Unified identity authentication and collaborative office workbench access platform and method

Abstract

This invention provides a unified identity authentication and collaborative workbench access platform and method, belonging to the field of user identity software authentication technology. The collaborative workbench module receives a user-initiated access request for a business system containing the identifier of the target business system and sends it to the unified access orchestration module. The unified access orchestration module queries the authentication routing policy from the access policy library based on the target business system identifier, then calls the unified identity authentication platform module to complete user authentication and obtain unified identity token information. Based on the authentication routing policy, it generates authentication data recognizable by the target business system from the unified identity token, verifies the user's access permissions, and forwards the authentication data to the target business system if the permission verification passes. The target business system establishes a login session based on the received authentication data and returns the access result to the unified access orchestration module. This invention achieves unified access control for multiple business systems.

Description

Technical Field

[0001] This invention belongs to the field of user identity software authentication technology. Specifically, this invention relates to a unified identity authentication and collaborative office workbench access platform and method. Background Technology

[0002] As large manufacturing enterprise groups continue to advance their digital and intelligent transformation, they have gradually built various types of business application systems, including collaborative office systems, human resources systems, financial systems, procurement systems, data governance platforms, master data platforms, production management systems, project management systems, and customer relationship management systems. These business application systems are typically built by different vendors, employing different technical architectures and authentication mechanisms. They differ significantly in authentication protocol types, token formats, user attribute fields, and permission models, exhibiting obvious heterogeneity among the systems.

[0003] Chinese Patent 101047508A relates to a login authentication system for logging into multiple accounts on different application systems. The login authentication system includes multiple application system servers identified by different serial numbers. Each application system server performs a login operation on the received login authentication data. The system also includes: an input device that receives user-inputted identity information and sends it to a login processing module; a login processing module that forwards the identity information to the authentication processing system and sends the returned login authentication data to the corresponding application system server according to the server serial number; a database storing login authentication data, its corresponding server serial number, and the user's identity information; and an authentication processing system that retrieves the corresponding login authentication data and server serial number from the database based on the identity information and sends it to the login processing module.

[0004] Existing identity authentication platforms typically require point-to-point access configuration with each business system. Different business systems have varying capabilities in supporting authentication protocols and authentication data formats, resulting in complex access processes, a large workload for configuration, and high maintenance costs in the later stages, making it difficult to achieve unified and efficient management. Summary of the Invention

[0005] The present invention aims to provide a unified identity authentication and collaborative office workbench access platform and method to achieve unified access control for multiple business systems, reduce the complexity of accessing multiple business systems, and improve the system's scalability and operational stability.

[0006] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0007] This invention provides a unified identity authentication and collaborative office workbench access platform, including a collaborative office workbench module, a unified access orchestration module, a unified identity authentication platform module, and a business system access module;

[0008] The collaborative office workbench module is used to receive user login requests and business system access requests, and send access request information containing the target business system identifier to the unified access orchestration module.

[0009] The unified access orchestration module serves as an intermediate access proxy layer between the collaborative office workbench and the unified identity authentication platform.

[0010] The unified identity authentication platform module is used to complete user identity authentication processing and generate unified identity token information.

[0011] The business system access module is used to receive authentication request data after it has been converted by the unified access orchestration module, and to establish a business system login session based on the authentication data.

[0012] The unified access orchestration module includes an access routing submodule, a protocol adaptation submodule, a parameter mapping submodule, and an access control submodule;

[0013] The access routing submodule is used to match the corresponding authentication routing policy from the pre-configured access policy library based on the target business system identifier, and to determine the authentication process path and the target authentication protocol type;

[0014] The protocol adaptation submodule is used to convert the unified identity token from the unified identity authentication platform into a protocol format that can be recognized by the target business system, according to the authentication routing policy.

[0015] The parameter mapping submodule is used to map user attribute fields in authentication data, mapping unified identity fields to the corresponding field structure of the target business system;

[0016] The access control submodule is used to verify user access permissions before forwarding access requests, and to determine whether access to the target business system is allowed based on user role information, organization information, and business system access policies.

[0017] The unified identity authentication platform module includes a user authentication unit, a token generation unit, and a session management unit;

[0018] The user authentication unit is used to authenticate user identity through the authentication database;

[0019] The token generation unit is used to return the signing key through the key management system and generate a signing token for the session management unit;

[0020] The session management unit is used to record session status, return session IDs, and generate unified identity tokens.

[0021] This invention provides a method for accessing a unified identity authentication and collaborative office workbench platform, comprising the following steps:

[0022] Step 1: The collaborative office workbench module receives the business system access request initiated by the user and sends the access request containing the target business system identifier to the unified access orchestration module;

[0023] Step 2: The unified access orchestration module queries the corresponding authentication routing policy from the access policy library based on the target business system identifier;

[0024] Step 3: The unified access orchestration module calls the unified identity authentication platform module to complete user identity authentication and obtain unified identity token information;

[0025] Step 4: The unified access orchestration module performs protocol conversion and parameter mapping on the unified identity token according to the authentication routing policy, generating authentication data that can be recognized by the target business system;

[0026] Step 5: The unified access orchestration module verifies user access permissions. If the permission verification passes, the authentication data is forwarded to the target business system.

[0027] Step Six: The target business system establishes a login session based on the received authentication data and returns the access result to the unified access orchestration module. The unified access orchestration module then feeds back the access result to the collaborative office workbench module for status updates.

[0028] In step two, the authentication routing strategy includes the authentication process path and the target authentication protocol type.

[0029] In step three, the user authentication unit queries the corresponding user's identity information from the authentication database. After successful verification, it sends an authentication success signal to the token generation unit. The token generation unit requests a signature key from the key management system and generates an issued token containing the user's identity information and permission information. The session management unit generates a unique session ID and returns a complete unified identity token to the unified access orchestration module.

[0030] In step four, the unified identity token from the unified identity authentication platform is converted into a protocol format according to the authentication routing policy, and the unified identity token is converted into an authentication data format that the target business system can recognize.

[0031] The user attribute fields in the authentication data are mapped to the corresponding field structure of the target business system.

[0032] In step five, user access permissions are verified before the access request is forwarded. Based on user role information, organization information, and business system access policies, it is determined whether access to the target business system is allowed.

[0033] The technical effects of this invention are as follows:

[0034] (1) This invention differs from the traditional point-to-point access mode. It constructs an intermediate proxy layer through a unified access orchestration module to realize centralized management and dynamic orchestration of authentication access processes for multiple business systems. It eliminates the need for separate customization of interface configurations for each heterogeneous business system, greatly simplifies the access process of business systems, reduces the workload of access configuration, and significantly reduces the complexity of system integration.

[0035] (2) This invention relies on the protocol adaptation submodule to realize the self-adaptive conversion of the authentication protocol, which can dynamically convert the standard token generated by the unified identity authentication platform into an authentication data format compatible with different business systems, effectively adapt to the heterogeneous differences in authentication protocols and token formats of various business systems, solve the login failure and authentication anomaly caused by protocol mismatch, and improve the compatibility of multi-system access.

[0036] (3) This invention uses a parameter mapping submodule combined with a preset attribute mapping table to complete the automatic mapping and reorganization of the unified identity field and the private user attribute fields of each business system, avoiding the authentication failure problem caused by the mismatch of user identity field structure, realizing the standardization and consistent transmission of user identity information across systems, and ensuring the accuracy of identity data flow.

[0037] (4) The present invention adds a permission control sub-module to realize centralized permission verification before access, replacing the decentralized permission management mode of each business system, solving problems such as inconsistent permissions across systems and unauthorized access, realizing group-level permission linkage control, and improving the overall access security control capability.

[0038] (5) This invention uses the collaborative office workbench as a unified access point, and realizes one-click access to business systems through unified access orchestration. Users do not need to log in repeatedly or switch between multiple system entrances, simplifying the system access link, optimizing the employee office operation experience, and solving the problems of complex access links and cumbersome switching between multiple systems.

[0039] (6) This invention centrally completes user authentication, token generation and session management through a unified identity authentication platform, realizes centralized control of user identity and session status, avoids session chaos and status asynchrony caused by decentralized session management of various business systems, standardizes authentication interaction process to reduce system anomalies and improves overall system operation stability.

[0040] (7) The present invention adopts a unified access, automatic adaptation and centralized management and control solution, which greatly reduces the manpower and time costs of customized development, system docking and debugging and subsequent operation and maintenance, effectively reduces the information system integration and full life cycle operation and maintenance costs of large manufacturing enterprise groups, and meets the cost reduction and efficiency improvement needs of the group's digital and intelligent transformation. Attached Figure Description

[0041] This manual includes the following figures, which illustrate the following:

[0042] Figure 1 This is a flowchart of a unified identity authentication and collaborative office workbench access platform and method according to the present invention. Detailed Implementation

[0043] The specific embodiments of the present invention will be further described in detail below with reference to the accompanying drawings, in order to help those skilled in the art to have a more complete, accurate and in-depth understanding of the inventive concept and technical solution of the present invention, and to facilitate its implementation.

[0044] This invention provides a unified identity authentication and collaborative office workbench access platform, including a collaborative office workbench module, a unified access orchestration module, a unified identity authentication platform module, and a business system access module;

[0045] The collaborative office workbench module is used to receive user login requests and business system access requests, and send access request information containing the target business system identifier to the unified access orchestration module.

[0046] The unified access orchestration module serves as an intermediate access proxy layer between the collaborative office workbench and the unified identity authentication platform.

[0047] The unified identity authentication platform module is used to complete user identity authentication processing and generate unified identity token information.

[0048] The business system access module is used to receive authentication request data after it has been converted by the unified access orchestration module, and to establish a business system login session based on the authentication data.

[0049] The unified access orchestration module includes an access routing submodule, a protocol adaptation submodule, a parameter mapping submodule, and an access control submodule;

[0050] The access routing submodule is used to match the corresponding authentication routing policy from the pre-configured access policy library based on the target business system identifier, and to determine the authentication process path and the target authentication protocol type;

[0051] The protocol adaptation submodule is used to convert the unified identity token from the unified identity authentication platform into a protocol format that can be recognized by the target business system, according to the authentication routing policy.

[0052] The parameter mapping submodule is used to map user attribute fields in authentication data, mapping unified identity fields to the corresponding field structure of the target business system;

[0053] The access control submodule is used to verify user access permissions before forwarding access requests, and to determine whether access to the target business system is allowed based on user role information, organization information, and business system access policies.

[0054] The unified identity authentication platform module includes a user authentication unit, a token generation unit, and a session management unit;

[0055] The user authentication unit is used to authenticate user identity through the authentication database;

[0056] The token generation unit is used to return the signing key through the key management system and generate a signing token for the session management unit;

[0057] The session management unit is used to record session status, return session IDs, and generate unified identity tokens.

[0058] This invention provides a method for accessing a unified identity authentication and collaborative office workbench platform, comprising the following steps:

[0059] Step 1: The collaborative office workbench module receives the business system access request initiated by the user and sends the access request containing the target business system identifier to the unified access orchestration module;

[0060] Step 2: The unified access orchestration module queries the corresponding authentication routing policy from the access policy library based on the target business system identifier;

[0061] Step 3: The unified access orchestration module calls the unified identity authentication platform module to complete user identity authentication and obtain unified identity token information;

[0062] Step 4: The unified access orchestration module performs protocol conversion and parameter mapping on the unified identity token according to the authentication routing policy, generating authentication data that can be recognized by the target business system;

[0063] Step 5: The unified access orchestration module verifies user access permissions. If the permission verification passes, the authentication data is forwarded to the target business system.

[0064] Step Six: The target business system establishes a login session based on the received authentication data and returns the access result to the unified access orchestration module. The unified access orchestration module then feeds back the access result to the collaborative office workbench module for status updates.

[0065] In step two, the authentication routing strategy includes the authentication process path and the target authentication protocol type.

[0066] In step three, the user authentication unit queries the corresponding user's identity information from the authentication database. After successful verification, it sends an authentication success signal to the token generation unit. The token generation unit requests a signature key from the key management system and generates an issued token containing the user's identity information and permission information. The session management unit generates a unique session ID and returns a complete unified identity token to the unified access orchestration module.

[0067] In step four, the unified identity token from the unified identity authentication platform is converted into a protocol format according to the authentication routing policy, and the unified identity token is converted into an authentication data format that the target business system can recognize.

[0068] The user attribute fields in the authentication data are mapped to the corresponding field structure of the target business system.

[0069] In step five, user access permissions are verified before the access request is forwarded. Based on user role information, organization information, and business system access policies, it is determined whether access to the target business system is allowed.

[0070] The following is a detailed description of the unified identity authentication and collaborative office workbench access platform of the present invention.

[0071] The present invention provides a unified identity authentication and collaborative office workbench access platform, comprising a collaborative office workbench module, a unified access orchestration module, a unified identity authentication platform module, and a business system access module.

[0072] The collaborative office workbench module serves as the user interaction entry point, receiving user login requests and business system access requests, and sending access request information containing the user ID and target business system identifier (TargetSysID) to the unified access orchestration module. The unified access orchestration module, as the core intermediate access proxy layer, is responsible for routing decisions, protocol conversion, parameter mapping, and permission verification. The unified identity authentication platform module is responsible for completing user identity authentication, generating a unified format identity token, and managing user sessions. The business system access module receives the converted standard authentication request and completes the establishment of the login session for the target business system.

[0073] The collaborative office workbench module serves as a unified entry point for enterprise users to access all business systems. Its functions include: receiving login requests and target business system access requests from enterprise users, encapsulating them into standard request messages containing UserID and TargetSysID, and sending them to the unified access orchestration module; receiving authentication status and access results returned by the unified access orchestration module, rendering the user's workbench page, and displaying the business system entry points that the user is authorized to access; and updating the status and visibility of business system entry points in real time through configuration update information pushed by the configuration center.

[0074] The unified access orchestration module is the core module of this invention, comprising an access routing submodule, a protocol adaptation submodule, a parameter mapping submodule, and an access control submodule. The access routing submodule communicates with the access policy library and is used to match the corresponding authentication routing policy from the access policy library based on the TargetSysID in the request. Based on the matching result, the access routing submodule makes a routing decision and forwards the request to the corresponding protocol adaptation submodule.

[0075] The protocol adaptation submodule communicates with the access routing submodule, the unified identity authentication platform module, and the parameter mapping submodule to perform format conversion between different authentication protocols. Specifically, the protocol adaptation submodule sends a standard authentication request to the unified identity authentication platform module to obtain a unified identity token; then, based on the protocol type of the target business system, it converts the unified token into an authentication data format recognizable by the target business system.

[0076] The parameter mapping submodule communicates with the attribute mapping table and is used to standardize the mapping of user attribute fields in the authentication data. The attribute mapping table pre-stores the correspondence between unified identity fields and private fields of each business system. The parameter mapping submodule queries the corresponding mapping rules based on TargetSysID and reorganizes the user attributes in the unified identity token into the field structure required by the target business system.

[0077] The access control submodule communicates with the access policy library and the business system access module to perform access verification before forwarding access requests. The access policy library stores the user's roles and the corresponding business system access permissions. The access control submodule queries the access policy library based on UserID and TargetSysID to verify whether the user has permission to access the business system. If the verification passes, the request is allowed and forwarded to the business system access module; otherwise, access is denied.

[0078] The unified identity authentication platform module includes a user authentication unit, a token generation unit, and a session management unit. The user authentication unit communicates with the authentication database to verify the legitimacy of user credentials. The authentication database stores the identity information of all users within the enterprise. When it receives an authentication request from the unified access orchestration module, the user authentication unit retrieves the corresponding user's credential information from the authentication database. If the verification is successful, it sends an authentication success signal to the token generation unit.

[0079] The token generation unit communicates with the key management system to generate and issue unified identity tokens. The token generation unit first requests a signing key from the key management system, then generates a standard JWT token or OAuth2.0 token based on the user's identity information and authentication results, returns the signing key, and generates and issues a token to the session management unit.

[0080] The session management unit communicates with the session storage cluster to manage user login session states. It receives tokens issued by the token generation unit and generates session IDs. Finally, it returns the complete token and session ID to the unified access orchestration module.

[0081] The business system access module receives standard authentication requests after they have been converted by the unified access orchestration module. The business system access module then parses out the user's identity and permission information and establishes a local login session for the user.

[0082] In this invention, the collaborative office workbench module is deployed on the user's computer, while the unified access orchestration module, the unified identity authentication platform module, and the business system access module are deployed on the server.

[0083] The following describes in detail a method for accessing a unified identity authentication and collaborative office workbench platform according to the present invention.

[0084] A user initiates an access request by logging into the collaborative office workbench module and clicking the entry icon for the target business system. The collaborative office workbench module receives the access request, encapsulates it into an HTTP request containing UserID and TargetSysID, and sends it to the unified access orchestration module.

[0085] The access routing submodule of the unified access orchestration module receives the request, extracts the TargetSysID, and queries the access policy library for the corresponding authentication routing policy. The access policy library returns the authentication process path and target authentication protocol type corresponding to the business system.

[0086] The protocol adaptation submodule of the unified identity authentication and unified access orchestration module sends a standard authentication request to the unified identity authentication platform module according to the authentication routing policy. The unified identity authentication platform module internally executes the following authentication process: the user authentication unit queries the corresponding user's identity information from the authentication database, and after successful verification, sends an authentication success signal to the token generation unit; the token generation unit requests a signing key from the key management system and generates a signed token containing user identity and permission information; the session management unit generates a unique session ID and returns a complete unified identity token.

[0087] The protocol adaptation submodule converts the unified identity token into a standard SAML assertion according to the SAML 2.0 protocol requirements of the target business system, and sets the validity period and recipient of the assertion; the parameter mapping submodule queries the attribute mapping table according to TargetSysID, maps the unified user attribute fields in the SAML assertion to the corresponding private field structure of the target business system, and reassembles them to generate a new authentication request body.

[0088] The access control submodule of the unified access orchestration module extracts the UserID and TargetSysID from the request and queries the access policy library for the user's corresponding role and business system access permissions. If the verification passes, the access control submodule forwards the converted authentication request to the business system access module; if the verification fails, the collaborative office workbench module prompts the user that they do not have access permissions.

[0089] The business system access module receives the authentication request, establishes a local login session for the user, and returns the access result to the unified access orchestration module. The unified access orchestration module then feeds back the access result to the collaborative office workbench module for status updates.

[0090] The beneficial effects of the present invention are described in detail below.

[0091] Unlike traditional point-to-point access modes, this invention constructs an intermediate proxy layer through a unified access orchestration module, enabling centralized management and dynamic orchestration of authentication access processes for multiple business systems. This eliminates the need for customized interface configurations for each heterogeneous business system, significantly simplifying the business system access process, reducing access configuration workload, and substantially lowering system integration complexity.

[0092] This invention relies on a protocol adaptation submodule to achieve self-adaptive conversion of authentication protocols. It can dynamically convert the standard token generated by the unified identity authentication platform into an authentication data format compatible with different business systems, effectively adapting to the heterogeneous differences in authentication protocols and token formats of various business systems, solving login failures and authentication anomalies caused by protocol mismatches, and improving the compatibility of multi-system access.

[0093] This invention uses a parameter mapping submodule combined with a preset attribute mapping table to automatically map and reassemble a unified identity field with the private user attribute fields of each business system. This avoids authentication failures caused by mismatched user identity field structures, achieves standardized and consistent transmission of user identity information across systems, and ensures the accuracy of identity data flow.

[0094] This invention adds an access control submodule to realize centralized access verification before access, replacing the decentralized access management mode of each business system, solving problems such as inconsistent permissions across systems and unauthorized access, realizing group-level access linkage control, and improving the overall access security control capability.

[0095] This invention uses a collaborative office workbench as a unified access point, enabling one-click access to business systems through unified access orchestration. This eliminates the need for users to log in repeatedly or switch between multiple system entry points, simplifying the system access chain, optimizing the employee's office operation experience, and solving the problems of complex access chains and cumbersome switching between multiple systems.

[0096] This invention centrally completes user authentication, token generation, and session management through a unified identity authentication platform, thereby achieving centralized control over user identity and session status. This avoids session chaos and status asynchrony caused by decentralized session management in various business systems. The standardized authentication interaction process reduces system anomalies and improves the overall system stability.

[0097] This invention adopts a unified access, automatic adaptation, and centralized management solution, which significantly reduces the manpower and time costs of customized development, system docking and debugging, and subsequent operation and maintenance. It effectively reduces the information system integration and full life cycle operation and maintenance costs of large manufacturing enterprise groups, meeting the cost reduction and efficiency improvement needs of the group's digital and intelligent transformation.

[0098] The present invention has been described above by way of example with reference to the accompanying drawings. Obviously, the specific implementation of the present invention is not limited to the above-described manner. Any non-substantial improvements made using the inventive concept and technical solution; or the direct application of the inventive concept and technical solution to other situations without modification, are all within the protection scope of the present invention.

Claims

1. A unified identity authentication and collaborative office workbench access platform, characterized in that: It includes a collaborative office workbench module, a unified access orchestration module, a unified identity authentication platform module, and a business system access module; The collaborative office workbench module is used to receive user login requests and business system access requests, and send access request information containing the target business system identifier to the unified access orchestration module. The unified access orchestration module serves as an intermediate access proxy layer between the collaborative office workbench and the unified identity authentication platform. The unified identity authentication platform module is used to complete user identity authentication processing and generate unified identity token information; The business system access module is used to receive authentication request data after it has been converted by the unified access orchestration module, and to establish a business system login session based on the authentication data.

2. The unified identity authentication and collaborative office workbench access platform as described in claim 1, characterized in that: The unified access orchestration module includes an access routing submodule, a protocol adaptation submodule, a parameter mapping submodule, and an access control submodule; The access routing submodule is used to match the corresponding authentication routing policy from the pre-configured access policy library based on the target business system identifier, and to determine the authentication process path and the target authentication protocol type; The protocol adaptation submodule is used to convert the unified identity token from the unified identity authentication platform into a protocol format that can be recognized by the target business system, according to the authentication routing policy. The parameter mapping submodule is used to map user attribute fields in authentication data, mapping unified identity fields to the corresponding field structure of the target business system; The access control submodule is used to verify user access permissions before forwarding access requests, and to determine whether access to the target business system is allowed based on user role information, organization information, and business system access policies.

3. The unified identity authentication and collaborative office workbench access platform as described in claim 1, characterized in that: The unified identity authentication platform module includes a user authentication unit, a token generation unit, and a session management unit; The user authentication unit is used to authenticate user identity through the authentication database; The token generation unit is used to return the signing key through the key management system and generate a signing token for the session management unit; The session management unit is used to record session status, return session IDs, and generate unified identity tokens.

4. A method for accessing a unified identity authentication and collaborative office workbench platform as described in any one of claims 1-3, characterized in that, Includes the following steps: Step 1: The collaborative office workbench module receives the business system access request initiated by the user and sends the access request containing the target business system identifier to the unified access orchestration module; Step 2: The unified access orchestration module queries the corresponding authentication routing policy from the access policy library based on the target business system identifier; Step 3: The unified access orchestration module calls the unified identity authentication platform module to complete user identity authentication and obtain unified identity token information; Step 4: The unified access orchestration module performs protocol conversion and parameter mapping on the unified identity token according to the authentication routing policy, generating authentication data that can be recognized by the target business system; Step 5: The unified access orchestration module verifies user access permissions. If the permission verification passes, the authentication data is forwarded to the target business system. Step Six: The target business system establishes a login session based on the received authentication data and returns the access result to the unified access orchestration module. The unified access orchestration module then feeds back the access result to the collaborative office workbench module for status updates.

5. The method for accessing a unified identity authentication and collaborative office workbench platform as described in claim 4, characterized in that: In step two, the authentication routing strategy includes the authentication process path and the target authentication protocol type.

6. The method for accessing a unified identity authentication and collaborative office workbench platform as described in claim 4, characterized in that: In step three, the user authentication unit queries the corresponding user's identity information from the authentication database, and after successful verification, sends an authentication success signal to the token generation unit. The token generation unit requests a signature key from the key management system and generates a signed token containing user identity information and authorization information. The session management unit generates a unique session ID and returns a complete unified identity token to the unified access orchestration module.

7. The method for accessing a unified identity authentication and collaborative office workbench platform as described in claim 4, characterized in that: In step four, the unified identity token from the unified identity authentication platform is converted into a protocol format according to the authentication routing policy, and the unified identity token is converted into an authentication data format that can be recognized by the target business system.

8. The method for accessing a unified identity authentication and collaborative office workbench platform as described in claim 7, characterized in that: The user attribute fields in the authentication data are mapped to the corresponding field structure of the target business system.

9. The method for accessing a unified identity authentication and collaborative office workbench platform as described in claim 4, characterized in that: In step five, user access permissions are verified before the access request is forwarded. Based on user role information, organization information, and business system access policies, it is determined whether access to the target business system is allowed.

Images