A permission management method, device and electronic equipment based on double verification
By performing dual verification of user function permissions and data keywords, the problem of insufficient security caused by the single permission management verification mechanism in the existing technology is solved, and the security of secure data is effectively protected and the security of the security system is improved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- SHANGHAI QIYUE INFORMATION TECH CO LTD
- Filing Date
- 2021-12-10
- Publication Date
- 2026-05-12
AI Technical Summary
The existing access control and verification mechanism is too simplistic, resulting in low security of the security system and an inability to strictly authorize and classify specific data content.
A dual authentication method is adopted, including function permission authentication and data keyword authentication. By performing dual authentication on the user's function permissions and data keywords, it is ensured that the user is only authorized to access secure data when both are verified.
It improves the security of accessing secure data, avoids the security deficiencies caused by overly simplistic authentication in security systems, and achieves effective protection of secure data.
Smart Images
Figure CN114186253B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of computer technology, and in particular to a method, apparatus and electronic device for permission management based on dual authentication. Background Technology
[0002] Security systems primarily manifest as application systems that verify user identity and permissions, and manage access control. Access authentication and management requirements in security systems are relatively strict. Existing access control and verification mechanisms are too simplistic and complex to use. Typically, access control is assigned to functional modules at the operational level, or specific operation assignments are added to the functional modules themselves. For example... Figure 1 As shown. However, relying solely on functional and operational permission design and verification cannot meet the needs of a security system, because a security system also requires strict authorization and classification of specific data content. Therefore, the current security systems suffer from a lack of diverse authentication methods and low security, which are problems that need to be addressed. Summary of the Invention
[0003] This invention provides a dual-authentication-based access control method, apparatus, and electronic device to improve the security of accessing secure data and ensure the data security of the security system.
[0004] This specification provides an example of a two-factor authentication-based access control method, including:
[0005] A request to obtain user access security data;
[0006] The request for the security data is subjected to function permission verification to obtain a first verification result;
[0007] The request for the secure data is validated using data keywords to obtain a second validation result;
[0008] When both the first verification result and the second verification result are successfully verified, the user is granted access rights and the security data corresponding to the request for the security data is loaded.
[0009] Preferably, before performing data keyword verification on the request for the secure data, the following steps are included:
[0010] Retrieve multiple security data entries from the security database;
[0011] Each piece of security data is identified by a keyword to obtain identified security data;
[0012] Authorize the target user with the data keywords corresponding to the identified security data.
[0013] Preferably, obtaining the second verification result includes:
[0014] Determine whether the data keyword exists in the request for the security data;
[0015] When the data keyword is present in the request for the security data, the second verification result is successful.
[0016] Preferably, the security data corresponding to the request to authorize user access and load the security data includes:
[0017] Based on user access permissions, identify security data corresponding to the data keywords in the request for the security data is matched, and the matched identification security data is loaded.
[0018] Preferably, the functional permissions are granted using roles, and users belong to a role and inherit the permissions of that role.
[0019] Preferably, each piece of security data has one or more of the data keywords as identifiers.
[0020] This specification also provides an embodiment of a permission management device based on two-factor authentication, comprising:
[0021] The request retrieval module is used to retrieve user requests for access security data.
[0022] The first verification module is used to perform functional permission verification on the request for the security data and obtain a first verification result.
[0023] The second verification module is used to perform data keyword verification on the request for the security data and obtain a second verification result.
[0024] The data reading module is used to authorize user access permissions and load the security data corresponding to the security data request when both the first verification result and the second verification result are successfully verified.
[0025] Preferably, the device further includes:
[0026] The data acquisition module is used to retrieve multiple pieces of security data from the security database;
[0027] The keyword identification module is used to identify each piece of security data with keywords to obtain identified security data.
[0028] The authorization module is used to authorize the data keywords corresponding to the identified security data to the target user.
[0029] Preferably, the second verification module includes:
[0030] The judgment unit is used to determine whether the data keyword exists in the request for the security data;
[0031] The verification unit determines that if the data keyword exists in the request for the security data, the second verification result is successful.
[0032] Preferably, the data reading module includes:
[0033] The matching unit is used to match the identifier security data corresponding to the data keywords in the request for the security data based on the user's access permissions, and load the matched identifier security data.
[0034] An electronic device, comprising:
[0035] A processor and a memory storing a computer executable program, which, when executed, causes the processor to perform the method described in any of the preceding descriptions.
[0036] A computer-readable storage medium storing one or more programs that, when executed by a processor, implement the method described in any of the preceding claims.
[0037] This invention improves the security of accessing secure data by performing dual verification of functional permissions and data keywords, avoiding the problem of security systems having a single type of permission authentication. Attached Figure Description
[0038] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:
[0039] Figure 1 This is a schematic diagram illustrating the authorization process in existing access control technology.
[0040] Figure 2 A schematic diagram illustrating the principle of a dual-authentication-based access control method provided in the embodiments of this specification;
[0041] Figure 3 A schematic diagram of a permission management device based on dual authentication provided in the embodiments of this specification;
[0042] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this specification;
[0043] Figure 5 A schematic diagram of a computer-readable medium provided for embodiments of this specification;
[0044] Figure 6 A schematic diagram of a keyword identifier for permission management based on two-factor authentication provided in the embodiments of this specification;
[0045] Figure 7 This is an authorization diagram illustrating a two-factor authentication-based access control system provided in an embodiment of this specification. Detailed Implementation
[0046] Exemplary embodiments of the invention will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limiting the invention to the embodiments set forth herein. Rather, these exemplary embodiments are provided to make the invention more comprehensive and complete, and to facilitate a full communication of the inventive concept to those skilled in the art. The same reference numerals in the drawings denote the same or similar elements, components, or parts, and therefore repeated descriptions of them will be omitted.
[0047] Subject to the technical concept of this invention, the features, structures, characteristics or other details described in a particular embodiment may be combined in one or more other embodiments in a suitable manner.
[0048] In the description of specific embodiments, the features, structures, characteristics, or other details described in this invention are intended to enable those skilled in the art to fully understand the embodiments. However, it is not excluded that those skilled in the art can practice the technical solutions of this invention without one or more of the specific features, structures, characteristics, or other details.
[0049] The diagrams shown in the accompanying drawings are merely illustrative and do not necessarily include all content and operations / steps, nor do they necessarily need to be performed in the described order. For example, some operations / steps can be broken down, while others can be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.
[0050] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.
[0051] The terms “and / or” or “and / or” include all combinations of any one or more of the listed items.
[0052] Reference Figure 1 This is a schematic diagram of authorization in existing permission management technology. Current permission management verification mechanisms typically allocate permissions to functional modules on the operational side, or add specific operation assignments to the functional modules, such as... Figure 1As shown, when a user is assigned permission to a functional module, the user can directly view the content of the overview screen, security intelligence, and negative news in the functional module. However, since there is no security protection for the specified data content in the overview screen, security intelligence, and negative news, the user permission division is ambiguous, and the specific data content is not strictly authorized and divided. This results in the existing permission management verification mechanism being too simple and having low security. To address the above problems, this invention proposes a permission management method, device, and electronic device based on dual verification.
[0053] Reference Figure 2 A schematic diagram illustrating the principle of a two-factor authentication-based access control method provided in the embodiments of this specification includes:
[0054] S201: Request to obtain user access security data;
[0055] In a preferred embodiment of the present invention, when a user needs to access secure data, the user must send a request for secure data to the permission management center. The request for secure data includes the user's request content, the user's login identity information, etc. The permission management center verifies the request for secure data to perform data permission operations, thereby protecting data security and system security.
[0056] S202: Perform function permission verification on the request for the security data to obtain a first verification result;
[0057] In a preferred embodiment of the present invention, the user's login identity information is verified to check whether the user has the functional permissions corresponding to the security data. When the verification result is that the functional permissions exist, the verification of the functional permissions is completed, so as to provide a basis for the subsequent verification of data permissions. When the verification result is that the functional permissions do not exist, the user's request for security data will be rejected, thereby protecting data security and system security.
[0058] S203: Perform data keyword verification on the request for the security data to obtain a second verification result;
[0059] In a preferred embodiment of the present invention, when the first verification result indicates the existence of functional permissions, a further data permission verification is required for the user's security data request. Specifically, this involves keyword verification of the security data request. When the security data request contains a keyword identifying the security data, the data permission verification is successful, and the user then has the permission to view the security data corresponding to the security data request. Through these two permission verifications, the protection of security data and the security system is achieved, preventing damage to the security system and security data from errors or malicious actions. It should be noted that there is no explicit order between functional permission verification and data permission verification; however, performing functional permission verification first and then data permission verification is optimal.
[0060] S204: When both the first verification result and the second verification result are successfully verified, authorize the user's access rights and load the security data corresponding to the request for the security data.
[0061] In a preferred embodiment of the present invention, based on the successful verification of permissions and data keywords, the user has the right to view the security data corresponding to the request for security data. Users who do not meet the above two verifications will have their requests rejected. The dual permission verification method protects the security data and the security system, preventing the security system and security data from being damaged by errors or malicious acts.
[0062] Furthermore, before performing data keyword verification on the request for the secure data, the process includes:
[0063] Retrieve multiple security data entries from the security database;
[0064] Each piece of security data is identified by a keyword to obtain identified security data;
[0065] Authorize the target user with the data keywords corresponding to the identified security data.
[0066] In a preferred embodiment of the present invention, referring to Figure 6 Add data keyword identifiers to functional modules, such as keyword 1, keyword 2, keyword 3, ..., keyword n, etc. Keywords include: code, vulnerability, fraud, virus, etc. Each piece of security data has one or more data keyword identifiers, which are attached to the specific information data. This identifies each piece of data information and lays the foundation for subsequent data permission division. For example, a code vulnerability data in security intelligence is assigned the data keywords "code" and "vulnerability". When a user has permission to view the code vulnerability data, the code vulnerability data is matched and loaded using the data keywords "code" and "vulnerability".
[0067] In a preferred embodiment of the present invention, referring to Figure 7In the functional modules, the role is granted viewing permissions for the overview dashboard, security intelligence, and negative news. However, the role is not granted permissions to input and configure permissions for the overview dashboard, security intelligence, and negative news. In the data modules, users are granted access permissions for security intelligence data in the overview dashboard, negative intelligence data in the overview dashboard, vulnerability data in the security intelligence section, and fraud data in the negative news section. Since the functional permissions granted to the role are ultimately assigned to the user, the user now has viewing permissions for the overview dashboard, security intelligence, and negative news, as well as access permissions for security intelligence data in the overview dashboard, vulnerability data in the security intelligence section, and fraud data in the negative news section. Users can access the specified data content within these permissions. For permissions not granted to users in the functional and data modules, the security system will deny access when a user requests to access security data. This method of authorizing functional and data permissions achieves security protection for security data and improves data security.
[0068] Furthermore, target user permissions are granted using roles. Users belong to a role and inherit the role's permissions. Roles have permissions for both functional modules and data modules. This approach achieves role-based allocation of application permissions, supports user-based data permission authorization, and ensures minimal authorization for each user, thereby guaranteeing a secure and controllable system. Simultaneously, data isolation ensures user independence and prevents interference. Authorization is more flexible; by defining roles and then granting permissions to specific users, different business and data permissions can be matched to employees with different responsibilities. This helps the company efficiently and conveniently solve practical production problems while meeting security compliance and regulatory requirements.
[0069] Furthermore, obtaining the second verification result includes:
[0070] Determine whether the data keyword exists in the request for the security data;
[0071] When the data keyword is present in the request for the security data, the second verification result is successful.
[0072] In a preferred embodiment of the present invention, the request for security data is subject to keyword verification. When the request for security data contains a keyword that identifies the security data, the data permission verification is successful, and the user then has the right to view the security data corresponding to the request. Through the above verification of data permissions, the security data and the security system are protected, and the security system and security data are prevented from being damaged by errors or malicious acts.
[0073] Furthermore, the security data corresponding to the request to authorize user access and load the security data includes:
[0074] Based on user access permissions, identify security data corresponding to the data keywords in the request for the security data is matched, and the matched identification security data is loaded.
[0075] In a preferred embodiment of the present invention, under the premise that the user has functional permissions and data permissions, the security system matches the identifier security data corresponding to the data keywords in the security data request according to the user's security data request. At this time, the user can read the security data specified in the security data request, thereby realizing the protection of security data and solving the problems of the previous permission verification mechanism being too simple, complicated to use, and difficult to develop and maintain.
[0076] Figure 3 A schematic diagram of a dual-authentication-based access control device provided in this specification includes:
[0077] Request Module 301 is used to obtain requests for user access security data.
[0078] The first verification module 302 is used to perform functional permission verification on the request for the security data and obtain a first verification result.
[0079] The second verification module 303 is used to perform data keyword verification on the request for the security data and obtain a second verification result.
[0080] The data reading module 304 is used to authorize user access permissions and load the security data corresponding to the request for the security data when both the first verification result and the second verification result are successfully verified.
[0081] Furthermore, the device also includes:
[0082] The data acquisition module is used to retrieve multiple pieces of security data from the security database;
[0083] The keyword identification module is used to identify each piece of security data with keywords to obtain identified security data.
[0084] The authorization module is used to authorize the data keywords corresponding to the identified security data to the target user.
[0085] Furthermore, the second verification module 303 includes:
[0086] The judgment unit is used to determine whether the data keyword exists in the request for the security data;
[0087] The verification unit determines that if the data keyword exists in the request for the security data, the second verification result is successful.
[0088] Furthermore, the data reading module 304 includes:
[0089] The matching unit is used to match the identifier security data corresponding to the data keywords in the request for the security data based on the user's access permissions, and load the matched identifier security data.
[0090] The functions of the apparatus in this embodiment have been described in the above method embodiments. Therefore, for any parts not detailed in this embodiment, please refer to the relevant descriptions in the foregoing embodiments, which will not be repeated here.
[0091] Based on the same inventive concept, embodiments of this specification also provide an electronic device.
[0092] The following describes embodiments of the electronic device of the present invention, which can be considered as specific implementations of the methods and apparatus embodiments of the present invention described above. Details described in the embodiments of the electronic device of the present invention should be considered as supplements to the methods or apparatus embodiments described above; details not disclosed in the embodiments of the electronic device of the present invention can be implemented with reference to the methods or apparatus embodiments described above.
[0093] Reference Figure 4 This is a schematic diagram of an electronic device provided as an embodiment of this specification. Refer to the following... Figure 4 To describe the electronic device 400 according to this embodiment of the invention. Figure 4 The electronic device 400 shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.
[0094] like Figure 4 As shown, the electronic device 400 is presented in the form of a general-purpose computing device. The components of the electronic device 400 may include, but are not limited to: at least one processing unit 410, at least one storage unit 420, a bus 430 connecting different device components (including storage unit 420 and processing unit 410), a display unit 440, etc.
[0095] The storage unit stores program code that can be executed by the processing unit 410, causing the processing unit 410 to perform the steps described in the processing method section of this specification according to various exemplary embodiments of the present invention. For example, the processing unit 410 can perform, for example... Figure 2 The steps are shown.
[0096] The storage unit 420 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 4201 and / or a cache storage unit 4202, and may further include a read-only memory unit (ROM) 4203.
[0097] The storage unit 420 may also include a program / utility 4204 having a set (at least one) of program modules 4205, such program modules 4205 including but not limited to: operating devices, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.
[0098] Bus 430 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.
[0099] Electronic device 400 can also communicate with one or more external devices 500 (e.g., keyboard, pointing device, Bluetooth device, etc.), and with one or more devices that enable a user to interact with the electronic device 400, and / or with any device that enables the electronic device 400 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 450. Furthermore, electronic device 400 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 460. Network adapter 460 can communicate with other modules of electronic device 400 via bus 430. It should be understood that, although... Figure 4 As not shown, other hardware and / or software modules may be used in conjunction with electronic device 400, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID devices, tape drives, and data backup storage devices.
[0100] Through the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described in this invention can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this invention can be embodied in the form of a software product, which can be stored in a computer-readable storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, or network device, etc.) to execute the above-described method according to this invention. When the computer program is executed by a data processing device, it enables the computer-readable medium to implement the above-described method of this invention, i.e.: as... Figure 2 The method shown.
[0101] Reference Figure 5 This is a schematic diagram of a computer-readable medium provided for embodiments of this specification.
[0102] accomplish Figure 2 The computer program of the method shown can be stored on one or more computer-readable media. A computer-readable medium can be a readable signal medium or a readable storage medium. A readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor device, apparatus, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof.
[0103] The computer-readable storage medium may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The readable storage medium may also be any readable medium other than a readable storage medium, capable of transmitting, propagating, or transmitting a program for use by or in connection with an instruction execution device, apparatus, or apparatus. The program code contained on the readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.
[0104] Program code for performing the operations of this invention can be written in any combination of one or more programming languages, including object-oriented programming languages such as Java and C++, and conventional procedural programming languages such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).
[0105] In summary, this invention can be implemented in hardware, or as software modules running on one or more processors, or a combination thereof. Those skilled in the art will understand that in practice, general-purpose data processing devices such as microprocessors or digital signal processors (DSPs) can be used to implement some or all of the functions of some or all of the components according to the embodiments of the invention. The invention can also be implemented as a device or apparatus program (e.g., a computer program and computer program product) for performing part or all of the methods described herein. Such programs implementing the invention can be stored on a computer-readable medium or can take the form of one or more signals. Such signals can be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.
[0106] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the present invention is not inherently related to any specific computer, virtual device, or electronic device, and various general-purpose devices can also implement the present invention. The above descriptions are merely specific embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.
[0107] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.
[0108] The above description is merely an embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of this application should be included within the scope of the claims of this application.
Claims
1. A permission management method based on two-factor authentication, characterized in that, include: A request to obtain user access security data; The request for the security data is subjected to functional permission verification to obtain a first verification result; wherein, the functional permissions are authorized by roles, and users inherit the permissions of roles to achieve the least authorization for users and achieve data isolation, so that users are independent of each other; Multiple security data entries are retrieved from a security database; each security data entry is identified by a keyword to obtain identified security data, which facilitates the division of data permissions; the data keywords corresponding to the identified security data are authorized to the user; wherein each security data entry has one or more of the identified data keywords. The request for the secure data is subjected to data keyword verification to obtain a second verification result; wherein, the data keyword verification includes: determining whether the data keyword authorized to the user exists in the request for the secure data; When both the first verification result and the second verification result are successfully verified, the identifier security data corresponding to the data keywords in the request for the security data is matched based on the user access permissions. The matched identifier security data is loaded, thereby enabling different data permissions to be matched for different users through dual verification authorization of the function permissions and the data permissions, thus achieving security protection for the security data.
2. The permission management method based on dual authentication as described in claim 1, characterized in that, The second verification result obtained includes: Determine whether the data keyword exists in the request for the security data; When the data keyword is present in the request for the security data, the second verification result is successful.
3. A permission management device based on two-factor authentication, characterized in that, include: The request retrieval module is used to retrieve user requests for access security data. The first verification module is used to perform functional permission verification on the request for the security data and obtain a first verification result; wherein, the functional permissions are authorized by roles, and users inherit the permissions of roles to achieve the least authorization for users and achieve data isolation, so that users are independent of each other; wherein, the permissions of the roles include functional permissions and data permissions; The data acquisition module is used to retrieve multiple pieces of security data from the security database; The keyword identification module is used to identify each piece of security data with keywords to obtain identified security data, so as to facilitate the division of data permissions; and to authorize the user with the data keywords corresponding to the identified security data; wherein, each piece of security data has one or more of the data keywords as identifiers; The second verification module is used to perform data keyword verification on the request for the security data to obtain a second verification result; wherein, the data keyword verification includes: determining whether the data keyword authorized to the user exists in the request for the security data; The data reading module is used to load the matching security data based on the user access permissions and the data keywords in the request for the security data when both the first verification result and the second verification result are successfully verified. This allows for the dual verification and authorization of the function permissions and the data permissions, enabling different data permissions to be matched for different users and achieving security protection for the security data.
4. The access control device based on dual authentication as described in claim 3, characterized in that, The second verification module includes: The judgment unit is used to determine whether the data keyword exists in the request for the security data; The verification unit determines that if the data keyword exists in the request for the security data, the second verification result is successful.
5. An electronic device, wherein, The electronic device includes: Processor; and, A memory storing a computer executable program, which, when executed, causes the processor to perform the method according to any one of claims 1-2.
6. A computer-readable storage medium, wherein, The computer-readable storage medium stores one or more programs that, when executed by a processor, implement the method of any one of claims 1-2.