Identity recognition and access management system and method

Abstract

The present invention relates to an identity recognition and access management system and method, the system comprising: an account system management module, an application management module and an account management module; the account system management module is used to define independent data authority management dimensions for different account systems, supports configuration of corresponding system fields under different account systems, and defines the attributes of system fields; the application management module is used to configure the account login methods supported by the application, and configures the menu permissions and operation permissions under the application; the account management module is used to configure the functional permissions of the account, and configures the data permissions of the account. In this way, the present application can realize unified identity information management of user accounts under different account systems or business systems, and at the same time supports each account system or business system to flexibly define data authority management dimensions, avoiding repeated development and waste of resources.

Description

Technical Field

[0001] The present invention relates to the technical field of information security management, and in particular to an identity recognition and access management system and method. Background Art

[0002] At present, daily enterprise accounts are divided into C-end ordinary consumer users, B-end enterprise users and internal employees. As the business of the enterprise ecosystem gradually expands, the number of business systems under the enterprise is increasing. Each business system of the relevant technology manages its corresponding daily enterprise account by independently building an application account permission management module and setting account management logic.

[0003] However, each business system independently builds an application account authority management module and account management logic, making the daily enterprise accounts corresponding to each business system independent of each other, making it difficult to uniformly manage the daily enterprise accounts corresponding to each business system, making the management of each business system chaotic; in addition, different business systems independently set up account management logic, making the account management logic only applicable to the corresponding business system, and cannot be directly applied to other business systems, resulting in problems of repeated development and waste of resources. In view of this, the relevant technology lacks a management system that can perform unified identity authentication and authorization, so that the relevant technology can achieve unified management of the daily enterprise accounts corresponding to each business system, while reducing the development work of each business system. Summary of the invention

[0004] In view of this, in order to solve the above problems to a certain extent, the present application provides an identity recognition and access management system and method.

[0005] The present invention adopts the following technical solution:

[0006] In a first aspect, the present invention provides an identity recognition and access management system, including: an account system management module, an application management module and an account management module;

[0007] The account system management module includes an account system data authority dimension management submodule and an account field management submodule;

[0008] The account system data permission dimension management submodule is used to define independent data permission management dimensions for different account systems; the data permission management dimensions support the application management module call; the account field management submodule is used to support the configuration of corresponding system fields under different account systems, and to define the attributes of the system fields; the attributes include whether it is unique, whether it is required, whether the user is allowed to modify, modify the verification method and account registration process;

[0009] The application management module includes an account information authorization management submodule and a permission configuration management submodule;

[0010] The account information authorization management submodule is used to configure the account login mode supported by the application based on the parameters configured by the account field management submodule; the permission configuration management submodule is used to configure the menu permission and operation permission under the application according to the preset permission model;

[0011] The account management module includes an account authority management submodule;

[0012] The account rights management submodule is used to configure the functional rights of the account based on the parameters configured by the rights configuration management submodule, and to configure the data rights of the account based on the parameters configured by the account system data rights dimension management submodule.

[0013] Furthermore, the account system management module also includes: a third-party login submodule

[0014] The third-party login submodule is used to configure the third-party login methods and third-party platform parameters supported by the account system.

[0015] Furthermore, the application management module further includes: an application data permission dimension management submodule;

[0016] The application data permission dimension management submodule is used to independently set the data permission control dimension under the application, and to call the data permission control dimension defined by the account system data permission dimension management submodule; the data permission control dimension called by the application data permission dimension management submodule only supports system viewing and use.

[0017] Furthermore, the account management module also includes: an account basic information management submodule;

[0018] The account basic information management submodule is used to maintain the system fields defined by the account field management submodule.

[0019] Furthermore, the application management module also includes: an application basic information management submodule;

[0020] The application basic information management submodule is used to manage the account system, application channels and authorized domain names to which the application belongs.

[0021] Furthermore, the application management module also includes: a role management submodule;

[0022] The role management submodule is used to configure different roles under the application and to configure permissions for the roles;

[0023] When configuring the account rights, the account rights management submodule configures the functional rights of the account by assigning the account role.

[0024] Furthermore, the application management module also includes: a security setting submodule;

[0025] The security settings submodule is used to support the configuration of account-sensitive operation risk control policies and account multi-terminal login settings.

[0026] Furthermore, the account management module further includes: an operation log management submodule;

[0027] The operation log management submodule is used to manage the historical operation records of the account.

[0028] In a second aspect, the present invention provides an identity recognition and access management method, comprising:

[0029] Create an account system super administrator account according to the first creation instruction sent by the user;

[0030] Creating an account system under the account system super administrator account according to the second creation instruction sent by the user;

[0031] Creating an application under the account system according to a third creation instruction sent by the user; wherein a preset permission definition is set in the application;

[0032] Creating an account under the application according to a fourth creation instruction sent by the user;

[0033] Creating a login application process for the account according to the fifth creation instruction sent by the user; the login application process complies with a preset login method and security risk control rules;

[0034] A user access application system is created according to a sixth creation instruction sent by the user; the user accesses the user access application system by logging into the account; when the user accesses the user access application system, the preset authority definition is followed.

[0035] Furthermore, after creating an account under the application according to the fourth creation instruction sent by the user, the method further includes:

[0036] The access rights of all the applications under the account system are allocated according to the allocation instruction sent by the user.

[0037] The present invention adopts the above technical scheme, an identity identification and access management system, including: an account system management module, an application management module and an account management module; the account system management module includes an account system data permission dimension management submodule and an account field management submodule; the account system data permission dimension management submodule is used to define independent data permission control dimensions for different account systems; the data permission control dimension supports application management module calling; the account field management submodule is used to support the configuration of corresponding system fields under different account systems, and is used to define the attributes of system fields; the application management module includes an account information authorization management submodule and a permission configuration management submodule; the account information authorization management submodule is used to configure the account login method supported by the application based on the parameters configured by the account field management submodule; the permission configuration management submodule is used to configure the menu permission and operation permission under the application according to the preset permission model; the account management module includes an account permission management submodule; the account permission management submodule is used to configure the functional permission of the account based on the parameters configured by the permission configuration management submodule, and is used to configure the data permission of the account based on the parameters configured by the account system data permission dimension management submodule. In this way, the present application can support relevant technologies to manage identity information of different account systems, and flexibly define system fields under different account systems, so that the present application can flexibly configure account identity information and meet the unified account management needs of different account systems and different applications (business systems); in addition, the present application can support the account system or business system of relevant technologies to flexibly define data permission management dimensions, avoiding repeated development and waste of resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0039] Figure 1 It is a structural diagram of an identity recognition and access management system provided by an embodiment of the present invention.

[0040] Figure 2 It is a flow chart of an identity recognition and access management method provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0041] To make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be described in detail below. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other implementation methods obtained by ordinary technicians in this field without creative work belong to the scope of protection of the present invention.

[0042] Figure 1 Schematic diagram of the structure of an identity recognition and access management system provided by an embodiment of the present invention. Figure 1 As shown, the identity recognition and access management system of this embodiment includes: an account system management module 11, an application management module 12 and an account management module 13.

[0043] Among them, the account system management module 11 includes an account system data permission dimension management submodule 111 and an account field management submodule 112; the account system data permission dimension management submodule 111 is used to define independent data permission management dimensions for different account systems; the data permission management dimensions support the call of the application management module 12; the account field management submodule 112 is used to support the configuration of corresponding system fields under different account systems, and to define the attributes of the system fields; the attributes include whether it is unique, whether it is required, whether the user is allowed to modify, modify the verification method and the account registration process.

[0044] The application management module 12 includes an account information authorization management submodule 121 and a permission configuration management submodule 122; the account information authorization management submodule 121 is used to configure the account login method supported by the application based on the parameters configured by the account field management submodule 112; the permission configuration management submodule 122 is used to configure the menu permissions and operation permissions under the application according to the preset permission model.

[0045] The account management module 13 includes an account authority management submodule 131 ; the account authority management submodule 131 is used to configure the functional authority of the account based on the parameters configured by the authority configuration management submodule 122 , and to configure the data authority of the account based on the parameters configured by the account system data authority dimension management submodule 111 .

[0046] Specifically, the present application divides the identity authentication authorization of user accounts into four levels: tenant-account system-application-account. The present application supports each account system and business system to flexibly define all the identity rules of the next level from top to bottom.

[0047] The account system data permission dimension management submodule 111 is used to define independent data permission control dimensions for different account systems; it supports multi-level and multi-dimensional flexible configuration of data permissions. The data permission control dimensions of the account system defined by the account system data permission dimension management submodule 111 can be shared in all application systems (business systems) under the account system. The account system can perform data permission control on different dimensions such as organizational structure and add dimensions through the account system data permission dimension management submodule 111. The account system data permission dimension management submodule 111 supports setting the enablement status of each dimension, which includes on and off. When the enablement status of the target dimension is set to on, the account system can perform data permission control on the target dimension through the account system data permission dimension management submodule 111, and the data permission control includes at least one of the following operations: details list, import, export, log and edit. When the enablement status of the target dimension is set to off, the field information of the target dimension is not displayed, and the account system cannot perform data permission control on the target dimension through the account system data permission dimension management submodule 111.

[0048] The account field management submodule 112 is used to support the configuration of corresponding system fields under different account systems, and to define the attributes of the system fields; the attributes include whether it is unique, whether it is required, whether the user is allowed to modify, modify the verification method and the account registration process. The system field is a field used to identify the identity information of the user account, such as: user name, password, email, mobile phone number, nickname, ID number, mailing address, etc. Whether the mobile phone number is required and unique determines whether the user account login method can choose mobile phone number + dynamic password (One-Time Password, OTP), or password login. Whether the email address is required and unique will affect whether the user account can choose email login when logging in. Whether the mobile phone number is required and unique will affect whether the user account can choose mobile phone number login when logging in.

[0049] The account information authorization management submodule 121 is used to configure the account login method supported by the application based on the parameters configured by the account field management submodule 112; the account login method supported by the application can be any of the following: 1. Mobile phone number + SMS verification code login; 2. Mobile phone number / user name / email + password login; 3. User name + password login; 4. Mobile phone number + password login; 5. Email + password login.

[0050] The permission configuration management submodule 122 is used to configure the menu permissions and operation permissions under the application according to the preset permission model. Menu permissions include operation buttons. The configuration management submodule 122 configures the menu permissions and operation permissions under the application, which can be used to determine the specific display functions when configuring user account roles or account permissions. The preset permission model can be a combination of the following permission models: Role-Based Access Control (RBAC) model, ABAC model, and various complex permission models based on resource management. In this way, the permission model of the present application is flexible and scalable.

[0051] The account authority management submodule 131 is used to configure the functional authority of the account based on the parameters configured by the authority configuration management submodule 122 , and to configure the data authority of the account based on the parameters configured by the account system data authority dimension management submodule 111 .

[0052] The present invention adopts the above technical scheme, an identity identification and access management system, including: an account system management module, an application management module and an account management module; the account system management module includes an account system data permission dimension management submodule and an account field management submodule; the account system data permission dimension management submodule is used to define independent data permission control dimensions for different account systems; the data permission control dimension supports application management module calling; the account field management submodule is used to support the configuration of corresponding system fields under different account systems, and is used to define the attributes of system fields; the application management module includes an account information authorization management submodule and a permission configuration management submodule; the account information authorization management submodule is used to configure the account login method supported by the application based on the parameters configured by the account field management submodule; the permission configuration management submodule is used to configure the menu permission and operation permission under the application according to the preset permission model; the account management module includes an account permission management submodule; the account permission management submodule is used to configure the functional permission of the account based on the parameters configured by the permission configuration management submodule, and is used to configure the data permission of the account based on the parameters configured by the account system data permission dimension management submodule. In this way, the present application can support relevant technologies to manage identity information of different account systems, and flexibly define system fields under different account systems, so that the present application can flexibly configure account identity information and meet the unified account management needs of different account systems and different applications (business systems); in addition, the present application can support the account system or business system of relevant technologies to flexibly define data permission management dimensions, avoiding repeated development and waste of resources.

[0053] In addition, the account field management submodule 112 is used to support the configuration of corresponding system fields under different account systems, and to define the attributes of the system fields, thereby meeting the management needs of different account systems and different business systems under the account systems, so that the present application is adaptable to various account systems and business systems.

[0054] In addition, the account information authorization management submodule 121 configures the account login method supported by the application based on the parameters configured by the account field management submodule 112, so that the present application provides a unified identity authentication service interface for the account information configured for different account systems or business systems, so that the present application supports account registration and login in various situations.

[0055] In addition, this application supports single sign-on to multiple business systems for accounts within the same account system, sharing of data dimensions within the same account system, and sharing of user tags within the same account system.

[0056] Further, such as Figure 1 As shown, the account system management module 11 may further include: a third-party login submodule 113 .

[0057] The third-party login submodule 113 is used to configure the third-party login methods and third-party platform parameters supported by the account system so that the system can adapt to the third-party login methods under different applications. After the third-party login submodule 113 completes the configuration of the third-party login method, the user can freely choose the configured third-party login method when logging in to the account.

[0058] Compared with the prior art that each business system or account system independently develops its three-party login authorization module, the present application avoids the need for each business system or account system to independently develop a three-party login authorization module, thereby saving hardware resources and human resources.

[0059] Further, such as Figure 1 As shown, the application management module 12 may further include: an application data permission dimension management submodule 123 .

[0060] The application data permission dimension management submodule 123 is used to independently set the data permission control dimension under the application, and can also be used to call the data permission control dimension defined by the account system data permission dimension management submodule 111; the data permission control dimension called by the application data permission dimension management submodule 123 only supports system viewing and use, and the application data permission dimension management submodule 123 cannot edit the called data permission control dimension. The data permission control dimension that ultimately acts on the application account is uniformly called by the data permission control dimension maintained here, and each data dimension can only act on the account data permission configuration rules when it is set to the enabled state.

[0061] In addition, the account system data permission dimension management submodule 111 and the application data permission dimension management submodule 123 implement the setting of data permission control dimensions by referencing the metadata in the metadata management module 14. The metadata management module 14 is a basic data management module based on tenants, and at least includes an organization department management submodule 141, a management area submodule 142, and a network point management submodule 143.

[0062] Further, such as Figure 1 As shown, the account management module 13 may further include: an account basic information management submodule 132 .

[0063] The account basic information management submodule 132 is used to maintain the system fields defined by the account field management submodule 112. The system fields and verification logic of the account basic information management submodule 132 are all from the configuration of the account system management module 11.

[0064] Further, such as Figure 1 As shown, the application management module 12 may further include: an application basic information management submodule 124 .

[0065] The application basic information management submodule 124 is used to manage the account system, application channels and authorized domain names to which the application belongs, as well as to manage the application icon, name, introduction, whether to enable single sign-on (SSO) authentication, SSO protocol and whether to enable permission management. In this way, the application can support account intercommunication between multiple account systems with non-standard protocols.

[0066] Further, such as Figure 1 As shown, the application management module 12 may further include: a role management submodule 125 .

[0067] The role management submodule 125 is used to configure different roles under the application, and to configure permissions for the roles; when the account permission management submodule configures account permissions, the functional permissions of the account are configured by assigning the account role. In this way, the present application can have the function of centralized user management in all scenarios. Specifically, the present application can have identity management functions such as user management, user group management, organizational structure management, and various flexible data dimension management. For example, when an employee joins, leaves, or transfers, the access rights of the employee account will also change accordingly. The present application can change the access rights of the employee account by changing the role of the employee account, thereby realizing centralized management of users.

[0068] Further, such as Figure 1 As shown, the application management module 12 may further include: a security setting submodule 126 .

[0069] The security setting submodule 126 is used to support the configuration of account-sensitive operation risk control policies and account multi-terminal login settings. Account-sensitive operation risk control policies include: One Time Password (OTP) error retry risk control restrictions, for example, after a single OTP verification error is sent 20 times, the OTP automatically expires; and incorrect password login risk control restrictions, for example, a single user can try to log in with an incorrect password up to 5 times within 1 hour. Account multi-terminal login settings include: allowing multiple clients and multiple devices online, for example, allowing up to 5 devices. By setting the security setting submodule 126, the present application ensures the information security of various business systems and account systems that use the present application, while avoiding security-related development work such as authentication and authorization for various business systems and account systems, saving human resources and hardware resources.

[0070] Further, such as Figure 1 As shown, the account management module 13 may further include: an operation log management submodule 133 .

[0071] The operation log management submodule 133 is used to manage the historical operation records of the account. The historical operation records include time, Internet Protocol (IP), browser device, operating system, application, operation content and operation result.

[0072] Further, such as Figure 1 As shown, the account system management module 11 further includes an account system basic information management submodule 114 for managing the system fields defined by the account field management submodule 112 .

[0073] Further, such as Figure 1 As shown, the account management module 13 may further include an account role management submodule 134 and a third-party account management submodule 135 .

[0074] The account role management submodule 134 is used to call the data configured by the role management submodule 125; the third-party account management submodule 135 is used to configure the third-party login mode and third-party platform parameters of the account.

[0075] Further, such as Figure 1 As shown, the identity identification and access management system of the present application also includes an identity identification and access management (IAM) console 15.

[0076] The IAM console 15 includes a user group management submodule 151 and a platform user management submodule 152. The platform user management submodule 152 is used for authentication management, permission configuration and group management of user accounts, and the user group management submodule 151 is used to reference data in the group management of user accounts in the platform user management submodule 152.

[0077] It should be noted that when the account system has the account system administrator role permission, or the application system has the application user administrator role permission, the system silently generates the corresponding IAM console user.

[0078] Figure 2 1 is a flow chart of an identity identification and access management method provided by an embodiment of the present invention. The identity identification and access management method of this embodiment is implemented by the identity identification and access management system of this application. Figure 2 As shown, the identity recognition and access management method of this embodiment includes:

[0079] S201. Create an account system super administrator account according to a first creation instruction sent by a user.

[0080] S202: Create an account system under the account system super administrator account according to the second creation instruction sent by the user.

[0081] Specifically, the account system under the super administrator account of the account system is created according to the second creation instruction sent by the user, including: configuring the corresponding system fields under different account systems through the account field management submodule 112, and the attributes used to define the system fields; the attributes include whether it is unique, whether it is required, whether the user is allowed to modify, modify the verification method and the account registration process. The system field is a field used to identify the identity information of the user account, such as: user name, password, email, mobile phone number, nickname, ID number, mailing address, etc. Whether the mobile phone number is required and unique determines whether the user account login method can choose mobile phone number + dynamic password (One-Time Password, OTP), or password login. Whether the email address is required and unique will affect whether the user account can choose email login when logging in, and whether the mobile phone number is required and unique will affect whether the user account can choose mobile phone number login when logging in.

[0082] The account system data permission dimension management submodule 111 defines independent data permission control dimensions for different account systems; supports flexible configuration of data permissions at multiple levels and dimensions. The data permission control dimensions of the account system defined by the account system data permission dimension management submodule 111 can be shared in all application systems (business systems) under the account system. The account system can perform data permission control on different dimensions such as organizational structure and add dimensions through the account system data permission dimension management submodule 111. The account system data permission dimension management submodule 111 supports setting the enablement status of each dimension, which includes on and off. When the enablement status of the target dimension is set to on, the account system can perform data permission control on the target dimension through the account system data permission dimension management submodule 111. The data permission control includes at least one of the following operations: details list, import, export, log and edit. When the enablement status of the target dimension is set to off, the field information of the target dimension is not displayed, and the account system cannot perform data permission control on the target dimension through the account system data permission dimension management submodule 111.

[0083] The third-party login submodule 113 configures the third-party login method and third-party platform parameters supported by the account system so that the system can adapt to the third-party login method under different applications. After the third-party login submodule 113 completes the configuration of the third-party login method, the user can freely choose the configured third-party login method when logging in to the account.

[0084] It should be noted that the account system data permission dimension management submodule 111 and the third-party login submodule 113 are configuration functions that are not necessarily completed in the identity identification and access management system. When each business system or account system uses the identity identification and access management system to manage identity authentication and authorization, it can choose to complete these configuration functions in the account system according to actual needs.

[0085] S203: Create an application under the account system according to the third creation instruction sent by the user; the application is provided with a preset permission definition.

[0086] Specifically, the applications under the account system created according to the third creation instruction sent by the user include:

[0087] The account login method supported by the application is configured through the account information authorization management submodule 121; the account login method supported by the application can be any of the following: 1. Mobile phone number + SMS verification code login; 2. Mobile phone number / user name / email + password login; 3. User name + password login; 4. Mobile phone number + password login; 5. Email + password login.

[0088] The menu permissions and operation permissions under the application are configured through the permission configuration management submodule 122. Menu permissions include operation buttons. The menu permissions and operation permissions under the application are configured by the configuration management submodule 122, which can be used to determine the specific display functions when configuring user account roles or account permissions. The preset permission model can be a combination of the following permission models: Role-Based Access Control (RBAC) model, ABAC model, and various complex permission models based on resource management.

[0089] The data permission control dimension under the application is independently set through the application data permission dimension management submodule 123, or the data permission control dimension defined by the account system data permission dimension management submodule 111 is called; the data permission control dimension called by the application data permission dimension management submodule 123 only supports system viewing and use, and the application data permission dimension management submodule 123 cannot edit the called data permission control dimension. The data permission control dimension that ultimately acts on the application account is uniformly called by the data permission control dimension maintained here, and each data dimension can act on the account data permission configuration rule only when it is set to the enabled state.

[0090] The role management submodule 125 is used to configure different roles under the application and to configure permissions for the roles; when the account permission management submodule configures account permissions, the functional permissions of the account are configured by assigning the account roles.

[0091] The security setting submodule 126 is used to configure the risk control policy for account-sensitive operations and the multi-terminal login settings for the account.

[0092] It should be noted that the permission configuration management submodule 122, the application data permission dimension management submodule 123, and the role management submodule 125 are configuration functions that are not necessarily completed in the identity identification and access management system. When each business system or account system uses the identity identification and access management system to manage identity authentication and authorization, it can choose to complete these configuration functions in the account system according to actual needs.

[0093] S204: Create an account under the application according to the fourth creation instruction sent by the user.

[0094] Specifically, the account under the application may be created in the background according to the fourth creation instruction sent by the administrator, or the account under the application may be registered and generated according to the fourth creation instruction sent by the registered user. When the system creates an account, it complies with the system field information rules defined by the account system.

[0095] S205. Create a login application process for the account according to the fifth creation instruction sent by the user; the login application process complies with a preset login method and security risk control rules.

[0096] S206. Create a user access application system according to the sixth creation instruction sent by the user; the user accesses the user access application system by logging in to the account; when the user accesses the user access application system, the preset authority definition is followed.

[0097] Furthermore, after creating an account under the application according to the fourth creation instruction sent by the user, the method further includes:

[0098] Allocate access permissions to all applications under the account system based on the allocation instructions sent by the user.

[0099] Specifically, the access permissions of all applications under the account system are allocated, including: allocating roles to each application and then allocating menu permissions or operation permissions corresponding to the application, and allocating data permissions to each application.

[0100] The identity identification and access management method of the above-mentioned embodiment is implemented through the identity identification and access management system of the present application, has the same execution process and beneficial effects, and will not be repeated here.

[0101] It should be noted that the identity identification and access management system of the present application can support users to configure account system field attributes, set login methods, manage data dimension permissions, and configure business application login and registration pages through the front-end page of the management console. It can also support users to configure account system field attributes, set login methods, manage data dimension permissions, and configure business application login and registration pages through files.

[0102] It can be understood that the same or similar parts of the above embodiments can be referenced to each other, and the contents not described in detail in some embodiments can refer to the same or similar contents in other embodiments.

[0103] It should be noted that, in the description of the present invention, the terms "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying relative importance. In addition, in the description of the present invention, unless otherwise specified, the meaning of "plurality" refers to at least two.

[0104] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, fragment or portion of code comprising one or more executable instructions for implementing the steps of a specific logical function or process, and the scope of the preferred embodiments of the present invention includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present invention belong.

[0105] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0106] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0107] In addition, each functional unit in each embodiment of the present invention may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0108] The storage medium mentioned above can be a read-only memory, a magnetic disk or an optical disk, etc.

[0109] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0110] Although the embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and are not to be construed as limitations of the present invention. A person skilled in the art may change, modify, replace and vary the above embodiments within the scope of the present invention.

Claims

1. An identity recognition and access management system, characterized in that: include: Account system management module, application management module and account management module; The account system management module includes an account system data authority dimension management submodule and an account field management submodule; The account system data authority dimension management submodule is used to define independent data authority control dimensions for different account systems; The data permission management dimension supports the calling of the application management module; the account field management submodule is used to support the configuration of corresponding system fields under different account systems, and to define the attributes of the system fields; the attributes include whether it is unique, whether it is required, whether the user is allowed to modify, modify the verification method and account registration process; The application management module includes an account information authorization management submodule and a permission configuration management submodule; The account information authorization management submodule is used to configure the account login mode supported by the application based on the parameters configured by the account field management submodule; The permission configuration management submodule is used to configure the menu permissions and operation permissions under the application according to the preset permission model; The account management module includes an account authority management submodule; The account rights management submodule is used to configure the functional rights of the account based on the parameters configured by the rights configuration management submodule, and is used to configure the data rights of the account based on the parameters configured by the account system data rights dimension management submodule; The account system management module also includes: a third-party login submodule; The third-party login submodule is used to configure the third-party login methods and third-party platform parameters supported by the account system; The application management module also includes: an application data permission dimension management submodule; The application data permission dimension management submodule is used to independently set the data permission control dimension under the application, and to call the data permission control dimension defined by the account system data permission dimension management submodule; the data permission control dimension called by the application data permission dimension management submodule only supports system viewing and use.

2. The identity recognition and access management system according to claim 1, characterized in that: The account management module also includes: an account basic information management submodule; The account basic information management submodule is used to maintain the system fields defined by the account field management submodule.

3. The identity recognition and access management system according to claim 1, characterized in that: The application management module also includes: an application basic information management submodule; The application basic information management submodule is used to manage the account system, application channels and authorized domain names to which the application belongs.

4. The identity recognition and access management system according to claim 1, characterized in that: The application management module also includes: a role management submodule; The role management submodule is used to configure different roles under the application and to configure permissions for the roles; When configuring the account rights, the account rights management submodule configures the functional rights of the account by assigning the account role.

5. The identity recognition and access management system according to claim 1, characterized in that: The application management module also includes: a security setting submodule; The security settings submodule is used to support the configuration of account-sensitive operation risk control policies and account multi-terminal login settings.

6. The identity recognition and access management system according to claim 1, characterized in that: The account management module also includes: an operation log management submodule; The operation log management submodule is used to manage the historical operation records of the account.

7. An identity recognition and access management method, characterized in that: include: Create an account system super administrator account according to the first creation instruction sent by the user; Creating an account system under the account system super administrator account according to the second creation instruction sent by the user; Creating an application under the account system according to a third creation instruction sent by the user; wherein a preset permission definition is set in the application; Creating an account under the application according to a fourth creation instruction sent by the user; Creating a login application process for the account according to a fifth creation instruction sent by the user; The login application process complies with the preset login method and security risk control rules; Creating a user access application system according to a sixth creation instruction sent by the user; The user accesses the user access application system by logging into the account; when the user accesses the user access application system, the preset authority definition is followed.

8. The identity recognition and access management method according to claim 7, characterized in that: After the account under the application is created according to the fourth creation instruction sent by the user, the method further includes: The access rights of all the applications under the account system are allocated according to the allocation instruction sent by the user.

Images