Login authentication management method and device, processor and machine readable storage medium

Abstract

The embodiment of the application provides a login authentication management method, device, processor and machine readable storage medium, and relates to the technical field of information security. The method comprises the following steps: in response to a connection request of a user terminal, obtaining a first authentication parameter and a first connection target of the user terminal; calling a server authentication file to obtain a second authentication parameter of the server authentication file; in the case that the first authentication parameter and the second authentication parameter satisfy a matching condition, obtaining login information of the first connection target and transmitting the login information to the user terminal, and the user terminal can establish a connection with the first connection target through the login information. In the application, the user terminal cannot directly obtain the login information of the connection target, so that the data security can be effectively improved, and when the login information of the connection target changes, the user terminal does not need to modify the connection code or the configuration file, and only needs to modify the login information in the configuration file on the server side.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, in particular to a login authentication management method, a login authentication management device, a processor and a machine readable storage medium. BACKGROUND

[0002] At present, when an application accesses a database or a service, a traditional method is to access through password authentication or file authentication.

[0003] When password authentication is performed, connection information such as a user password is usually written in a connection code, a configuration file or a database. If the user password is written in the connection code or the configuration file, if the connection information such as the password, IP and port of the target database or the target service changes, the connection code or the configuration file needs to be modified and recompiled and deployed. If the user password is written in the database, the user can obtain all the connection information of the target beyond his access range, which has a security risk.

[0004] When authentication is performed through an authentication file, after the authentication is completed, the local machine can arbitrarily connect to the target database or the target service. However, the authentication through the authentication file has the following problems: when the user accesses different databases or services, the administrator needs to distribute and deploy different authentication files to the user end, which is cumbersome; if the authentication file of the user is lost, others can perform authentication through the authentication file and can illegally access the database or the service, which also has a security risk. SUMMARY

[0005] The embodiments of the present application aim to provide a login authentication management method, a login authentication management device, a processor and a machine readable storage medium.

[0006] In order to achieve the above-mentioned purpose, the first aspect of the present application provides a login authentication management method applied to a service end, comprising:

[0007] In response to a connection request of a user end, a first authentication parameter and a first connection target of the user end are obtained;

[0008] A service end authentication file is called to obtain a second authentication parameter of the service end authentication file;

[0009] In the case that the first authentication parameter and the second authentication parameter satisfy a matching condition, login information of the first connection target is obtained and transmitted to the user end, and the user end can establish a connection with the first connection target through the login information.

[0010] Optionally, the first authentication parameter comprises a first authentication file ID of the user terminal authentication file and a first permission parameter corresponding to the first authentication file ID; and the second authentication parameter comprises a second authentication file ID corresponding to a different user terminal authentication file and a second permission parameter corresponding to each second authentication file ID.

[0011] The matching condition comprises:

[0012] The first authentication file ID is consistent with one of the second authentication file IDs in the second authentication parameter; and

[0013] The first permission parameter matches the second permission parameter corresponding to the second authentication file ID.

[0014] Optionally, the first permission parameter comprises a first user terminal address and a first access time, and the first access time is a current time; and the second permission parameter comprises at least one second user terminal address and at least one second access time corresponding to each second user terminal address.

[0015] The first permission parameter matches the second permission parameter corresponding to the second authentication file ID, comprising:

[0016] The first user terminal address is consistent with at least one second user terminal address corresponding to the second authentication file ID; and

[0017] The first access time is consistent with one of at least one second access time corresponding to the second user terminal address.

[0018] Optionally, the first permission parameter further comprises a first user ID; the second permission parameter further comprises at least one access permission control ID corresponding to the second authentication file ID and a second user ID corresponding to the access permission control ID; and the access permission control ID is used to represent a second connection target that allows the second user ID corresponding to the access permission control ID to access.

[0019] The first permission parameter matches the second permission parameter corresponding to the second authentication file ID, further comprising:

[0020] The first user terminal address is consistent with the second user terminal address corresponding to the second authentication file ID, one of the first access time and the at least one second access time corresponding to the second user terminal address is consistent, the first user ID is consistent with the second user ID, and the first connection target is consistent with the second connection target that allows the second user ID to access.

[0021] The second aspect of the present application provides a login authentication management method applied to a user terminal, comprising:

[0022] In response to the connection instruction, a first authentication parameter and a first connection target of the user terminal are acquired, and a connection request is generated based on the first authentication parameter and the first connection target;

[0023] The connection request is sent to a server, and the server can acquire login information of the first connection target according to the connection request;

[0024] The login information is received from the server; and

[0025] The connection is established with the first connection target according to the login information.

[0026] Optionally, the first authentication parameter includes a first authentication file ID of a user terminal authentication file and a first permission parameter corresponding to the first authentication file ID.

[0027] The first permission parameter includes:

[0028] a first user ID, a first user terminal address, and a first access time, and the first access time is a current time.

[0029] The third aspect of the present application provides a login authentication management device deployed on a server, comprising:

[0030] A data acquisition module configured to acquire a first authentication parameter and a first connection target of a user terminal in response to a connection request of the user terminal;

[0031] A permission authentication module configured to call a server authentication file to acquire a second authentication parameter of the server authentication file; and

[0032] In a case where the first authentication parameter and the second authentication parameter satisfy a matching condition, login information of the first connection target is acquired and transmitted to the user terminal, and the user terminal can establish a connection with the first connection target through the login information.

[0033] Optionally, the first authentication parameter includes a first authentication file ID of a user terminal authentication file and a first permission parameter corresponding to the first authentication file ID; and the second authentication parameter includes a second authentication file ID corresponding to a different user terminal authentication file and a second permission parameter corresponding to each second authentication file ID.

[0034] The permission authentication module is further configured to:

[0035] In a case where the first authentication file ID is consistent with one of the second authentication file IDs in the second authentication parameter, and the first permission parameter matches the second permission parameter corresponding to the second authentication file ID, it is determined that the first authentication parameter and the second authentication parameter satisfy the matching condition.

[0036] Optionally, the first permission parameter comprises a first user terminal address and a first access time, and the first access time is a current time; and the second permission parameter comprises at least one second user terminal address and at least one second access time corresponding to each second user terminal address.

[0037] The permission authentication module is further configured to:

[0038] determine that the first permission parameter matches the second permission parameter corresponding to the second authentication file ID when the first user terminal address is consistent with a second user terminal address corresponding to the second authentication file ID, and the first access time is consistent with one of at least one second access time corresponding to the second user terminal address.

[0039] Optionally, the first permission parameter further comprises a first user ID; the second permission parameter further comprises at least one access permission control ID corresponding to the second authentication file ID, and a second user ID corresponding to the access permission control ID; and the access permission control ID is used to represent a second connection target that the second user ID corresponding to the access permission control ID is allowed to access.

[0040] The permission authentication module is further configured to:

[0041] determine that the first permission parameter matches the second permission parameter corresponding to the second authentication file ID when the first user terminal address is consistent with a second user terminal address corresponding to the second authentication file ID, the first access time is consistent with one of at least one second access time corresponding to the second user terminal address, the first user ID is consistent with the second user ID, and the first connection target is consistent with a second connection target that the second user ID is allowed to access.

[0042] A fourth aspect of the present application provides a login authentication management device deployed on a user terminal, comprising:

[0043] a connection request module configured to, in response to a connection instruction, acquire a first authentication parameter and a first connection target of the user terminal, and generate a connection request based on the first authentication parameter and the first connection target;

[0044] a data sending module configured to send the connection request to a server, wherein the server can acquire login information of the first connection target according to the connection request;

[0045] a data receiving module configured to receive the login information from the server; and

[0046] The connecting module is configured to establish a connection with the first connection target according to the login information.

[0047] Optionally, the first authentication parameter comprises a first authentication file ID of the user-side authentication file and a first permission parameter corresponding to the first authentication file ID.

[0048] The first permission parameter comprises:

[0049] The first user ID, the first user-side address and a first access time, wherein the first access time is a current time.

[0050] The fifth aspect of the present application provides a processor configured to execute the above-mentioned login authentication management method applied to the server side or configured to execute the above-mentioned login authentication management method applied to the user side.

[0051] The sixth aspect of the present application provides a machine-readable storage medium, which stores instructions, wherein the instructions, when executed by a processor, cause the processor to be configured to execute the above-mentioned login authentication management method applied to the server side or the instructions, when executed by a processor, cause the processor to be configured to execute the above-mentioned login authentication management method applied to the user side.

[0052] The seventh aspect of the present application provides a computer program product comprising a computer program, wherein the computer program, when executed by a processor, implements the above-mentioned login authentication management method applied to the server side or the computer program, when executed by a processor, implements the above-mentioned login authentication management method applied to the user side.

[0053] Through the above technical solution, when the user side requests a connection, the server side first verifies the authentication parameter of the user side, and only when the authentication parameter of the user side and the authentication parameter of the server side satisfy the matching condition, the server side sends the login information of the connection target to the user side for login connection. In the present application, the user side cannot directly obtain the login information of the connection target, thereby effectively improving the data security, and when the login information of the connection target changes, the user side does not need to modify the connection code or the configuration file, but only needs to modify the login information in the configuration file on the server side.

[0054] Other features and advantages of the present application will be described in detail in the following specific embodiments. BRIEF DESCRIPTION OF DRAWINGS

[0055] The accompanying drawings are included to provide a further understanding of the present application and constitute a part of the specification, which together with the specific embodiments below, serve to explain the present application, but do not constitute a limitation on the present application. In the drawings:

[0056] Figure 1 Fig. 1 schematically shows a flowchart of a login authentication management method applied to a server according to an embodiment of the present application;

[0057] Figure 2 Fig. 2 schematically shows a connection authentication logic diagram of a user end according to an embodiment of the present application;

[0058] Figure 3 Fig. 3 schematically shows a flowchart of a login authentication management method applied to a user end according to an embodiment of the present application;

[0059] Figure 4 Fig. 4 schematically shows a server login authentication management device according to an embodiment of the present application;

[0060] Figure 5 Fig. 5 schematically shows a user end login authentication management device according to an embodiment of the present application. DETAILED DESCRIPTION

[0061] In order to make the objectives, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. It should be understood that the specific embodiments described herein are merely used to explain and illustrate the embodiments of the present application, and are not used to limit the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts fall within the scope of protection of the present application.

[0062] It should be noted that if the embodiments of the present application involve directional indications (such as up, down, left, right, front, back, etc.), the directional indications are merely used to explain the relative positional relationship, movement condition, etc. between components in a certain posture (as shown in the drawings), and if the certain posture changes, the directional indications also change accordingly.

[0063] In addition, if the embodiments of the present application involve descriptions such as “first”, “second”, etc., the descriptions of “first”, “second”, etc. are merely for description purposes, and cannot be understood as indicating or implying the relative importance of the indicated technical features or implicitly indicating the number of the indicated technical features. Therefore, the features limited by “first”, “second” can explicitly or implicitly include at least one of the features. In addition, the technical solutions of the various embodiments can be combined with each other, but it must be based on the fact that a person of ordinary skill in the art can realize it, and when the combination of technical solutions contradicts each other or cannot be realized, it should be considered that the combination of technical solutions does not exist, and is not within the scope of protection claimed by the present application.

[0064] Currently, users need to know the database or service's login information and be authenticated before accessing the database or related services. For example, accessing an Oracle database requires knowing the Oracle database's IP address, instance name, username, and password. Users must enter this information on the system login page and pass authentication before accessing the data in the database. Similarly, accessing various HTTP / HTTPS and SFTP / FTP services requires authentication using a username and password before calling the relevant services. Because the user client can directly obtain the database or service's username and password, if these are lost, the database or service may be unauthorized.

[0065] If access to the database or service is via an authentication file, a corresponding authentication file needs to be generated for the user's end. For example, if a user needs to access data under the "abc" user in the Hive database through operating system user "a" on server A, the administrator needs to generate an authentication file named "abc.keytab" on the server and send it to the user. The user stores "abc.keytab" in a file path under operating system user "a" on server A, and then completes authentication of "abc.keytab" by executing relevant commands through an authentication program. After successful authentication, operating system user "a" on server A can access the data under the "abc" user in the Hive database. If user "a" needs to access data under the "abcd" user in the Hive database, the administrator needs to redistribute and deploy the authentication file "abcd.keytab" to user "a". However, if the authentication file is illegally copied, the copyer can use it to access the database or service from any user's end, posing a significant security risk.

[0066] In response to the above problems, such as Figure 1 As shown, in one embodiment of this application, a login authentication management method is provided, applied to a server, including:

[0067] S100: In response to the connection request from the user, obtain the first authentication parameters and the first connection target from the user;

[0068] S200: Call the server-side authentication file to obtain the second authentication parameter of the server-side authentication file; and if the first authentication parameter and the second authentication parameter meet the matching conditions, obtain the login information of the first connection target and transmit the login information to the user terminal, so that the user terminal can establish a connection with the first connection target through the login information.

[0069] Thus, when the user terminal requests to connect, the server first verifies the authentication parameters of the user terminal, and only when the authentication parameters of the user terminal and the authentication parameters of the server satisfy the matching condition, the server sends the login information of the connection target to the user terminal for login connection. Since the user terminal cannot directly obtain the login information of the connection target, the data security can be effectively improved. Meanwhile, when the login information of the connection target changes, the user terminal does not need to modify the connection code or the configuration file, and only needs to modify the login information in the configuration file on the server side.

[0070] Specifically, the administrator pre-configures the authentication information on the server, including a server authentication file and a login information file. The login information file pre-writes the login information of all connection targets, including target ID, target IP, target port, target username, target password, etc. As shown in Table 1, taking the connection target including one database and one sftp service as an example, DB1 is the instance name of the target database, the IP address is 11.1.1.12, the target port number is 4034, one username of the database DB1 is abc, and the password corresponding to the user abc is abcdefg; sftp1 is the ID of the sftp service, the server IP address is 11.11.11.12, the target port number is 22, the username of the sftp service is sftp, and the password corresponding to the user sftp is sftp. In this way, the login information of multiple connection targets can be written in Table 1, and Table 1 can be stored as a login information file on the server.

[0071] Target ID Target IP Target Port Target User Name Target Password (encrypted) DB1 11.1.1.12 4034 abc abcdefg sftp1 11.11.11.12 22 sftp sftp

[0072] Table 1

[0073] In this embodiment, the second authentication parameter is a control parameter representing user authority. In order to ensure information security, the administrator needs to pre-write the second authentication parameter into the server authentication file. For example, the database DB1 only allows the user a of the operating system 1 to access, and the administrator needs to write the ID of the operating system of the user terminal, the ID of the user a, and the instance name DB1 of the database into the server authentication file and associate them. For example, the second authentication parameters are stored in the form of a list to indicate that the user a of the operating system 1 has the authority to access the database DB1. It can be understood that the second authentication parameter is not limited to the user terminal operating system ID, user ID, and connection target ID.

[0074] When the user needs to access the target database, the user needs to log in and connect through the operating system installed on the user side. It can be understood that the operating system can be for related applications. When the user generates a connection request for connecting the database DB1 through the corresponding operating system, the connection request is sent to the server. The server parses the received connection request and extracts the first authentication parameters in the connection request, such as the ID of the operating system, the user ID corresponding to the operating system, and the target ID of the connection target, such as DB1. The server calls the second authentication file stored in the server in advance and reads the second authentication parameters in the second authentication file. In turn, it is judged whether the ID of the operating system and the user ID corresponding to the operating system in the connection request have the access right to the database DB1. If the matching is successful, the server reads the login information of the database DB1 from Table 1, such as the ip address, port number, corresponding target username and password of the database DB1, and sends the login information to the user side. The user side logs in to the target database server or the target sftp server through the login information to access the target database server or the target sftp server. Since the user side of the present embodiment cannot directly obtain the username and password of the connection target, the possibility of the user side leaking the username and password of the connection target is effectively reduced, effectively ensuring information security; and since the permission control of the user side is completed in the server, whether the user side has the access right to the connection target is written in the server authentication file, so when the access right of the user side user is changed, only the increase or modification of the permission of the server authentication file is needed, for example, when the user a of the user side operating system 1 needs to increase the access right to the database DB2, only the operating system 1 and the user a are associated with the database DB2 in the server authentication file, and the right is increased.

[0075] In order to further ensure information security, the first authentication parameters include the first authentication file ID of the user side authentication file and the first permission parameters corresponding to the first authentication file ID; the second authentication parameters include the second authentication file ID corresponding to different user side authentication files and the second permission parameters corresponding to each second authentication file ID; and the matching condition in step S200 includes: the first authentication file ID is consistent with one of the second authentication file IDs in the second authentication parameters; and the first permission parameters match the second permission parameters corresponding to the second authentication file ID.

[0076] As Figure 2As shown, the user terminal permission is configured in advance and the user terminal authentication file is generated, the service terminal sends the user terminal authentication file to the user terminal, the user terminal authenticates the received user terminal authentication file through the authentication program and stores it in the user terminal, wherein the first authentication file ID and the first permission parameter are written in the user terminal authentication file in advance, the first authentication file ID is the ID of the user terminal authentication file, and the first permission parameter includes but is not limited to the ID of the operating system, the user ID corresponding to the operating system, the ID of the connection target allowed to be accessed by the user ID, etc.

[0077] In one embodiment, the administrator can configure the user terminal permission and the configuration of the service terminal authentication file on the authentication configuration server, and the user terminal authentication file and the authentication of the user terminal authentication file can be sent to the user terminal on the authentication management server; it can be understood that the authentication configuration and authentication management of the user terminal authentication file and the service terminal authentication file can also be executed on the same server, and the present embodiment does not limit this. Taking the configuration of the permissions of user 1 to user 3 as an example, the user terminal authentication file IDs corresponding to user 1 to user 3 are Authen1 to Authen3, the operating system IDs corresponding to user 1 to user 3 are APP1 to APP3, the user IDs corresponding to user 1 to user 3 are User1 to User3, and the databases accessed by user 1 to user 3 are DB1 to DB3 respectively. As shown in Table 2, Authen1-APP1-User1-DB1, Authen2-APP2-User2-DB2 and Authen3-APP3-User3-DB3 are written in each row in the form of a list in the service terminal authentication file in advance. It respectively indicates that the user whose identity ID is Authen1, operating system ID is APP1 and user ID is User1 is allowed to access the database DB1; the user whose identity ID is Authen2, operating system ID is APP2 and user ID is User2 is allowed to access the database DB2; the user whose identity ID is Authen3, operating system ID is APP3 and user ID is User3 is allowed to access the database DB3.

[0078] When the service end receives the connection request of the user end, the first authentication file ID of the user end authentication file, such as Authen1, is matched with the identity ID in the service end authentication file first. If there is the same identity ID, the service end continues to judge whether the first permission parameter of the user end and the second permission parameter of the identity ID Authen1 in the service end authentication file are matched. For example, in the first permission parameter, the operating system ID is APP1, the user ID is User1, and the second permission parameter of the identity ID Authen1 in the service end authentication file is matched. Then it is judged whether the ID of the connection target in the connection request is DB1. If yes, it is judged that the current user has the permission to access DB1. The service end obtains the related login information of DB1 from Table 1 and sends it to the user end. If the operating system ID in the first permission parameter is APP2, the user ID is User2, the service end judges that the current user has no permission to access the database DB1, and returns the error information to the user end. It can be understood that the operating system information is usually carried in the user ID, and the user ID can be used to judge which operating system the user ID belongs to. Therefore, in the embodiment, the operating system ID can not be included in the permission parameter.

[0079] Identity ID Operating System ID User ID Target ID Authen1 APP1 User1 DB1 Authen2 APP2 User2 DB2 Authen3 APP3 User3 DB3

[0080] Table 2

[0081] In the embodiment, the same user end authentication file can be bound with multiple access permissions at the same time. For example, to allow the same user end to access the database through the users of different operating systems, Authen1-APP1-User1-DB1, Authen1-APP2-User2-DB1 and Authen1-APP3-User3-DB2 can be written in each row in the service end authentication file. If the user end authentication file with the ID Authen1 is deployed on the user end server, the user can access the database DB1 through the user User1 of APP1 or the user User2 of APP2 on the user end server, and access the database DB2 through the user User3 of APP3. In this way, if the same user end needs to access different databases through different operating systems, it is not necessary to distribute and deploy the corresponding authentication file to the user end again. It is only necessary to reconfigure the service end authentication file.

[0082] In order to further improve the data security, the first permission parameter includes a first user end address and a first access time, and the first access time is the current time. The second permission parameter includes at least one second user end address and at least one second access time corresponding to each second user end address. The first permission parameter is matched with the second permission parameter corresponding to the second authentication file ID, which includes:

[0083] The first user terminal address corresponds to at least one second user terminal address of the second authentication file ID, and the first access time corresponds to one of at least one second access time of the second user terminal address.

[0084] To avoid data security problems caused by illegal copying of the user terminal authentication file, the embodiment further adds a control field of the user terminal IP address in the user terminal authentication file and the server authentication file. For example, a control field of the source host IP is added in the server authentication file, and Authen1-11.1.2.1-100-APP1-DB1 is written in the server authentication file, which indicates that the source host with the user terminal authentication file ID of Authen1 and with the IP address between 11.1.2.1-100 can access the database DB1 through the user APP1. By adding the limitation of the source host IP address, it can be effectively ensured that the copier cannot access the database DB1 on the device other than the source host when the user terminal authentication file is illegally copied.

[0085] Considering that the access amount of the database or the service may cause the system to crash, in order to effectively control the access flow, the embodiment further adds a control field of the target allowed access time in the server authentication file, so as to control the access time of the user and realize the control of the system flow. As shown in Table 3, Authen1-11.1.2.1-100-APP1-0:00-8:00-DB1 in the first row indicates that the source host with the user terminal authentication file ID of Authen1 and with the IP address between 11.1.2.1-100 can access the database DB1 through the user APP1 at 0:00-8:00. Authen1-11.1.2.1-100-APP2-8:00-18:00-DB1 in the second row of Table 3 indicates that the source host with the user terminal authentication file ID of Authen1 and with the IP address between 11.1.2.1-100 can access the database DB1 through the user APP2 at 8:00-18:00.

[0086] Identity ID Source Host IP User ID Target Allowed Access Time Target ID Authen1 11.1.2.1-100 APP1 0:00-8:00 DB1 Authen1 11.1.2.1-100 APP2 8:00-18:00 DB1

[0087] Table 3

[0088] In one embodiment, the first permission parameter further comprises a first user ID; the second permission parameter further comprises at least one access permission control ID corresponding to the second authentication file ID, and a second user ID corresponding to the access permission control ID; the access permission control ID is used to represent the second user ID corresponding to the access permission control ID to access the second connection target; the first permission parameter matches the second permission parameter corresponding to the second authentication file ID, further comprising: the first user end address is consistent with the second user end address corresponding to the second authentication file ID, one of the first access time and at least one second access time corresponding to the second user end address is consistent, the first user ID is consistent with the second user ID, and the first connection target is consistent with the second connection target allowed to be accessed by the second user ID.

[0089] As shown in Table 4, the access permission control ID field is also provided in the server authentication file, wherein the access permission control ID field indicates that the administrator authorizes the app1_db1_connect and app2_db2_connect two access controls to the Authen1 identity ID, app1_db1_connect indicates that the access permission is that the user end source host ip address belongs to 11.1.2.1-100, and the source host deployed with the user end authentication file ID Authen1 can access the database DB1 through the user APP1 at 0:00-8:00; app2_db2_connect indicates that the access permission is that the user end source host ip address belongs to 11.1.2.1-100, and the source host deployed with the user end authentication file ID Authen1 can access the database DB2 through the user APP2 at 8:00-18:00.

[0090]

[0091] Table 4

[0092] The server generates a user terminal authentication file Authen1.key according to the access permission control ID, the user stores the user terminal authentication file Authen1.key in a server satisfying the source host IP of the server authentication file, in the case of logging in the APP1 or APP2 user, calls the authentication program, and transmits the authentication file Authen1.key and the connection target such as the database DB1 that the user wants to access as parameters into the authentication program for authentication, after the authentication is completed, the user can initiate a connection request for accessing the connection target to the server through the user terminal source host, the server can obtain the current access time of the user terminal, the connection target that the user wants to access, the user terminal source host IP address, the user terminal source host operating system user ID and other parameters according to the connection request of the user terminal, and match with the server authentication file, if the matching is successful, the server obtains the login information of the connection target from Table 1 and returns to the user terminal, and then the user terminal can access the database DB1 through the login information.

[0093] As shown in Figure 3 The second aspect of the present application provides a login authentication management method, applied to a user terminal, comprising:

[0094] S300, in response to the connection instruction, obtaining the first authentication parameter of the user terminal and the first connection target, and generating a connection request based on the first authentication parameter and the first connection target;

[0095] S400, sending the connection request to the server, and the server can obtain the login information of the first connection target according to the connection request;

[0096] S500, receiving the login information from the server; and establishing a connection with the first connection target according to the login information.

[0097] In step S300, the first authentication parameter includes: a first authentication file ID of a user terminal authentication file and a first permission parameter corresponding to the first authentication file ID; the first permission parameter includes: a first user ID, a first user terminal address and a first access time, wherein the first user ID is a user terminal operating system user ID, the first user terminal address is a user terminal source host IP address, and the first access time is the current time.

[0098] As shown in Figure 4 The third aspect of the present application provides a login authentication management device, deployed in a server, comprising:

[0099] The data acquisition module is configured to obtain the first authentication parameter of the user terminal and the first connection target in response to the connection request of the user terminal;

[0100] The permission authentication module is configured to invoke the server-side authentication file, obtain a second authentication parameter of the server-side authentication file, and obtain login information of the first connection target and transmit the login information to the user terminal in a case where the first authentication parameter and the second authentication parameter satisfy a matching condition, and the user terminal can establish a connection with the first connection target through the login information.

[0101] Optionally, the first authentication parameter comprises a first authentication file ID of the user terminal authentication file and a first permission parameter corresponding to the first authentication file ID, and the second authentication parameter comprises a second authentication file ID corresponding to different user terminal authentication files and a second permission parameter corresponding to each second authentication file ID.

[0102] The permission authentication module is further configured to:

[0103] In a case where the first authentication file ID is consistent with one of the second authentication file IDs in the second authentication parameter, and the first permission parameter matches the second permission parameter corresponding to the second authentication file ID, it is determined that the first authentication parameter and the second authentication parameter satisfy the matching condition.

[0104] Optionally, the first permission parameter comprises a first user terminal address and a first access time, and the first access time is a current time; and the second permission parameter comprises at least one second user terminal address and at least one second access time corresponding to each second user terminal address.

[0105] The permission authentication module is further configured to:

[0106] In a case where the first user terminal address is consistent with the second user terminal address corresponding to the second authentication file ID, and the first access time is consistent with one of the at least one second access time corresponding to the second user terminal address, it is determined that the first permission parameter matches the second permission parameter corresponding to the second authentication file ID.

[0107] Optionally, the first permission parameter further comprises a first user ID; the second permission parameter further comprises at least one access permission control ID corresponding to the second authentication file ID and a second user ID corresponding to the access permission control ID; and the access permission control ID is used to represent a second connection target that the second user ID corresponding to the access permission control ID is allowed to access.

[0108] The permission authentication module is further configured to:

[0109] In a case that the first user terminal address is consistent with a second user terminal address corresponding to the second authentication file ID, one of the first access time is consistent with at least one second access time corresponding to the second user terminal address, the first user ID is consistent with a second user ID, and the first connection target is consistent with a second connection target allowed to be accessed by the second user ID, it is determined that the first permission parameter matches a second permission parameter corresponding to the second authentication file ID.

[0110] As shown in Figure 5 the fourth aspect of the present application provides a login authentication management device deployed in a user terminal, comprising:

[0111] a connection request module configured to obtain a first authentication parameter and a first connection target of the user terminal in response to a connection instruction, and generate a connection request based on the first authentication parameter and the first connection target;

[0112] a data sending module configured to send the connection request to a server, and the server is capable of obtaining login information of the first connection target according to the connection request;

[0113] a data receiving module configured to receive the login information from the server; and

[0114] a connection module configured to establish a connection with the first connection target according to the login information.

[0115] Optionally, the first authentication parameter comprises a first authentication file ID of a user terminal authentication file pre-stored in the user terminal and a first permission parameter corresponding to the first authentication file ID; and the first permission parameter comprises a first user ID, a first user terminal address and a first access time, and the first access time is a current time.

[0116] The fifth aspect of the present application provides a processor configured to execute the above-mentioned login authentication management method applied to a server, or configured to execute the above-mentioned login authentication management method applied to a user terminal.

[0117] The processor contains a core, and the core retrieves corresponding program units in the memory. The core can be set to one or more, and the above-mentioned login authentication management method applied to a user terminal is realized by adjusting the core parameters.

[0118] The memory can include a non-permanent memory in a computer readable medium, random access memory (RAM) and / or non-volatile memory such as read-only memory (ROM) or flash memory (flash RAM), and the memory includes at least one memory chip.

[0119] The sixth aspect of the present application provides a machine readable storage medium, which stores instructions, when executed by a processor, cause the processor to be configured to perform the login authentication management method applied to the server or the login authentication management method applied to the user terminal.

[0120] The embodiment of the present application provides a machine readable storage medium, which stores instructions, when executed by a processor, cause the processor to be configured to perform the login authentication management method applied to the server or the login authentication management method applied to the user terminal.

[0121] The machine readable storage medium includes permanent and non-permanent, removable and non-removable media, and can be implemented by any method or technology to store information. The information can be computer readable instructions, data structures, program modules or other data. Examples of machine readable storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other memory technologies, compact disc read only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible by a computing device.

[0122] The seventh aspect of the present application provides a computer program product, which includes a computer program, the computer program, when executed by a processor, implements the login authentication management method applied to the server or the login authentication management method applied to the user terminal.

[0123] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, device or computer program product. Therefore, the present application can be in the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware aspects. Moreover, the present application can be in the form of a computer program product implemented on one or more computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer usable program code.

[0124] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 The flowchart and / or block diagram in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to the present application. In this regard, each block in the flowchart and / or block diagrams can represent a module, segment, or portion of code, which comprises one or more executable Figure 1 The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks.

[0125] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 The flowchart and / or block diagram in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to the present application. In this regard, each block in the flowchart and / or block diagrams can represent a module, segment, or portion of code, which comprises one or more executable Figure 1 The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks.

[0126] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 The flowchart and / or block diagram in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to the present application. In this regard, each block in the flowchart and / or block diagrams can represent a module, segment, or portion of code, which comprises one or more executable Figure 1 The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks.

[0127] It should also be noted that the term "comprising" or "including" or any other variation thereof is intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus.

[0128] The embodiments of methods, devices, and computer program products described herein can be implemented in various ways. The embodiments of the application are not limited to the embodiments described herein, but can vary and be implemented in various ways. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of the application shall fall within the scope of claims of the application.

Claims

1. A login authentication management method, applied to a server, characterized in that, include: In response to a connection request from the user, the first authentication parameters and the first connection target of the user are obtained; Call the server-side authentication file to obtain the second authentication parameters of the server-side authentication file; If the first authentication parameter and the second authentication parameter meet the matching condition, the login information of the first connection target is obtained and the login information is transmitted to the user terminal, and the user terminal can establish a connection with the first connection target through the login information; The first authentication parameters include: a first authentication file ID of the user-end authentication file and a first permission parameter corresponding to the first authentication file ID. The user-end authentication file is generated by the server after configuring the user-end permissions in advance. The server sends the user-end authentication file to the user-end. The user-end authenticates the received user-end authentication file through an authentication program and stores it in the user-end. The second authentication parameters include: the second authentication file ID corresponding to different user terminal authentication files and the second permission parameter corresponding to each second authentication file ID; The matching conditions include: The first authentication file ID is consistent with one of the second authentication file IDs in the second authentication parameters; and The first permission parameter matches the second permission parameter corresponding to the second authentication file ID.

2. The login authentication management method according to claim 1, characterized in that, The first permission parameter includes a first user terminal address and a first access time, wherein the first access time is the current time; the second permission parameter includes at least one second user terminal address and at least one second access time corresponding to each second user terminal address. The first permission parameter matches the second permission parameter corresponding to the second authentication file ID, including: The first client address is the same as the second client address corresponding to the second authentication file ID; and The first access time is consistent with one of at least one second access time corresponding to the second client address.

3. The login authentication management method according to claim 2, characterized in that, The first permission parameter further includes a first user ID; the second permission parameter further includes at least one access control ID corresponding to the second authentication file ID, and a second user ID corresponding to the access control ID; the access control ID is used to characterize a second connection target that is allowed to be accessed by the second user ID corresponding to the access control ID; The first permission parameter matches the second permission parameter corresponding to the second authentication file ID, and further includes: The first user terminal address is consistent with the second user terminal address corresponding to the second authentication file ID, the first access time is consistent with one of at least one second access time corresponding to the second user terminal address, the first user ID is consistent with the second user ID, and the first connection target is consistent with the second connection target that allows the second user ID to access.

4. A login authentication management method, applied to a user terminal, used in conjunction with the login authentication management method described in any one of claims 1-3, characterized in that, include: In response to a connection command, the system obtains the first authentication parameters and the first connection target from the user terminal, and generates a connection request based on the first authentication parameters and the first connection target. The connection request is sent to the server, and the server can obtain the login information of the first connection target based on the connection request; Receive login information from the server; as well as A connection is established with the first connection target based on the login information.

5. The login authentication management method according to claim 4, characterized in that, The first authentication parameters include: the first authentication file ID of the user-end authentication file and the first permission parameter corresponding to the first authentication file ID; The first permission parameters include: first user ID, first user terminal address, and first access time, where the first access time is the current time.

6. A login authentication management device, deployed on a server, characterized in that, The apparatus employs the login authentication management method according to any one of claims 1-3, and the apparatus comprises: The data acquisition module is configured to acquire the first authentication parameters and the first connection target of the user terminal in response to the connection request from the user terminal. The authentication module is configured to call the server-side authentication file and obtain the second authentication parameters from the server-side authentication file; and If the first authentication parameter and the second authentication parameter meet the matching condition, the login information of the first connection target is obtained and the login information is transmitted to the user terminal, and the user terminal can establish a connection with the first connection target through the login information; The first authentication parameters include: a first authentication file ID of the user-end authentication file and a first permission parameter corresponding to the first authentication file ID. The user-end authentication file is generated by the server after configuring the user-end permissions in advance. The server sends the user-end authentication file to the user-end. The user-end authenticates the received user-end authentication file through an authentication program and stores it in the user-end. The second authentication parameters include: the second authentication file ID corresponding to different user terminal authentication files and the second permission parameter corresponding to each second authentication file ID; The authorization module is also configured as follows: If the first authentication file ID is consistent with one of the second authentication file IDs in the second authentication parameters, and the first permission parameter matches the second permission parameter corresponding to the second authentication file ID, then the first authentication parameter and the second authentication parameter are determined to meet the matching condition.

7. The login authentication management device according to claim 6, characterized in that, The first permission parameter includes a first user terminal address and a first access time, wherein the first access time is the current time; the second permission parameter includes at least one second user terminal address and at least one second access time corresponding to each second user terminal address. The authorization module is also configured as follows: If the first user terminal address is consistent with the second user terminal address corresponding to the second authentication file ID, and the first access time is consistent with one of at least one second access time corresponding to the second user terminal address, then it is determined that the first permission parameter matches the second permission parameter corresponding to the second authentication file ID.

8. The login authentication management device according to claim 7, characterized in that, The first permission parameter further includes a first user ID; the second permission parameter further includes at least one access control ID corresponding to the second authentication file ID, and a second user ID corresponding to the access control ID; the access control ID is used to characterize a second connection target that is allowed to be accessed by the second user ID corresponding to the access control ID; The authorization module is also configured as follows: If the first user terminal address is consistent with the second user terminal address corresponding to the second authentication file ID, the first access time is consistent with one of at least one second access time corresponding to the second user terminal address, the first user ID is consistent with the second user ID, and the first connection target is consistent with the second connection target that allows the second user ID to access, then it is determined that the first permission parameter matches the second permission parameter corresponding to the second authentication file ID.

9. A login authentication management device, deployed on a user terminal, characterized in that, The apparatus employs the login authentication management method according to any one of claims 4-5, and the apparatus comprises: The connection request module is configured to, in response to a connection command, obtain the first authentication parameters and the first connection target from the user terminal, and generate a connection request based on the first authentication parameters and the first connection target; The data sending module is configured to send the connection request to the server, and the server can obtain the login information of the first connection target based on the connection request; A data receiving module is configured to receive login information from the server; and The connection module is configured to establish a connection with the first connection target based on the login information.

10. The login authentication management device according to claim 9, characterized in that, The first authentication parameters include: the first authentication file ID of the user-end authentication file and the first permission parameter corresponding to the first authentication file ID; The first permission parameters include: first user ID, first user terminal address, and first access time, where the first access time is the current time.

11. A processor, characterized in that, It is configured to perform the login authentication management method according to any one of claims 1 to 3, or to perform the login authentication management method according to any one of claims 4 to 5.

12. A machine-readable storage medium storing instructions thereon, characterized in that, When executed by a processor, the instruction causes the processor to be configured to perform the login authentication management method according to any one of claims 1 to 3, or when executed by a processor, the instruction causes the processor to be configured to perform the login authentication management method according to any one of claims 4 to 5.

13. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the login authentication management method according to any one of claims 1 to 3, or when the computer program is executed by the processor, it implements the login authentication management method according to any one of claims 4 to 5.

Images