, configure access priorities for each application system. Access priorities are used to determine which system should prioritize user requests when a user has access to multiple application systems. A priority value is assigned to each application system through the configuration file. The higher the priority value, the higher the priority order of the system to process the request. These priority settings will be read by the system and stored in a priority table to guide the system's selection when accessing multiple systems.

[0052] After completing the above configuration, integrate the user role relationship table, role system relationship table, and priority table to form a complete access strategy.

[0053] Furthermore, the method provided in the application embodiment also includes:

[0054] Obtain the user identity token, the user's organization, the current application system identifier, and the identity certificate and use symmetric encryption technology to generate a transfer token; detect the transfer middleware service corresponding to the transfer logic intermediate interface to determine whether the transfer middleware service exists. If so, call the transfer middleware service; if not, directly open the homepage of the local application system; at the same time, when calling the transfer middleware service, bring the transfer token to the transfer middleware service.

[0055] In the embodiment of the present application, the user's identity information is first collected, including the user identity token, the organization information to which the user belongs, the current logged-in application system identifier, and the user's identity information. This information will be used as the basic data for encryption and subsequent secure transmission and authentication.

[0056] Next, symmetric encryption technology, such as the AES algorithm, is used to encrypt this information and generate a transfer token. Symmetric encryption is a technology that uses the same key for encryption and decryption, and is used to protect the security of sensitive data during transmission. In this step, the collected user identity data is encrypted into a ciphertext string through an encryption function. The resulting transfer token can be safely passed between different systems without exposing the user's sensitive information.

[0057] After the transfer token is generated, the transfer middleware service of the transfer logic intermediate interface is checked to confirm whether the service is in normal operation. The way to check is to send an HTTP GET request to the health check interface of the transfer middleware service and make a judgment based on the returned status code. If the returned status code is 200, it means that the service is running normally and the check is successful; if the returned status code is not 200, it is considered that the service is currently unavailable.

[0058] If the detection result shows that the transfer middleware service exists and is running normally, a request is sent to the service, and the previously generated transfer token is carried in the request. This operation is completed by sending a POST request containing the transfer token to the specified interface of the transfer middleware service. In this way, when the transfer middleware service is called, the transfer token is sent to the server along with the request. The transfer middleware service can decrypt the token and extract the user identity information and related data for subsequent identity authentication and access authorization.

[0059] If the detection result shows that the transfer middleware service is unavailable, the service will not be called, but the homepage of the local application system will be opened directly. This step is completed through the redirection operation of the front-end page or the interface rendering of the local application, ensuring that users can continue to use the current application service when the transfer service is unavailable.

[0060] Furthermore, the method provided in the application embodiment also includes:

[0061] The first request instruction is received at the transfer logic intermediate interface, and the user information, current application system identification information, and system identity code are parsed from the transfer token; wherein the user information includes the user account and the organization to which the user belongs, the current application system identification information includes the current application system code and the current application system IP address, and the system identity code refers to the user's effective access function session token code in the current system.

[0062] In the embodiment of the present application, the transfer logic intermediate interface receives a first request instruction including a transfer token. The transfer token includes user identity information, current application system identification information and system identity certification code. To extract this information, the interface performs a decryption operation on the transfer token.

[0063] By using symmetric decryption technology, such as the AES algorithm, the transfer token is decrypted, and the interface restores the encrypted user data through decryption. At this time, the decrypted data is a structured data format, such as JSON or XML, which is used to store various types of information.

[0064] Then, the decrypted data is parsed using the JSON parsing method to extract the user information, the current application system identification information, and the system identification code. The user information includes the user account and the information of the organization to which the user belongs, such as the user's unique ID and the organizational structure name, which are used to identify the user's identity and the organization to which he belongs. The current application system identification information includes the current application system code and IP address, which are used to identify the specific system the user is logged in and its network location. By parsing this information, the interface can accurately obtain the user's source and access environment.

[0065] In addition, the system identity code is extracted during the parsing process. The system identity code is the session token code for the user to effectively access functions in the current application system. It is used to identify the user's active session in the current system and ensure that the user's access status is within the validity period. This session token is usually in JWT format and contains the user's session status and expiration time. After parsing the system identity code, the interface can be further used to verify the user's session validity and ensure the security of the user's access rights.

[0066] Through the above steps, the transfer logic intermediate interface successfully parses the user information, current application system identification information and system identity certification code from the transfer token.

[0067] Furthermore, the method provided in the application embodiment also includes:

[0068] The access policy is obtained, and combined with the user, the organization to which the user belongs, and the current application system identification information in the transfer token, a list of application systems accessible to the user is obtained, and the list of application systems accessible to the user is sorted in reverse order by priority; according to the list of application systems accessible to the user in reverse order of priority, the application system sites are activated one by one, and if the activation is successful, the next application system will not be activated; the address of the successfully activated application system and the user, the organization to which the user belongs, the current application system identification information, the system identity certificate code, and the target application system identification information are symmetric encrypted using technology to generate a new transfer token, and the transfer token is sent to the central gateway as a request parameter.

[0069] In the embodiment of the present application, firstly, the access policy is read, which includes the user role, the organization to which the user belongs, and the access priority of each application system. Combined with the user information (such as user account and organization) parsed from the transfer token and the current application system identification information (such as system ID and IP address), a list of application systems accessible to the user is generated. This list lists all application systems that the user can access in the current organization and system environment.

[0070] Then, the list of applications that users can access is prioritized according to the priority defined in the access policy. The sorting process uses the priority field to sort the applications in the list in reverse order, with higher priority applications at the front of the list, ensuring that when users initiate access requests, high priority applications are given priority, optimizing the user's access experience and the use of system resources.

[0071] After generating a list of user-accessible application systems in reverse order of priority, start probing these application systems one by one. The purpose of probing is to verify the operating status of each application system and ensure that the user is connected to a healthy system. The probing process uses HTTP GET request or PING command to send a probe request to the health check interface of the application system and check whether the returned status code is 200. If the status code is 200, it means that the application system is in normal state and the probing is successful; if the status code is not 200, continue to probe the next application system.

[0072] Once the first high-priority application system is found during the live detection process, the detection of other application systems will be stopped. Successful live detection means that a stable system that can accept user requests has been found, thus avoiding unnecessary further detection operations and improving efficiency.

[0073] Next, the successfully activated application system address is combined with the user information, user organization, current application system identification information, system identity code and target application system identification information in the transfer token, and these data are encrypted using symmetric encryption technology to encrypt these sensitive information into a new transfer token to ensure that the data will not be leaked or tampered with during network transmission. The generated transfer token contains the user's authentication information and the address of the target system to be accessed, providing security for subsequent request processing.

[0074] Finally, the generated new transfer token is used as a request parameter and sent to the central gateway via an HTTP POST request.

[0075] Furthermore, the method provided in the application embodiment also includes:

[0076] Displays a list of all application systems to which the user has access permissions on the current business system, allowing the user to switch back and forth between application systems.

[0077] In an embodiment of the present application, a list of all application systems to which the user has access rights is displayed on the current business system. First, the user's access rights information is obtained through the rights management system. This information contains all application systems that the user can access. Then, the front-end interface displays the names and links of these application systems to the user in the form of a list or menu. The user can switch systems by clicking on an application system in the list. After capturing the user's choice, the user will be taken to the corresponding target application system through redirection or navigation. After completing the operation, the user can still return to the current business system in the same way to ensure free switching between multiple application systems.

[0078] Furthermore, the method provided in the application embodiment also includes:

[0079] The current business system is capable of encrypting, assembling and decrypting the user's identity token, the organization to which the user belongs, the current application system identifier, and the identity verification information.

[0080] In the embodiment of the present application, the current business system has the function of encrypting, assembling and decrypting the user identity token, the organization to which the user belongs, the current application system identifier, and the identity proof information. The system encrypts this information into a data packet through symmetric encryption technology to ensure the security of the information during transmission. At the same time, when the system receives the encrypted data, it uses the same key to decrypt and parse out the original user identity information, organization information, system identifier and identity proof, so as to perform identity authentication and authorization operations. The functions of encryption assembly and decryption analysis ensure the secure transmission and accurate identification of data.

[0081] In the embodiments of the present application, in summary, the embodiments of the present application have at least the following technical effects:

[0082] The present application establishes a user identity authentication channel, determines the access priority strategy according to the access connection relationship between the user and the application system site; encrypts the user identity and current site information to generate a transfer token, and sends a first request instruction with the transfer token to the transfer logic intermediate interface; after the transfer logic intermediate interface receives the first request instruction, parses the user's starting login site information from the transfer token; according to the access priority strategy, the system operation status is detected in sequence, and the address and key of the application system with high priority that has been successfully detected are sent to the central gateway as the second request instruction; after the central gateway receives the second request instruction, it configures multiple application system addresses that agree to enter mutual trust access, and forwards the first request instruction to the target application system according to the application system mapping table; the target application system determines whether the forwarded first request instruction is credible based on the parsed user information, and if it is credible, obtains the user rights of the local application system based on the parsed user information, loads the local application system function, and displays the current business system logo in a prominent position; the current business system logo sets a public drop-down list component, and the drop-down list content corresponding to the public drop-down list component is a list of all business systems that the user has permissions for, and switches to different business system services in different places through the public drop-down list component. The present invention solves the technical problems of slow response speed of the switching process and insecure cross-system access in the prior art when switching applications in different locations. Through user identity authentication, encrypted transmission of transfer tokens, priority policy detection, central gateway configuration and request forwarding, secure mutual trust switching between applications in different locations is realized, achieving the technical effect of improving the speed and security of cross-system access.

[0083] It should be noted that the above-mentioned sequence of the embodiments of the present application is only for description and does not represent the advantages and disadvantages of the embodiments. And the above-mentioned specific embodiments of this specification are described. The processes depicted in the accompanying drawings do not necessarily require the specific order and continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0084] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

[0085] This specification and drawings are merely exemplary illustrations of the present application and are deemed to cover any and all modifications, variations, combinations or equivalents within the scope of the present application. Obviously, a person skilled in the art may make various modifications and variations to the present application without departing from the scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the present application and its equivalents, the present application intends to include these modifications and variations.

Claims

1. A mutual trust switching method for remote applications driven by a cloud native gateway, characterized in that: The method comprises: Establish user identity authentication channels and determine access priority strategies based on the access connection relationship between users and application system sites; Encrypt the user identity and current site information to generate a transfer token, and send a first request instruction with the transfer token to the transfer logic intermediate interface; After the transfer logic intermediate interface receives the first request instruction, parsing the user's initial login site information from the transfer token; According to the access priority strategy, the system operation status is detected in order, and the address and key of the application system with high priority that has been successfully detected are sent to the central gateway as the second request instruction; After receiving the second request instruction, the central gateway configures multiple application system addresses that agree to enter the mutual trust access, and forwards the first request instruction to the target application system according to the application system mapping table; The target application system determines whether the first request instruction forwarded is credible according to the parsed user information. If credible, the target application system obtains the user rights of the local application system according to the parsed user information, loads the local application system function, and displays the current business system logo in a prominent position; The current business system identifier sets a public drop-down list component, and the drop-down list content corresponding to the public drop-down list component is a list of all business systems that the user has permission to use. The public drop-down list component is used to switch to different business system services in different places.

2. The mutual trust switching method for remote applications driven by a cloud native gateway as claimed in claim 1 is characterized in that: The authentication constraint conditions of the user identity authentication channel are bidirectionally synchronized and unified for the main data.

3. The mutual trust switching method for remote applications driven by a cloud native gateway as claimed in claim 2 is characterized in that: Configure access policies, which include the relationship between users and roles, the relationship between roles and application system addresses, and the access priority level of each application system.

4. The mutual trust switching method for remote applications driven by a cloud native gateway as claimed in claim 3 is characterized in that: The method comprises: Obtain the user identity token, the user's organization, the current application system ID, and identity certificate and use symmetric encryption technology to generate a transfer token; Check the transfer middleware service corresponding to the transfer logic intermediate interface to determine whether the transfer middleware service exists. If so, call the transfer middleware service. If it does not exist, directly open the homepage of the local application system; At the same time, when calling the transfer middleware service, bring the transfer token to the transfer middleware service.

5. The mutual trust switching method for remote applications driven by a cloud native gateway as claimed in claim 4 is characterized in that: The method comprises: The first request instruction is received at the transfer logic intermediate interface, and user information, current application system identification information, and system identity certification code are obtained by parsing from the transfer token; Among them, the user information includes the user account and the organization to which the user belongs, the current application system identification information includes the current application system code and the current application system IP address, and the system identity certification code refers to the user's effective access function session token code in the current system.

6. The mutual trust switching method for remote applications driven by a cloud native gateway as claimed in claim 5, characterized in that: The method comprises: Obtain the access policy, and combine the user, the organization to which the user belongs, and the current application system identification information in the transfer token to obtain a list of application systems accessible to the user, wherein the list of application systems accessible to the user is sorted in reverse order by priority; According to the list of user-accessible application systems in reverse order of priority, the application system sites are activated one by one. If the activation is successful, the next application system will not be activated. The successfully activated application system address and user, the user's organization, the current application system identification information, the system identity code, and the target application system identification information are symmetric encrypted to generate a new transfer token, which is sent to the central gateway as a request parameter.

7. The mutual trust switching method for remote applications driven by a cloud native gateway as claimed in claim 1, characterized in that: Displays a list of all application systems to which the user has access permissions on the current business system, allowing the user to switch back and forth between application systems.

8. The mutual trust switching method for remote applications driven by a cloud native gateway as claimed in claim 1, characterized in that: The current business system is capable of encrypting, assembling and decrypting the user's identity token, the organization to which the user belongs, the current application system identifier, and the identity verification information.

Images