A method for securely accessing multiple existing application systems based on a middleware system

Abstract

The present invention discloses a method for securely accessing multiple existing application systems based on a middleware system. This method, by embedding the middleware system within the services of multiple existing application systems, can solve the user identity authentication and resource authorization issues associated with unified access by multiple existing application systems. The third-party middleware system can correctly identify the identity of the visitor, determine the access rights granted to the visitor, and periodically monitor the system's operating status, thereby optimizing overall access traffic, alleviating the pressure on internal services, and improving service concurrency efficiency. Multiple existing application systems only need to connect to the middleware system to ensure high service availability and flexible access rule control, effectively improving the utilization and stability of internal service resources.

Description

Technical Field

[0001] The present invention relates to the technical field of third-party middleware authentication and authorization methods, and in particular to a method for securely accessing multiple existing application systems based on a middleware system. Background Art

[0002] Currently, the common method for accessing existing application system services is to distribute and process user requests through forward or reverse proxy gateways, or to access resources through proxy channels opened by proxy terminals. Both of these methods for accessing internal systems have significant drawbacks: the service provider cannot authenticate the visitor's identity, effectively identify legitimate access, and restrict or relax access control levels based on identity information. Summary of the Invention

[0003] The purpose of the present invention is to solve the shortcomings of the prior art and to propose a method for securely accessing multiple existing application systems based on a middleware system.

[0004] In order to achieve the above object, the present invention adopts the following technical solution: A method for securely accessing multiple existing application systems based on a middleware system, the method comprising the following steps:

[0005] Step S1: The middleware system obtains the user data, user level, user authority and corresponding accessible resource list of the existing application system;

[0006] Step S2: The user terminal applies for access services to the middleware system using the account information provided by the existing application system, and submits a list of resources for which authorization to access is requested;

[0007] Step S3: The middleware system verifies the user's legitimacy in the existing application system and the resource attributes of the user level, and generates a corresponding token and private key, as well as an encryption algorithm list for the user;

[0008] Step S4: The user terminal obtains the token and private key, selects an encryption method from the encryption algorithm list, generates signature data with user identity proof, and sends it to the middleware system for verification;

[0009] Step S5: The middleware system receives and verifies whether the signature data is valid, and checks whether the user's requested resource path access permission is allowed. If the verification is passed, it sends a request to the existing application system to access the service, otherwise it intercepts the request.

[0010] Preferably, the middleware system uses a token bucket algorithm to periodically detect the operating status of the existing application system, and control and block user access traffic that exceeds the system's tolerance.

[0011] Preferably, the step S4 further includes a method for authenticating and authorizing users of the existing application system, and the method for authenticating and authorizing users of the existing application system includes the following steps:

[0012] Step S41: The user terminal obtains the existing system account and password provided by the current user, and carries a list of resource paths that need to be authorized to access, and sends it to the middleware system to request authentication verification through the basic authentication method of the HTTP protocol;

[0013] Step S42: The middleware system verifies the legitimacy of the user submitted in step S41 against the user list provided by the existing application system, and verifies whether the resource path list submitted by the user is in the access list. If the verification is correct, a 32-bit token string, an encryption algorithm type list, and a 16-bit private key password are temporarily generated for the user.

[0014] Step S43: The user terminal randomly generates a first string of 10-bit unsigned decimal integers. From the encryption algorithm types returned by the middleware system in step S42, the user terminal selects one of the algorithms and appends its serial number to the 11th bit of the first string. The user terminal obtains the current 10-bit timestamp information string and appends the timestamp information to the end of the first string to form a 21-bit string.

[0015] Step S44: The token string returned in step S42 and the 21-bit string in step S43 are concatenated to form a second string. The second string is encrypted using the private key password obtained in step S42 and the encryption algorithm selected in step S43 to generate a third string. The third string is then concatenated with the second string to form a fourth string. The fourth string is then Base64-encoded to form the final signature data.

[0016] Preferably, step S5 further includes a method for verifying the legality of users of the existing application system, and the method for verifying the legality of users of the existing application system includes the following steps:

[0017] Step S51: The middleware system decodes the signature data obtained in step S44 using the base64 algorithm and separates the unencrypted string R, the selected encryption algorithm serial number N, the encrypted string P, and the timestamp string T;

[0018] Step S52: The middleware system compares the timestamp string T obtained in step S51 with the current timestamp information. If T is within 2 hours before or after the current time, the signature data sent by the user is considered valid. Otherwise, the user's authentication is rejected.

[0019] Step S53: The middleware system retrieves the Nth serial number algorithm M in the encryption algorithm type list and the 16-bit private key Q allocated to the user from the user list provided by the existing application system;

[0020] Step S54: Obtain the character string before encryption from step S51, and encrypt the character string R before encryption obtained in S51 using the encryption algorithm M obtained in step S53. The encryption key uses the private key password Q obtained in S53 to form a new encrypted character string K. By comparing K with the character P obtained in step S51, if they are exactly the same, the verification is successful. If they are not the same, the user authentication is rejected.

[0021] Preferably, the token bucket algorithm comprises the following steps:

[0022] Step SS1: The middleware system will constantly add a token to the designated middleware system processing queue every 1 / Q seconds according to the maximum number of processing access users Q set by the existing application system. If the queue is full, no more tokens will be added.

[0023] Step SS2: The middleware system will allow each authenticated user to try to take the token from the queue in step SS1. If the token is successfully taken, it will forward the user's request to the existing application system. If there is no token to take, the user will continue to wait for the next SS1 token issuance cycle until it is possible to take the token.

[0024] The present invention has the following beneficial effects:

[0025] This invention provides a third-party middleware system that addresses user authentication and resource authorization issues for unified access across multiple existing application systems. The system accurately identifies the identity of visitors, determines their access rights, and periodically monitors system health, thereby optimizing overall access flow, alleviating pressure on internal services, and improving service concurrency efficiency. Multiple existing application systems simply need to connect to the middleware system to ensure high service availability and flexible access rule control, effectively improving the utilization and stability of internal service resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 This is a flow chart of a method for securely accessing multiple existing application systems based on a middleware system according to the present invention; DETAILED DESCRIPTION

[0027] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0028] Reference Figure 1 In order to achieve the above-mentioned purpose, the present invention adopts the following technical solutions: A method for securely accessing multiple existing application systems based on a middleware system, the method comprising the following steps:

[0029] Step S1: The middleware system obtains the user data, user level, user authority and corresponding accessible resource list of the existing application system;

[0030] Step S2: The user terminal applies for access services to the middleware system using the account information provided by the existing application system, and submits a list of resources for which authorization to access is requested;

[0031] Step S3: The middleware system verifies the user's legitimacy in the existing application system and the resource attributes of the user level, and generates a corresponding token and private key, as well as an encryption algorithm list for the user;

[0032] Step S4: The user terminal obtains the token and private key, selects an encryption method from the encryption algorithm list, generates signature data with user identity proof, and sends it to the middleware system for verification;

[0033] The method for the user to request to obtain the token and private key includes the following steps:

[0034] Step S41: The user terminal obtains the existing system account and password provided by the current user, and carries a list of resource paths that need to be authorized to access, and sends it to the middleware system to request authentication verification through the basic authentication method of the HTTP protocol;

[0035] Step S42: The middleware system verifies the legitimacy of the user submitted in step S41 against the user list provided by the existing application system, and verifies whether the resource path list submitted by the user is in the access list. If the verification is correct, a 32-bit token string, an encryption algorithm type list, and a 16-bit private key password are temporarily generated for the user.

[0036] Step S43: The user terminal randomly generates a first string of 10-bit unsigned decimal integers. From the encryption algorithm types returned by the middleware system in step S42, the user terminal selects one of the algorithms and appends its serial number to the 11th bit of the first string. The user terminal obtains the current 10-bit timestamp information string and appends the timestamp information to the end of the first string to form a 21-bit string.

[0037] Step S44: The token string returned in step S42 and the 21-bit string in step S43 are concatenated to form a second string. The second string is encrypted using the private key password obtained in step S42 and the encryption algorithm selected in step S43 to generate a third string. The third string is then concatenated with the second string to form a fourth string. The fourth string is then Base64-encoded to form the final signature data.

[0038] Step S5: The middleware system receives and verifies whether the signature data is valid, and checks whether the user's requested resource path access permission is allowed. If the verification is passed, it sends a request to the existing application system to access the service, otherwise it intercepts the request.

[0039] The middleware system authenticates the client's request method, including the following steps:

[0040] Step S51: The middleware system decodes the signature data obtained in step S44 using the base64 algorithm and separates the unencrypted string R, the selected encryption algorithm serial number N, the encrypted string P, and the timestamp string T;

[0041] Step S52: The middleware system compares the timestamp string T obtained in step S51 with the current timestamp information. If the string T is within 2 hours before or after the current time, the signature data sent by the user is considered to be within the validity period. Otherwise, the user's authentication is rejected.

[0042] Step S53: The middleware system retrieves the Mth algorithm M from the encryption algorithm type list and the 16-bit private key Q allocated to the user from the user list provided by the existing application system;

[0043] Step S54: Obtain the character string before encryption from step S51, and encrypt the character string R before encryption obtained in S51 using the encryption algorithm M obtained in step S53. The encryption key uses the private key password Q obtained in S53 to form a new encrypted character string K. By comparing K with the character P obtained in step S51, if they are exactly the same, the verification is successful. If they are not the same, the user authentication is rejected.

[0044] The existing user authentication method uses username and password for account authentication, which is easy to be stolen by illegal elements. Therefore, without exposing the password method, each authentication uses a different random string verification method to verify the legitimacy of the user, and increases the timeliness of the verification. If the sending time is incorrect, it will be rejected. In this way, the security of verification and authorization is improved.

[0045] To control and block user access traffic that exceeds the system's capacity, the middleware system uses a token bucket algorithm to periodically detect the operating status of existing application systems. The token bucket algorithm includes the following steps:

[0046] Step SS1: The middleware system will constantly add a token to the designated middleware system processing queue every 1 / Q seconds according to the maximum number of processing access users Q set by the existing application system. If the queue is full, no more tokens will be added.

[0047] Step SS2: The middleware system will allow each authenticated user to try to take the token from the queue in step SS1. If the token is successfully taken, it will forward the user's request to the existing application system. If there is no token to take, the user will continue to wait for the next SS1 token issuance cycle until it is possible to take the token.

[0048] Finally, it should be noted that the above is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for securely accessing multiple existing application systems based on a middleware system, characterized by: The method comprises the following steps: Step S1: The middleware system obtains the user data, user level, user authority and corresponding accessible resource list of the existing application system; Step S2: The user terminal applies for access services to the middleware system using the account information provided by the existing application system, and submits a list of resources for which authorization to access is requested; Step S3: The middleware system verifies the user's legitimacy in the existing application system and the resource attributes of the user level, and generates a corresponding token and private key, as well as an encryption algorithm list for the user; Step S4: The user terminal obtains the token and private key, selects an encryption method from the encryption algorithm list, generates signature data with user identity proof, and sends it to the middleware system for verification; The method for the user to request to obtain the token and private key includes the following steps: Step S41: The user terminal obtains the existing system account and password provided by the current user, and carries a list of resource paths that need to be authorized to access, and sends it to the middleware system to request authentication verification through the basic authentication method of the HTTP protocol; Step S42: The middleware system verifies the legitimacy of the user submitted in step S41 against the user list provided by the existing application system, and verifies whether the resource path list submitted by the user is in the access list. If the verification is correct, a 32-bit token string, an encryption algorithm type list, and a 16-bit private key password are temporarily generated for the user. Step S43: The user terminal randomly generates a first string of 10-bit unsigned decimal integers. From the encryption algorithm types returned by the middleware system in step S42, the user terminal selects one of the algorithms and appends its serial number to the 11th bit of the first string. The user terminal obtains the current 10-bit timestamp information string and appends the timestamp information to the end of the first string to form a 21-bit string. Step S44: The token string returned in step S42 and the 21-bit string in step S43 are concatenated to form a second string. The second string is encrypted using the private key password obtained in step S42 and the encryption algorithm selected in step S43 to generate a third string. The third string is then concatenated with the second string to form a fourth string. The fourth string is then Base64-encoded to form the final signature data. Step S5: The middleware system receives and verifies whether the signature data is valid, and checks whether the user's requested resource path access permission is allowed. If the verification is passed, it sends a request to the existing application system to access the service, otherwise it intercepts the request.

2. The method for securely accessing multiple existing application systems based on a middleware system according to claim 1, characterized in that: The method further comprises the middleware system using a token bucket algorithm to periodically detect the operating status of the existing application system, and control and block user access traffic that exceeds the system's tolerance.

3. The method for securely accessing multiple existing application systems based on a middleware system according to claim 1, characterized in that: Step S5 also includes a method for validating the authentication of existing application system users, which includes the following steps: Step S51: The middleware system decodes the signature data obtained in step S44 using the base64 algorithm and separates the unencrypted string R, the selected encryption algorithm serial number N, the encrypted string P, and the timestamp string T; Step S52: The middleware system compares the timestamp string T obtained in step S51 with the current timestamp information. If the string T is within the valid time period set by the middleware system, the signature data sent by the user is considered valid. Otherwise, the user's authentication is rejected. Step S53: The middleware system retrieves the 16-bit private key Q assigned to the user by the Nth number algorithm M in the encryption algorithm type list from the user list provided by the existing application system; Step S54: Obtain the character string before encryption from step S51, and encrypt the character string R before encryption obtained in S51 using the encryption algorithm M obtained in step S53. The encryption key uses the private key password Q obtained in S53 to form a new encrypted character string K. By comparing K with the character P obtained in step S51, if they are exactly the same, the verification is successful. If they are not the same, the user request is rejected.

4. The method for securely accessing multiple existing application systems based on a middleware system according to claim 2, characterized in that: The token bucket algorithm includes the following steps: Step SS1: The middleware system will constantly add a token to the designated middleware system processing queue every 1 / Q seconds according to the maximum number of processing access users Q set by the existing application system. If the queue is full, no more tokens will be added. Step SS2: The middleware system will allow each authenticated user to try to take the token from the queue in step SS1. If the token is successfully taken, it will forward the user's request to the existing application system. If there is no token to take, the user will continue to wait for the next SS1 token issuance cycle until it is possible to take the token.

Images