Authentication method, device, service system access method, device and storage medium

Abstract

The present application relates to an intelligent authentication technology, and specifically to an authentication method, device, computer equipment, storage medium and computer program product. The method comprises: when a target object accesses a target page in a business system of an access permission engine system, obtaining a permission bit identifier of the target object and an authentication ticket obtained by logging into the permission engine system; matching the permission bit identifier with the role category of the target object; verifying the authentication ticket, and when the authentication ticket is verified, determining a pre-configured accessible page link associated with the permission bit identifier; feeding back the accessible page link to the business system; the fed-back accessible page link is used to instruct the business system to determine the target object's access rights to the target page based on the matching relationship between the page link of the target page and the accessible page link. The use of this method can improve the efficiency of authentication. The embodiments of the present invention can be applied to various scenarios such as cloud technology, artificial intelligence, smart transportation, and assisted driving.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an authentication method, device, business system access method, device and storage medium. Background Art

[0002] As the usage scenarios and functions of business systems become more and more extensive, business systems are also beginning to involve more and more information security issues. Therefore, when a user wants to access a business system, the user needs to be authenticated first to determine whether the user has the authority to access the business system.

[0003] The existing technology mainly develops a separate permission management module for each business system, and uses the permission management module to determine whether the user has the permission to access the business system. In this mode, if there are multiple business systems, a permission management module needs to be developed for each business system, which results in a large amount of repeated development work, thereby reducing the authentication efficiency due to repeated development work. Summary of the invention

[0004] Based on this, it is necessary to provide an authentication method, apparatus, computer device, computer-readable storage medium and computer program product that can improve authentication efficiency in response to the above technical problems.

[0005] In a first aspect, the present application provides an authentication method, the method comprising:

[0006] When the target object accesses the target page in the business system of the access permission engine system, the permission bit identifier of the target object and the authentication ticket obtained by logging into the permission engine system are obtained; the permission bit identifier matches the role category of the target object;

[0007] Verifying the authentication ticket, and when the authentication ticket is verified, determining a preconfigured accessible page link associated with the permission bit identifier;

[0008] The accessible page link is fed back to the business system; the fed back accessible page link is used to instruct the business system to determine the target object's access rights to the target page based on a matching relationship between the page link of the target page and the accessible page link.

[0009] In a second aspect, the present application further provides an authentication device, the device comprising:

[0010] A ticket acquisition module, used to acquire the permission bit identifier of the target object and the authentication ticket obtained by logging into the permission engine system when the target object accesses the target page in the business system of the access permission engine system; the permission bit identifier matches the role category of the target object;

[0011] A link acquisition module, used to verify the authentication ticket and, when the authentication ticket is verified, determine a pre-configured accessible page link associated with the permission bit identifier;

[0012] A feedback module is used to feed back the accessible page link to the business system; the fed-back accessible page link is used to instruct the business system to determine the target object's access rights to the target page based on the matching relationship between the page link of the target page and the accessible page link.

[0013] In one embodiment, the authentication device also includes a ticket generation module, which is used to generate an authentication ticket according to the login account of the target object when logging into the permission engine system, and feedback the authentication ticket to the business system; wherein the feedback authentication ticket is used to instruct the business system to cache the authentication ticket and set a validity period, and when it is determined that the target object has accessed the target page and the authentication ticket is within the validity period, the authentication ticket is sent to the permission engine system.

[0014] In one of the embodiments, the ticket generation module is also used to trigger the display of a login page; the target object logs in to the permission engine system through the login page of the permission engine system; the login page is a page displayed when the target object accesses the business system for the first time within a preset time period; when the target object accesses the business system and the session object of the business system does not include an authentication ticket or the authentication ticket is invalid, it is determined that the target object is accessing the business system for the first time within the preset time period.

[0015] In one of the embodiments, the ticket generation module is also used to obtain the login account and login password entered through the login page of the permission engine system; when the login account matches the login password, obtain a preconfigured redirection page link; send the redirection page link to the front end of the business system; the redirection page link sent is used to trigger the front end of the business system to display a corresponding redirection page, and the redirection page displays an access control for accessing the target page.

[0016] In one of the embodiments, the ticket generation module is also used to obtain a login account entered through a login page of an authentication system; generate an authorization code based on the login account, and feed back the authorization code; the fed-back authorization code is used to trigger the business system to generate an authentication ticket generation request carrying the authorization code; receive the authentication ticket generation request sent by the business system, and generate an authentication ticket based on the authorization code in the authentication ticket generation request.

[0017] In one of the embodiments, the ticket generation module is also used to parse the authorization code to obtain the login account of the target object; determine the pre-configured object identity information corresponding to the login account; encrypt the object identity information to obtain identity encryption information; and sign the identity encryption information and the object identifier of the target object through a preset private key to obtain an authentication ticket.

[0018] In one of the embodiments, the ticket generation module is also used to obtain an encryption function and a key; divide the object identity information to obtain multiple identity information fragments; encrypt each of the identity information fragments using the encryption function and the key to obtain an encrypted fragment corresponding to each of the identity information fragments; and obtain identity encryption information by combining the encrypted fragments corresponding to each of the identity information fragments.

[0019] In one of the embodiments, the authentication device is also used to obtain a permission bit identifier acquisition request sent by the business system, and parse the permission bit identifier acquisition request to obtain an authentication ticket carried by the permission bit identifier acquisition request; parse the authentication ticket to obtain an object identifier of the target object; determine the corresponding permission bit identifier based on the object identifier, and send the permission bit identifier to the business system; the sent permission bit identifier is used to trigger the business system to cache.

[0020] In one of the embodiments, the authentication device is further used to determine the role category to which the target object belongs based on the object identifier; and to search for a pre-configured permission bit associated with the role category to obtain a corresponding permission bit identifier.

[0021] In one of the embodiments, the authentication device is also used to obtain the security level of the business system based on the system identifier of the business system when the target object accesses the business system for the first time within a preset time period; when the security level of the business system is greater than or equal to a preset level threshold, determine whether the target object has passed the internal authentication of the enterprise to which the business system belongs; when the target object passes the internal authentication, determine whether the target object has logged in to the permission engine system, and when it is determined that the target object has logged in to the permission engine system, trigger the front end of the business system to display an access control for accessing the target page in the business system.

[0022] In one of the embodiments, the feedback module is also used to trigger the business system to determine the target object's authority to the target access page; when the page link of the target page does not belong to the accessible page link, the business system determines that the target object does not have the authority to access the target access page; when the target object does not have the authority to access the target access page, the business system triggers the front end of the permission engine system to display a role application page, so that the target object applies for the role category required to access the target page through the role application page.

[0023] In a third aspect, the present application further provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of any authentication method provided in the embodiments of the present application are implemented.

[0024] In a fourth aspect, the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of any authentication method provided in the embodiments of the present application are implemented.

[0025] In a fifth aspect, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the steps of any authentication method provided in the embodiments of the present application.

[0026] The above-mentioned authentication method, device, computer equipment, storage medium and computer program product can obtain the permission bit identification and authentication ticket of the target object when the target object accesses the target page in the business system, and can verify the authentication ticket, and obtain the accessible page link corresponding to the permission bit identification after the verification is passed. By obtaining the accessible page link only after the verification is passed, the security of the authentication system can be improved and the probability of malicious acquisition of the accessible page link can be reduced. By obtaining the accessible page link, the accessible page link can be fed back to the business system, so that the business system can determine the target object's access rights to the target page based on the matching relationship between the page link of the target page and the accessible page link. Since the permission engine system is an open and accessible independent system, the permission engine system can access multiple business systems, thereby realizing permission management of multiple business systems through one permission engine system, reducing the resources consumed by repeatedly developing permission management modules, and thus improving the authentication efficiency. In addition, since this application can be refined to manage access rights to the target page, compared to the traditional rough permission management that determines whether the target object has access rights to access the business system through account and password, this application can also manage access rights in a more detailed manner, thereby achieving more fine-grained permission management.

[0027] In a first aspect, the present application provides a service system access method, the method comprising:

[0028] In response to an access operation of accessing the business system to the permission engine system, displaying a permission bit creation page, and in response to a permission bit creation operation triggered by the permission bit creation page, displaying a created permission bit;

[0029] In response to a role editing operation on the permission bit, displaying a role category associated with the permission bit edited by the role editing operation;

[0030] In response to a link editing operation on the permission bit, displaying an accessible page link associated with the permission bit edited by the link editing operation;

[0031] In response to the completion of the link editing operation, the first association relationship between the permission bit and the accessible page link is triggered to take effect in the permission engine system; the first association relationship is used for authentication when the target object of the role category accesses a page in the business system.

[0032] In a second aspect, the present application further provides a service system access device, the device comprising:

[0033] A permission bit creation module, for displaying a permission bit creation page in response to an access operation of connecting a business system to a permission engine system, and for displaying a created permission bit in response to a permission bit creation operation triggered by the permission bit creation page;

[0034] A role category association module, configured to respond to a role editing operation on the permission bit and display a role category associated with the permission bit edited by the role editing operation;

[0035] A link association module is used to, in response to a link editing operation on the permission bit, display an accessible page link associated with the permission bit edited through the link editing operation; in response to completion of the link editing operation, trigger a first association relationship between the permission bit and the accessible page link to take effect in the permission engine system; the first association relationship is used for authentication when a target object of the role category accesses a page in the business system.

[0036] In one of the embodiments, the role category association module is also used to display a role editing control corresponding to the created permission bit; in response to a trigger operation on the role editing control, display a role category set; in response to a selection operation on the role category set, display a target role category selected by the selection operation, and establish a second association relationship between the target role category and the created permission bit.

[0037] In one of the embodiments, the business system access is also used to display a role management page; the role management page displays a role category new control; in response to a trigger operation on the role category new control, a role category new page is displayed; in response to an input operation on the role category new page, the input role information is displayed, and a role category new work order is generated based on the input role information; when the role category new work order is approved, it is determined that the role category has been successfully added.

[0038] In one of the embodiments, the link association module is also used to display a link editing control corresponding to the created permission bit; in response to a trigger operation on the link editing control, display a set of functional modules included in the business system; in response to a selection operation on the set of functional modules, use a page link included in the target functional module selected by the selection operation as an accessible page link associated with the permission bit.

[0039] In a third aspect, the present application further provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of any authentication method provided in the embodiments of the present application are implemented.

[0040] In a fourth aspect, the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of any authentication method provided in the embodiments of the present application are implemented.

[0041] In a fifth aspect, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the steps of any authentication method provided in the embodiments of the present application.

[0042] The above-mentioned business system access method, device, computer equipment, storage medium and computer program product can create permission bits and display the created permission bits by responding to permission bit creation operations. By creating permission bits, it is possible to respond to role editing operations on permission bits, determine and display the role category associated with the permission bits edited through the role editing operation, and respond to link editing operations on permission bits, display the accessible page link associated with the permission bits edited through the link editing operation. In this way, when the link editing operation is completed, the first association relationship between the permission bit and the accessible page link can be triggered to take effect in the permission engine system; wherein the effective first association relationship is used for target objects with role categories to authenticate when accessing pages in the business system. Since it is only necessary to connect each business system to the permission engine system, it is possible to implement permission management of multiple business systems through one permission engine system, thereby reducing the resources consumed by repeatedly developing permission management modules and improving authentication efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 is an application environment diagram of an authentication method in an embodiment;

[0044] Figure 2 A schematic diagram of a flow chart of an authentication method in an embodiment;

[0045] Figure 3 A schematic diagram of the association relationship between permission bits, accessible page links and role categories in one embodiment;

[0046] Figure 4 A schematic diagram of a target page access process in one embodiment;

[0047] Figure 5 A functional schematic diagram of a permission engine system in one embodiment;

[0048] Figure 6 A schematic diagram of the transmission of an authentication ticket in one embodiment;

[0049] Figure 7 A schematic diagram of an access configuration page in an embodiment;

[0050] Figure 8 A schematic diagram of generating an authentication ticket in one embodiment;

[0051] Fig. 9 A schematic diagram of a role category management page in one embodiment;

[0052] Fig.10 A schematic diagram of an authentication process in an embodiment;

[0053] Fig.11An interactive schematic diagram of obtaining role authority information in one embodiment;

[0054] Fig.12 A schematic diagram of the access interaction of a target page in one embodiment;

[0055] Fig.13 A schematic diagram of a process flow of a service system access method in an embodiment;

[0056] Fig.14 A schematic diagram of a permission bit management page in an embodiment;

[0057] Fig.15 A schematic diagram of business system access in one embodiment;

[0058] Fig.16 A schematic diagram of a flow chart of an authentication method in a specific embodiment;

[0059] Fig.17 A schematic diagram of a process flow of a service system access method in a specific embodiment;

[0060] Fig.18 is a structural block diagram of an authentication device in an embodiment;

[0061] Fig.19 A structural block diagram of a service system access device in an embodiment;

[0062] Fig. 20 is an internal structure diagram of a computer device in one embodiment;

[0063] Fig.21 FIG. 4 is a diagram showing the internal structure of a computer device in another embodiment. DETAILED DESCRIPTION

[0064] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0065] The authentication method provided in the embodiment of the present application can be applied to Figure 1In the application environment shown. Among them, the terminal 102 communicates with the first server 104 through the network, and the terminal 102 communicates with the second server 106 through the network. The data storage system can store the data that the first server 104 and the second server 106 need to process. The data storage system can be integrated on the first server 104 or the second server 106, or it can be placed on the cloud or other servers. Among them, the first server 104 is deployed with the background of the business system, and the second server is deployed with the background of the permission engine system. The target object can access the business system through the terminal 102. When the target object accesses the business system for the first time within a preset time period, the terminal 102 can display the login page of the permission engine system, so that the second server 106 can generate an authentication ticket when it is determined that the target object has successfully logged into the permission engine system, and send the authentication ticket to the first server 104 for caching. When the target object accesses the target page in the business system through the terminal 102, the terminal 102 can trigger the first server 104 to generate an authentication request carrying an authentication ticket, and send the authentication request to the second server 106, so that the second server 106 searches for the corresponding accessible page link according to the authentication ticket in the authentication request, and returns the found accessible page link to the first server 102, so that the first server 102 can determine the target object's access rights to the target page based on the page link of the target page and the accessible page link.

[0066] Among them, the terminal 102 can be, but is not limited to, various desktop computers, laptops, smart phones, tablet computers, intelligent voice interaction devices, smart home appliances, aircraft, vehicle terminals, Internet of Things devices and portable wearable devices. Smart home appliances can be smart speakers, smart TVs, smart air conditioners, smart vehicle devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. The first server 104 and the second server 106 can be implemented with independent servers or server clusters composed of multiple servers. The embodiments of the present invention can be applied to various scenarios, including but not limited to cloud technology, artificial intelligence, smart transportation, assisted driving, etc.

[0067] The solution provided in the embodiment of the present application involves technologies such as automatic authentication of artificial intelligence. For example, the permission engine of the present application can intelligently authenticate the target object to determine whether the target object has access rights to the target page. Artificial Intelligence (AI) is a theory, method, technology and application system that uses a digital computer or a machine controlled by a digital computer to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results. In other words, artificial intelligence is a comprehensive technology of computer science, which attempts to understand the essence of intelligence and produce a new intelligent machine that can react in a similar way to human intelligence. With the research and progress of artificial intelligence technology, artificial intelligence technology has been studied and applied in many fields, such as common automatic authentication, smart home, smart wearable devices, virtual assistants, smart speakers, smart marketing, unmanned driving, automatic driving, drones, robots, smart medical care, smart customer service, etc. It is believed that with the development of technology, artificial intelligence technology will be applied in more fields and play an increasingly important role.

[0068] In order to better understand the authentication method in the embodiment of the present application, the overall concept of the present application is introduced below:

[0069] In the traditional technical solution, a separate permission management module is mainly developed for each business system, and the permission management module is used to determine whether the user has the permission to access the business system. However, the repetitive development workload in this mode is relatively large. Therefore, the present application innovatively develops a permission engine system, through which the permissions of multiple business systems can be managed. The permission engine system refers to a system used to manage the permissions of each business system. The permission engine system is an open and accessible independent system, and different business systems can be connected to the permission engine system. Therefore, after the business system is successfully connected to the permission engine system, the permissions of the connected business system can be managed through the permission engine system.

[0070] In the process of connecting the business system to the permission engine system, the R&D personnel can create multiple permission bits associated with the business system to be connected. The permission bit is information pointing to a set of functional modules in the business system. The permission bit may include a permission bit identifier, a permission bit name, a permission bit sensitivity level, and a permission bit storage directory. The permission bit identifier refers to information that uniquely identifies a permission bit. For example, the permission bit identifier may be the number of the permission bit. The permission bit name refers to the name of the permission bit. For example, when the name of the permission bit is "Grouping-Create, Query, Operation", it can be considered that the permission bit points to the group creation function module, the group query function module, and the group operation function module in the business system. When the name of the permission bit is "Kanban-Search, Statistics", it can be considered that the permission bit points to the Kanban content search function module and the Kanban content statistics function module in the business system. Since the permission bit is information pointing to a set of functional modules in the business system, the permission bit can be associated with at least one accessible page link. For instance, in the above example, when the permission bit points to the kanban content search function module and the kanban content statistics function module in the business system, the R&D personnel can use the link of the page that can be provided by the kanban content search function module as the accessible page link, and use the link of the page that can be provided by the kanban content statistics function module as the accessible page link, and associate the determined accessible page link with the permission bit named "Kanban-Search, Statistics".

[0071] In the process of connecting the business system to the permission engine system, R&D personnel can also associate role categories with permission bits. Role category refers to the type of role. For example, the role category can be a general role category, an administrator role category, etc. Different target objects can apply to have different role categories. A permission bit can be associated with one or more role categories. Different permission bits can be associated with the same role category or different role categories. After associating the permission bit with the role category, it can be considered that the permission bit identifier of the permission bit matches the role category. For example, when the permission bit named "Kanban-Search, Statistics" is associated with the general role category, it can be considered that the permission bit identifier of the permission bit named "Kanban-Search, Statistics" matches the general role category.

[0072] When the accessible page link is associated with the permission bit, and the role category is associated with the permission bit, it can be considered that the business system has been successfully connected to the permission engine system. At this time, the permission engine system records the association between the permission bit, the accessible page link and the role category. For example, refer to Figure 3, the permission engine system can be connected to business systems A to D. Each business system corresponds to multiple role categories. Each role category is associated with a corresponding permission bit, and the permission bit is associated with a corresponding accessible page link. When the business system is successfully connected to the permission engine system, when the target object accesses the target page in the business system, the permission engine system can determine whether the target object has the permission to access the target page through the association between the recorded permission bit, the accessible page link, and the role category. Thereby achieving the purpose of managing the permissions of each business system through a unified permission engine system, thereby greatly improving the efficiency of authentication. Figure 3 A schematic diagram showing the association relationship among permission bits, accessible page links, and role categories in one embodiment.

[0073] In one embodiment, Figure 2 As shown, an authentication method is provided, which is applied to Figure 1 Taking the second server in the example as an example, wherein the second server runs an authority engine system, the authentication method includes the following steps:

[0074] Step 202, when the target object accesses the target page in the business system of the access permission engine system, the permission bit identifier of the target object and the authentication ticket obtained by logging into the permission engine system are obtained; the permission bit identifier matches the role category of the target object.

[0075] Among them, the business system can be a system that can execute various business logics, and this business logic can be initiating a meeting, initiating a session, session management, logical operation, information query, etc. The embodiment of the present invention does not limit the type of business logic. The authentication ticket refers to the ticket generated by the permission engine system to represent the identity of the target object when the target object logs into the permission engine system. For example, the authentication ticket can specifically be a token.

[0076] Specifically, the target object can access the target page in the business system of the access permission engine system through the terminal. For example, when the terminal displays the homepage of the business system, the target object can click the page jump control in the homepage to access the target page in the business system through the page jump control. The role permission information and authentication ticket of the target object are cached in the business system, wherein the role permission information includes the role category and permission bit identifier of the target object, and the cached permission bit identifier matches the role category of the target object. Therefore, when it is determined that the target object accesses the target page in the business system, the business system can generate an authentication request based on the permission bit identifier and authentication ticket of the target object, and send the authentication request to the permission engine system. When the permission engine system receives the authentication request, the permission engine system can parse the authentication request to obtain the permission bit identifier and authentication ticket of the target object.

[0077] In one embodiment, when the target object first accesses the business system within a preset time period, the target object needs to log in to the permission engine system first, so that when the target object logs in to the permission engine system, the permission engine system can generate an authentication ticket according to the login account of the target object when logging in to the permission engine system, and determine the role category to which the login account belongs, and determine the permission bit identifier that matches the role category. Further, the permission engine system can feedback the authentication ticket and permission bit identifier to the business system. When the business system receives the feedback authentication ticket and permission bit identifier, the business system can cache the authentication ticket and permission bit identifier and set the effective time. At the same time, the business system can trigger the terminal to display the specified page, for example, the terminal can be triggered to display the home page of the business system, so that the target object can access the target page of the business system through the home page. Among them, the effective time set by the business system can be consistent with the preset time period, so that when the authentication ticket expires, it can be considered that the target object is accessing the business system for the first time within the preset time period. At this time, the target object needs to log in to the permission engine system again.

[0078] In one of the embodiments, when the target object logs into the permission engine system, the permission engine system can obtain the object identity information of the target object according to the login account of the target object, and encrypt the object identity information to obtain the authentication ticket.

[0079] Step 204: verify the authentication ticket, and when the authentication ticket is verified, determine the pre-configured accessible page link associated with the permission bit identifier.

[0080] Specifically, when the permission engine system receives the authentication ticket of the target object, the permission engine can decode the authentication ticket to obtain the decoded authentication ticket. Since the authentication ticket is a token that represents the identity of the target object, when the decoding is successful, or when the identity information pointed to by the decoded authentication ticket is correct, the permission engine system can consider that the authentication ticket has been verified, so that the permission engine system can now look for the pre-configured accessible page link associated with the received permission bit identifier. The link refers to the address of a web page, file, picture, email, or even an application.

[0081] In one of the embodiments, the business system can generate an authentication request based on the role permission information and the authentication ticket of the target object, and send the authentication request to the permission engine system. When the permission engine system receives the authentication request, the permission engine system extracts the role category in the role permission information and verifies the role category. When it is determined that the target object belongs to the role category in the role permission information, the permission engine system verifies the authentication ticket again, and after the authentication ticket verification is passed, determines the accessible page link associated with the permission bit identifier in the role permission information.

[0082] In one embodiment, a pair of public and private keys for encrypting and decrypting the object identity information of the target object is stored in the permission engine system. The permission engine system can encrypt the object identity information of the target object with the private key to obtain the authentication ticket. When receiving the authentication ticket, the authentication ticket is decoded with the public key to obtain the object identity information of the target object.

[0083] In one of the embodiments, when the authentication ticket verification is passed, the permission engine system can determine the target permission bit with the received permission bit identifier, and determine the accessible page link associated with the target permission bit that is preconfigured when accessing the business system, and use the determined accessible page link as the accessible page link associated with the received permission bit identifier.

[0084] Step 206, feeding back the accessible page link to the business system; the fed-back accessible page link is used to instruct the business system to determine the target object's access rights to the target page based on the matching relationship between the page link of the target page and the accessible page link.

[0085] Specifically, when the permission engine system obtains an accessible page link associated with the permission bit identifier, the permission engine system can send the accessible page link to the business system, so that the business system can determine the page link of the target page, and determine whether the target object has access rights to access the target page based on the page link of the target page and the received accessible page link.

[0086] In one embodiment, the business system matches the page link of the target page with the received accessible page link. When the page link of the target page belongs to the accessible page link, it is determined that the target object has the access right to access the target page, and the business system triggers the terminal to display the target page. When the page link of the target page does not belong to the accessible page link, it is determined that the target object does not have the access right to access the target page, and the target object can be reminded to apply for the corresponding permission.

[0087] In one of the embodiments, when the permission engine system determines the accessible page link associated with the received permission bit identifier, the permission engine system can also obtain the page link of the target page in the business system, and determine the authentication result based on the matching relationship between the page link of the target page and the accessible page link. For example, when the page link of the target page belongs to the accessible page link, the authentication result is determined to be that the target object has the access right to access the target page. Further, the permission engine system returns the authentication result to the business system, and the business system can determine whether to trigger the terminal to display the target page based on the received authentication result. For example, when the authentication result is that the target object has the access right to access the target page, the business system sends the page data of the target page to the terminal.

[0088] In one embodiment, reference Figure 4 , when the business system is connected to the permission engine system, the permission engine system can create a system identifier corresponding to the connected business system, create a role category, and determine the permission bits associated with each role category, and determine the accessible page links associated with each permission bit. When the target object accesses the target page of the business system, the business system can determine whether the authentication ticket of the target object is in a valid state. If it is not in a valid state, the business system triggers the terminal to display the login page of the permission engine system, so that when the login is successful, the permission engine system generates an authentication ticket and returns the authentication ticket to the business system. When the authentication ticket is in a valid state, the business system can determine the role category of the target object, and pull the role interface whitelist from the authentication engine system through the role category of the target object. Among them, the role interface whitelist records the accessible page links associated with the permission bit identifier that matches the role category. When the business system obtains the role interface whitelist, the business system can determine the access rights of the target object to access the target page based on the role interface whitelist and the page link of the target page. Figure 4 A schematic diagram of a target page access process in an embodiment is shown.

[0089] In one embodiment, reference Figure 5 , Figure 5 The functional schematic diagram of the permission engine system in one embodiment is shown. In the permission engine system of this embodiment, the permission engine system may include an identity authentication module, a user authentication module, an approval management module, a statistical management module, a work order management module and a permission governance module. For example, the identity of the target object can be authenticated by decoding the authentication ticket, the permission of the target object to access the target page can be verified, the work order of the target object's application role category can be approved, the number of connected business systems can be counted, and the permission can be self-evaluated.

[0090] In the above authentication method, by obtaining the permission bit identification and authentication ticket of the target object when the target object accesses the target page in the business system, the authentication ticket can be verified, and the accessible page link corresponding to the permission bit identification can be obtained after the verification is passed. By obtaining the accessible page link only after the verification is passed, the security of the authentication system can be improved and the probability of maliciously obtaining the accessible page link can be reduced. By obtaining the accessible page link, the accessible page link can be fed back to the business system, so that the business system can determine the target object's access rights to the target page according to the matching relationship between the page link of the target page and the accessible page link. Since the permission engine system is an open and accessible independent system, the permission engine system can access multiple business systems, thereby realizing the permission management of multiple business systems through one permission engine system, reducing the resources consumed by repeatedly developing the permission management module, and thus improving the authentication efficiency. In addition, since the present application can be refined to manage the access rights for the target page, compared with the traditional rough permission management that determines whether the target object has the access rights to access the business system by account password, the present application can also manage the access rights in a more refined manner, realizing more fine-grained permission management.

[0091] In one of the embodiments, before the target object accesses the target page in the business system of the access permission engine system, the above method also includes a step of generating an authentication ticket, and the step of generating the authentication ticket includes: when the target object logs in to the permission engine system, an authentication ticket is generated according to the login account of the target object when logging in to the permission engine system, and the authentication ticket is fed back to the business system; wherein the fed-back authentication ticket is used to instruct the business system to cache the authentication ticket and set the validity time, and when it is determined that the target object accesses the target page and the authentication ticket is within the validity time, the authentication ticket is sent to the permission engine system.

[0092] Specifically, before the target object accesses the target page in the business system, the target object needs to log in to the permission engine system. For example, the business system may include a business system front end and a business system back end. The front end is the front-end part of the website, which runs on browsers such as computers and mobile terminals to display the web pages browsed by the target object. The back end is an application deployed in the server, which provides various business support for the front end. When the target object enters the business system, the terminal can first display the login page of the permission engine. The target object can log in to the permission engine system through the displayed login page, and then the permission engine system can obtain the login account entered by the target object through the login page, and generate an authentication ticket based on the login account, and return the authentication ticket to the business system back end. The business system back end can create a session object, store the received authentication ticket in the session object, and set the validity period of the authentication ticket. Among them, the session object can specifically be a session. When the business system background stores the authentication ticket in the session object, the business system background can determine the session object identifier of the session object and send the session object identifier to the terminal, that is, send the session object identifier to the business system front end, so that when the target object accesses the target page of the business system, the business system front end can send the session object identifier to the business system background, and then the business system background can find the corresponding session object according to the received session object identifier, and extract the authentication ticket from the found session object. When the extracted authentication ticket is in a valid state, the extracted authentication ticket is sent to the permission engine system.

[0093] In one embodiment, when the business system background caches the authentication ticket, the business system background will set the validity period of the authentication ticket. Therefore, the business system background can determine whether the authentication ticket is in a valid state according to the cache time of the authentication ticket, the current time and the set validity period. For example, when the authentication ticket is cached at 12 o'clock, the validity period is 2 hours, and the current time is 15 o'clock, since the current time is outside the range of 12 o'clock to 14 o'clock, the authentication ticket is in an invalid state.

[0094] In one embodiment, when the target object successfully logs in to the permission engine system, the permission engine system can cache the target object's login account and login password, and set the validity time. For example, the permission engine system may include a permission engine system front end and a permission engine system back end. The terminal may run a permission engine system front end. When the target object logs in to the permission engine system through the login page displayed by the permission engine system front end, the permission engine system front end may cache the target object's login account and login password in the cookie, so that when the login account is within the valid time, the permission engine system can be automatically logged in through the login account and login password cached in the cookie, thereby avoiding repeated login to the permission engine system. For example, the first business system and the second business system can both be connected to the permission engine system. When the target object visits the first business system for the first time within a preset time period, the target object must first log in to the permission engine system. At this time, the permission engine system front end can cache the target object's login account and login password, and set the validity time. When the target object visits the second business system for the first time within the preset time period when the login account is within the valid time, the permission engine system front end can automatically log in according to the cached login account and login password, thereby avoiding the target object from repeatedly logging in to the permission engine system. For example, reference Figure 6 , business systems A to D can all be connected to the permission engine system. When the target object accesses business system A for the first time within the preset time period, the target object must first log in to the permission engine system, and the permission engine system generates an authentication ticket and sends the authentication ticket to business system A. When the login account is within the valid time and the target object accesses business system B for the first time within the preset time period, the target object does not need to log in to the permission engine system again, and the permission engine system will send the generated authentication ticket to the business system B accessed by the target object. In this way, the authentication ticket is shared and transmitted between different business systems through the permission engine system. Figure 6 A schematic diagram of the transmission of an authentication ticket in an embodiment is shown.

[0095] In the above embodiment, by generating an authentication ticket to characterize the identity of the target object, the identity of the target object can be determined by the authentication ticket when the target object accesses the target page, thereby improving the security of page access. By setting the validity period of the authentication ticket, the authentication ticket can be sent to the permission engine system when the authentication ticket is within the validity period, further improving the security of page access. By sending the authentication ticket to the business system for storage, cross-subject isolated storage can be achieved, thereby improving the security and compliance of the authentication engine system through cross-subject isolated storage.

[0096] In one of the embodiments, the target object logs in to the permission engine system through the login page of the permission engine system; the login page is a page displayed when the target object accesses the business system for the first time within a preset time period; when the target object accesses the business system and the session object of the business system does not include an authentication ticket or the authentication ticket is invalid, it is determined that the target object is accessing the business system for the first time within the preset time period.

[0097] Specifically, the target object can log in to the permission engine system through the login page of the permission engine system. The login page is the page displayed when the target object accesses the business system for the first time within a preset time period. For example, when the preset time period is set to 2 hours, it can be determined whether the target object accesses the business system for the first time within the first 2 hours ending with the current time. If it is the first time to access, it is necessary to log in to the permission engine system. Exemplarily, the business system may include a business system front end and a business system back end. When the target object enters the business system through the browser in the terminal, the business system front end can send a home page display request to the business system back end. The business system back end checks whether the home page display request carries a session object identifier. If the home page display request carries a session object identifier, the business system back end determines the session object corresponding to the session object identifier and extracts the authentication ticket from the session object. Since the authentication ticket is set with an effective time, the business system back end can determine whether the authentication ticket is in a valid state according to the set effective time. When the authentication ticket is in an invalid state, it is determined that the target object is accessing the business system for the first time within the preset time period. When the authentication ticket is valid, it is determined that the target object is not accessing the business system for the first time within the preset time period. When the first page display request does not carry a session object identifier, it can also be determined that the target object is accessing the business system for the first time within the preset time period. It is easy to understand that the target object needs to open and start the business system front end before accessing the target page in the business system, so the step of logging into the permission engine system occurs before the target object accesses the target page.

[0098] In this embodiment, when the session object does not include an authentication ticket, it can be considered that the target object has not logged into the permission engine system. At this time, in order to generate an authentication ticket, the target object needs to log into the permission engine system. When the authentication ticket in the session object expires, it can be considered that the target object has logged into the permission engine system before a preset time period ending with the current time. At this time, in order to improve the security of authentication, the target object needs to log into the permission engine system again.

[0099] In one of the embodiments, when the target object logs in to the permission engine system, before generating an authentication ticket based on the login account of the target object when logging in to the permission engine system, the method further includes obtaining the login account and login password entered through the login page of the permission engine system; when the login account and the login password match, obtaining a preconfigured redirection page link; sending the redirection page link to the front end of the business system; the sent redirection page link is used to trigger the front end of the business system to display a corresponding redirection page, and the redirection page displays an access control for accessing the target page.

[0100] Specifically, when the business system is connected to the permission engine system, a redirection page link can be configured. When the business system is successfully connected to the permission engine system, and the target object successfully logs in to the permission engine system, the permission engine system can obtain the pre-configured redirection page link, and send the redirection page link to the business system front end, and then the business system front end can display the redirection page corresponding to the redirection page link. That is, the terminal corresponding to the target object can be changed from displaying the login page to displaying the redirection page. Among them, the redirection page can display access controls for accessing the target page. For example, the redirection page can be the home page of the business system, so that the target object can access the corresponding target page through the home page.

[0101] In one embodiment, reference Figure 7 When the business system is connected to the authority engine system, the terminal can display the access configuration page of the authority engine system. The access configuration page can display a redirection page link input box 701, and the system access personnel can enter the redirection page link in the redirection page link input box. Multiple redirection page links can be entered in the redirection page link input box, and the system access personnel can specify the redirection page link that matches each scenario. For example, when the login account matches the login password, the authority engine system can obtain a redirection page link set, and filter out the target redirection page link that matches the login success scenario from the redirection page link set, and then the authority engine system sends the redirection page link to the business system front end. Figure 7 A schematic diagram of an access configuration page in an embodiment is shown.

[0102] In the above embodiment, by pre-setting a redirection page link, when it is determined that the target object has logged in successfully, the terminal can be triggered to change from displaying the login page of the permission engine system to displaying the redirection page of the business system, so that the target object can access the target page of the business system based on the displayed redirection page.

[0103] In one of the embodiments, an authentication ticket is generated based on the login account of the target object when logging into the permission engine system, including: obtaining the login account entered through the login page of the authentication system; generating an authorization code based on the login account, and feeding back the authorization code; the fed-back authorization code is used to trigger the business system to generate an authentication ticket generation request carrying the authorization code; receiving the authentication ticket generation request sent by the business system, and generating an authentication ticket based on the authorization code in the authentication ticket generation request.

[0104] Specifically, when the target object logs in to the permission engine system through the login page, the permission engine system can obtain the login account entered through the login page, and encode the login account to obtain an authorization code. Among them, the encoding method used to encode the login account can be freely set according to needs. Further, the permission engine system can send the authorization code to the business system, and then the business system can generate an authentication ticket generation request based on the authorization code when receiving the authorization code. Further, the business system can send the authentication ticket generation request to the permission engine system, and the permission engine system extracts the authorization code in the authentication ticket generation request, and generates an authentication ticket based on the authorization code.

[0105] In one embodiment, when the permission engine system generates an authorization code, the permission engine system can send the generated authorization code and the redirection page link found to the business system backend, so that the business system backend can send the authorization code and the redirection page link to the business system frontend, and then the business system frontend can display the redirection page corresponding to the redirection page link, and after displaying the redirection page, generate an authentication ticket generation request carrying the authorization code. The business system frontend can send the generated authentication ticket generation request to the permission engine system through the business system backend, and then the permission engine system parses the received authentication ticket generation request, obtains the authorization code, and generates an authentication ticket based on the authorization code.

[0106] In the above embodiment, since the authorization code is generated according to the login account when the target object logs in to the permission engine system, when the business system receives the authorization code, it can be considered that the target object has successfully logged in to the permission engine system. Therefore, when it is determined that the target object has logged in to the permission engine system, an authentication ticket generation request is generated, which can reduce the probability of the target object sending an authentication ticket generation request to the permission engine system without logging in to the permission engine system, thereby improving the security of the generation of authentication tickets.

[0107] In one of the embodiments, an authentication ticket is generated based on the authorization code in the authentication ticket generation request, including: parsing the authorization code to obtain a login account of the target object; determining pre-configured object identity information corresponding to the login account; encrypting the object identity information to obtain identity encryption information; and signing the identity encryption information and the object identifier of the target object with a preset private key to obtain an authentication ticket.

[0108] Specifically, when the permission engine system receives a request to generate an authentication ticket, the permission engine system can parse the request to generate an authentication ticket to obtain an authorization code, and parse the authorization code to obtain the login account of the target object. Since the target object can apply for a login account and input the object identity information associated with the login account when registering the permission engine system, when the authorization code is parsed to obtain the login account of the target object, the permission engine system can search for the object identity information that matches the login account. Furthermore, the permission engine system can encrypt the object identity information obtained by the search through a preset encryption algorithm to obtain identity encryption information, and sign the identity encryption information and the object identifier of the target object through a preset private key to obtain an authentication ticket.

[0109] In one embodiment, the object identity information may include a node identifier of a node to which the target object belongs in the organizational structure, for example, the identifier of the department to which the target object belongs. The object identity information may also include information such as employee identifier, name, mobile phone number, zip code, etc. The object identifier of the target object refers to information that uniquely identifies a target object, for example, the ID of the target object, etc.

[0110] In one embodiment, reference Figure 8 , the authentication ticket issued by the permission engine system is not forgeable and uses double encryption. For example, the object identity information of the target object will be encrypted by an encryption algorithm first, and then the encrypted object identity information will be signed by a private key. The private key signature can ensure that the permission engine system is the only ticket issuing point. The authentication ticket itself has a life cycle, and the private key is changed regularly, thereby improving the reliability of the authentication ticket based on the regularly changed private key and the authentication ticket with a life cycle. The permission engine system only issues the authentication ticket after determining that the target object has successfully logged in, which further improves the reliability of the authentication ticket. The authentication ticket issued is used to represent the identity of the target object. When the target object login fails, the authentication ticket issued is also in an invalid state. The permission engine system not only issues the authentication ticket, but also verifies the received authentication ticket. When the permission engine system issues the authentication ticket, the authentication ticket is stored in the session object of the business system.

[0111] The private key is stored in the permission engine system, and the process of signing with the private key is a purely algorithmic process. The signed authentication ticket is in a decentralized storage state. Even if a vulnerability occurs in the logical server, the probability of being dragged down can be reduced. Figure 8 A schematic diagram of generating an authentication ticket in an embodiment is shown.

[0112] In the above embodiment, the security of the generated authentication ticket can be improved by performing double encryption.

[0113] In one of the embodiments, object identity information is encrypted to obtain identity encryption information, including: obtaining an encryption function and a key; dividing the object identity information to obtain multiple identity information fragments; encrypting each identity information fragment using the encryption function and the key to obtain an encrypted fragment corresponding to each identity information fragment; and combining the encrypted fragments corresponding to each identity information fragment to obtain identity encryption information.

[0114] Specifically, when it is necessary to encrypt the object identity information of the target object, the permission engine system can obtain a preset encryption function and key. The permission engine system can divide the object identity information of the target object. For example, the permission engine system can encode the object identity information of the target object to obtain a coding sequence, and divide the coding sequence according to a preset division length to obtain multiple identity information fragments. Among them, multiple refers to more than two. Exemplarily, the division length can be set to 128 bytes, so that the permission engine system can use each 128 bytes of data in the coding sequence as an identity information fragment. Further, for each identity information fragment in more than a plurality of identity information fragments, the permission engine system can use the current identity information fragment and the obtained key as inputs of the encryption function, so as to output the encrypted fragment corresponding to the current identity information fragment through the encryption function, that is, encrypt the current identity information fragment through the encryption function and the key to obtain the corresponding encrypted fragment. Further, when the encrypted fragments corresponding to each identity information fragment are obtained, the permission engine system can splice the multiple encrypted fragments to obtain the identity encryption information of the target object.

[0115] In this embodiment, by dividing the object identity information of the target object to obtain multiple identity information fragments, and encrypting each identity information fragment separately, the complexity of encryption can be increased, thereby reducing the probability of the encrypted identity encryption information being easily cracked.

[0116] In one of the embodiments, after feeding back the authentication ticket to the business system, the above method also includes a process for obtaining a permission bit identifier, and the process for obtaining the permission bit identifier includes: obtaining a permission bit identifier acquisition request sent by the business system, and parsing the permission bit identifier acquisition request to obtain the authentication ticket carried by the permission bit identifier acquisition request; parsing the authentication ticket to obtain the object identifier of the target object; determining the corresponding permission bit identifier based on the object identifier, and sending the permission bit identifier to the business system; the sent permission bit identifier is used to trigger the business system to cache.

[0117] Specifically, when the target object logs in to the permission engine system, and the permission engine system generates an authentication ticket, and feeds back the authentication ticket to the business system, the business system can pull the permission bit identifier corresponding to the target object from the permission engine system. More specifically, the business system generates a permission bit identifier acquisition request carrying an authentication ticket, and sends the generated permission bit identifier acquisition request to the permission engine system. When the permission engine system receives the permission bit identifier acquisition request, it can parse the permission bit identifier acquisition request, obtain the authentication ticket, and verify the authentication ticket. For example, the permission engine system can first decode the authentication ticket through the public key to obtain the encrypted identity encryption information, and decode the identity encryption information through the key to obtain the object identity information of the target object and the object identifier of the target object. When the decryption is successful, it can be determined that the request to obtain the permission bit identifier is a legitimate request. At this time, it is determined that the authentication ticket verification is successful. When the authentication ticket verification is successful, the permission engine system can search for the corresponding permission bit identifier based on the object identifier of the target object, and return the found permission bit identifier to the business system, so that the business system can cache the received permission bit identifier in the session object, and then when the target object accesses the target page in the business system, the business system can send the cached permission bit identifier to the permission engine system.

[0118] In this embodiment, the business system can cache the permission bit identifier by obtaining the permission bit identifier, so that when the target object accesses the target page, the corresponding accessible page link can be pulled from the permission engine system based on the permission bit identifier, and then the target object's access rights to the target page can be determined based on the pulled accessible page link. In this way, permission management is implemented.

[0119] In one of the embodiments, determining the corresponding permission bit identifier according to the object identifier includes: determining the role category to which the target object belongs according to the object identifier; and searching for a preconfigured permission bit associated with the role category to obtain a corresponding permission bit identifier.

[0120] Specifically, since the role category and permission bit are associated in the process of accessing the business system, when the object identifier of the target object is obtained, the role category to which the target object belongs can be found according to the object identifier, and then the pre-configured permission bit associated with the role category can be found to obtain the permission bit identifier of the permission bit associated with the role category.

[0121] In one embodiment, reference Fig. 9In the process of accessing the business system, the system access personnel can enter the permission engine system and trigger the terminal to display the role category management page of the permission engine system. The role category management page displays a new role category control 901, so that the system access personnel can add a role category through the new role category control 901. Furthermore, in the process of adding a role category, the system access personnel can associate the target object with the newly added role category, so that the target object has the corresponding role category. Fig. 9 A schematic diagram of a role category management page in an embodiment is shown.

[0122] In the above embodiment, since the role category is associated with the permission bit during the process of accessing the business system, the corresponding permission bit identifier can be quickly queried through the role category of the target object.

[0123] In one of the embodiments, after feeding back an accessible page link to the business system, the method further includes: when the page link of the target page does not belong to an accessible page link, the business system determines that the target object does not have the authority to access the target access page; when the target object does not have the authority to access the target access page, the business system triggers the front end of the permission engine system to display a role application page, so that the target object applies for the role category required to access the target page through the role application page.

[0124] Specifically, when the business system obtains the accessible page link sent by the permission engine system, the business system can determine the matching relationship between the page link of the target page and the accessible page link. When the page link of the target page matches the accessible page link, it is determined that the target object has the permission to access the target page. Among them, when it is determined that the page link of the target page belongs to the accessible page link, it is determined that the page link of the target page matches the accessible page link. When the page link of the target page does not match the accessible page link, it is determined that the target object does not have the access authority to access the target page. When the business system determines that the target object does not have the access authority to access the target page, the business system obtains the role application page link in the permission engine system, and displays the role application page corresponding to the role application page link through the front end of the business system, and then the target object can apply for the role category required to access the target page through the displayed role application page.

[0125] When the target object applies for the role category required to access the target page through the role application page, the permission engine system can generate a role application work order. When it is determined that the role application work order is approved, the permission engine system associates the object identifier of the target object with the applied role category, so that the target object has the applied role category.

[0126] In this embodiment, by displaying the role application page, the target object can apply for the corresponding role category through the displayed role application page, thereby improving the flexibility of role category application.

[0127] In one of the embodiments, before the target object accesses the target page in the business system of the access permission engine system, the above method also includes: when the target object accesses the business system for the first time within a preset time period, obtaining the security level of the business system according to the system identifier of the business system; when the security level of the business system is greater than or equal to the preset level threshold, determining whether the target object has passed the internal authentication of the enterprise to which the business system belongs; when the target object passes the internal authentication, determining whether the target object has logged in to the permission engine system, and when it is determined that the target object has logged in to the permission engine system, triggering the front end of the business system to display an access control for accessing the target page in the business system.

[0128] Specifically, when the target object accesses the business system for the first time within a preset time period, the permission engine system can obtain the system identification of the business system and determine the security level of the business system based on the system identification. When the security level of the business system is greater than or equal to the level threshold, the business system can be considered to be a highly sensitive system. At this time, the permission engine system determines whether the target object has passed the internal authentication of the enterprise to which the business system belongs. For example, the permission engine system can determine whether the target object has successfully logged into the OA (Office Automation) system of the enterprise to which the business system belongs. If the target object passes the internal authentication, the permission engine system determines whether the target object has successfully logged in. For example, the permission engine system determines whether the authentication ticket of the target object has been distributed to the business system, and when it is determined that the target object has logged in to the permission engine system, it triggers the front end of the business system to display the access control for accessing the target page in the business system, for example, triggering the front end of the business system to display the home page of the business system.

[0129] In one embodiment, reference Fig.10 When the target object enters the system link of the business system in the browser to enter the business system, the browser can obtain the system identifier of the business system, redirect to the login page that displays the permission engine system, and send the system identifier to the permission engine system. The permission engine system can determine the security level of the business system based on the received system identifier, and when the determined security level is greater than or equal to the level threshold, perform internal login authentication and permission engine login authentication on the target object. When the authentication is passed, the permission engine system returns the authorization code to the business system. The business system authenticates the authorization code, triggers the browser to display the redirection page of the business system, and sends an authentication ticket generation request to the permission engine system, so that the permission engine system generates an authentication ticket and sends the authentication ticket to the business system. Fig.10A schematic diagram of the authentication process in an embodiment is shown.

[0130] In the above embodiment, by performing double authentication on a business system with a high security level, the access security of the business system can be improved.

[0131] In one embodiment, reference Fig.11 , Fig.11 An interactive schematic diagram of role authority information acquisition in an embodiment is shown. When the target object accesses the business system, the business system front end sends a system access request to the business system back end. When the business system back end receives the system access request, the business system back end determines whether the authentication ticket of the target object is stored in the session object, and when it is determined that there is an authentication ticket, it determines whether the authentication ticket is in a valid state. When the session object does not have an authentication ticket or the authentication ticket is in an invalid state, the business system back end triggers the permission engine front end to display a login page. When the target object logs in to the permission engine system through the login page, the permission engine system back end generates an authorization code according to the login account of the target object, and sends the authorization code to the permission engine front end. The permission engine front end passes the authorization code to the business system front end, and triggers the business system front end to display a redirection page. When the business system front end displays the redirection page, the business system front end generates an authentication ticket generation request according to the authorization code, sends the authentication ticket generation request to the business system back end, and the business system back end sends the authentication ticket generation request to the permission engine back end. The authorization engine background generates an authentication ticket and sends the generated authentication ticket to the business system background. When the business system background receives the authentication ticket, the business system background caches the authentication ticket in the session object and sets the validity period, and generates a role permission information acquisition request based on the authentication ticket, and sends the role permission information acquisition request to the authorization engine system background, so that the authorization engine system background can find the role category of the target object and the permission bit identifier associated with the role category after successfully verifying the authentication ticket, and return the found role category and permission bit identifier as role permission information to the business system background. The business system background receives the role permission information, caches the role permission information in the session object, and sets the validity period of the role permission information.

[0132] In one embodiment, reference Fig.12 , Fig.12The schematic diagram of the access interaction of the target page in one embodiment is shown. The permission engine system may include a permission engine system front end and a permission engine system back end. When the target object accesses the target page in the business system, the business system front end sends the target page access request to the business system back end. When the business system back end receives the target page access request, the business system back end extracts the authentication ticket of the target object from the session object and determines whether the authentication ticket is in a valid state. If there is no authentication ticket in the session object or the authentication ticket is in an invalid state, the business system back end triggers the authentication ticket back end to regenerate the authentication ticket. When there is an authentication ticket in the session object and the authentication ticket is in a valid state, the business system back end extracts the permission bit identifier from the session object, generates an authentication request based on the authentication ticket and the permission bit identifier, and sends the authentication request to the permission engine system back end. The permission engine system back end searches for an accessible page link associated with the permission bit identifier in the authentication request, and sends the accessible page link found to the business system back end. The business system back end determines whether the target object has access rights to access the target page based on the matching relationship between the page link of the target page and the accessible page link. When the target object has access rights, the business system backend returns the page data of the target page to the business system frontend; when the target object does not have access rights, the business system backend triggers the permission engine frontend to display the role category application page.

[0133] In one embodiment, Fig.13 As shown, a business system access method is provided, which is applied to Figure 1 Taking the terminal in as an example, the service system access method includes the following steps:

[0134] Step 1302, in response to the access operation of accessing the business system to the permission engine system, displaying the permission bit creation page, and in response to the permission bit creation operation triggered by the permission bit creation page, displaying the created permission bit.

[0135] Specifically, when the business system is connected to the permission engine system, the system access personnel can trigger the terminal to display the front page of the permission engine system, wherein the front page of the permission engine system may include a permission bit management page. Fig.14 , the permission bit management page may display a permission bit list 1401 and a permission bit creation control 1402. When it is determined that the system access personnel triggers the permission bit creation control, the terminal may display the permission bit creation page, and in response to the permission bit creation operation triggered by the permission bit creation page, create a permission bit, and display the created permission bit in the permission bit list of the permission bit management page. Fig.14 A schematic diagram of a permission bit management page in an embodiment is shown.

[0136] In one of the embodiments, the system access personnel can input the name, number, directory, identifier, extension field, and permission bit description of the permission bit to be created through the permission bit creation page. Among them, the directory refers to the directory where the permission bit information of the permission bit to be created should be stored. A save control is also displayed in the permission bit creation page. When it is determined that the system access personnel clicks the save control, the terminal will send the information entered through the permission bit page to the permission engine system background, so that the permission engine system background will create the permission bit based on the received information, and return the creation result to the terminal, that is, return to the permission engine system front end. When the terminal receives the creation result, and the creation result is successful, the terminal can display the created permission bit in the permission bit list of the permission bit management page.

[0137] Step 1304 , in response to the role editing operation on the permission bit, displaying the role category associated with the permission bit edited by the role editing operation.

[0138] Specifically, the permission management page can also display a role editing control, for example, Fig.14 , the permission bit list may display a role editing control 1403 corresponding to each created permission bit. When it is determined that the system access personnel clicks the role editing control, the terminal may respond to the click operation of the role editing control and display a role editing page, and then the system access personnel may specify the role category associated with the corresponding permission bit through the role editing page.

[0139] In one embodiment, before the business system is connected to the permission engine system, multiple default role categories can be pre-set in the permission engine system. When the system access personnel expect to add a new role category, the system access personnel can also trigger the terminal to display the role category management page, and add a new role category through the new role category control in the role category management page. For example, refer to Fig. 9 , Fig. 9 A role category management page in an embodiment is shown. The role category management page may display a role category list 902, and the role category list displays role categories created for the business system. The role category list may also display an editing control 903, through which the created role category may be edited, for example, the name and role description of the created role category may be edited.

[0140] In one embodiment, the role category management page may also display a batch freeze control 904 and a batch unfreeze control 905. When it is determined that the system access personnel clicks the batch freeze control, the permission engine system will freeze the role categories created by the business system. At this time, the target object cannot access the target page through the role category to which it belongs. When it is determined that the system access personnel clicks the batch unfreeze control, the permission engine system will unfreeze the role categories created by the business system.

[0141] Step 1306 , in response to the link editing operation on the permission bit, displaying the accessible page link associated with the permission bit edited by the link editing operation.

[0142] Specifically, the permission bit management page can also display a link editing control, for example, Fig.14 , the permission bit list may display a link editing control (associated URL control) 1404 corresponding to each created permission bit. When it is determined that the system access personnel clicks the link editing control, the terminal may display a link editing page in response to the click operation of the link editing control, and then the system access personnel may specify an accessible page link associated with the corresponding permission bit through the link editing page. It is easy to understand that a permission bit can be associated with multiple role categories, and an accessible page link can also be associated with multiple permission bits, so that the control of the permission bit is more detailed.

[0143] In one of the embodiments, the link editing page may display the accessible page links corresponding to each functional module in the business system, so that the system access personnel can determine the functional module corresponding to the permission bit according to the needs, and determine the associated accessible page link based on the determined functional module.

[0144] In one of the embodiments, an accessible page link input box may be displayed in the link editing page, and the system access personnel may input the accessible page link through the accessible page link input box, and then the permission engine system background associates the accessible page link input by the system access personnel with the corresponding permission bit.

[0145] Step 1308, in response to the completion of the link editing operation, the association relationship between the trigger permission bit and the accessible page link takes effect in the permission engine system; the association relationship is used for authentication when the target object of the role category accesses the page in the business system.

[0146] Specifically, when the role editing operation is completed, the terminal may send the created permission bit and the role category edited by the role editing operation to the permission engine system background, so that the permission engine system background can establish a second association relationship between the permission bit and the role category. When the link editing operation is completed, the terminal may send the created permission bit and the accessible page link edited by the link editing operation to the permission engine system background, so that the permission engine system background can establish a first association relationship between the permission bit and the accessible page link. Among them, the first association relationship between the permission bit and the accessible page link can be used for the target object with the role category to authenticate the access rights of the target object when the target object accesses the target page in the business system.

[0147] In one embodiment, reference Figure 7 When connecting the business system to the permission engine system, the system access personnel can also trigger the terminal to display the access configuration page of the permission engine system. Among them, the access configuration page can display the redirection page link input box 701, the system address input box 702, the system description input box 703, the security level input box 704, etc. The redirection page link can be entered through the redirection page link input box; the home page link of the business system can be entered through the system address input box; the description information of the system can be entered through the system description input box; the security level of the system can be entered through the security level input box.

[0148] In one embodiment, reference Fig.15 , Fig.15 A schematic diagram of business system access in an embodiment is shown. The permission engine system can access multiple different business systems. When multiple different business systems are connected to the permission engine system, the permission engine system can generate system identifiers corresponding to different business systems, create permission bits corresponding to each business system, and determine the role category associated with each permission bit, and determine the accessible page link associated with each permission bit. The permission engine can achieve cross-platform and cross-frame system access through web pages.

[0149] It is easy to understand that in addition to creating permission bits and associating role categories and accessible page links with the created permission bits in the process of connecting the business system to the permission engine system, new permission bits can also be added and the newly added permission bits can be edited in the process of subsequent target objects accessing the business system.

[0150] In the above-mentioned business system access method, by responding to the permission bit creation operation, the permission bit can be created and the created permission bit can be displayed. By creating the permission bit, in response to the role editing operation for the permission bit, the role category associated with the permission bit edited through the role editing operation can be determined and displayed, and in response to the link editing operation for the permission bit, the accessible page link associated with the permission bit edited through the link editing operation can be displayed. In this way, when the link editing operation is completed, the first association relationship between the permission bit and the accessible page link can be triggered to take effect in the permission engine system; wherein the effective first association relationship is used for the target object with the role category to authenticate when accessing the page in the business system. Since it is only necessary to connect each business system to the permission engine system, the permission management of multiple business systems can be realized through one permission engine system, thereby reducing the resources consumed by repeatedly developing the permission management module and improving the authentication efficiency.

[0151] In one of the embodiments, in response to a role editing operation on a permission bit, a role category associated with the permission bit edited by the role editing operation is displayed, including: displaying a role editing control corresponding to the created permission bit; in response to a triggering operation on the role editing control, displaying a role category set; in response to a selection operation on the role category set, displaying a target role category selected by the selection operation, and establishing a second association relationship between the target role category and the created permission bit.

[0152] Specifically, the terminal can display the role editing control corresponding to the created permission bit, and in response to the triggering operation of the role editing control by the system access personnel, display the role category set. Among them, the role category set includes a variety of different categories of role types. In response to the selection operation for the role category in the role category set, the terminal can determine and display the target role category selected by the selection operation. When the target role category is determined, the terminal can establish a second association relationship between the target role category and the created permission bit, and send the second association relationship between the target role category and the created permission bit to the permission engine system background for storage.

[0153] In one of the embodiments, before displaying the role category set, the method further includes: displaying a role management page; displaying a role category addition control on the role management page; in response to a trigger operation on the role category addition control, displaying a role category addition page; in response to an input operation on the role category addition page, displaying the input role information, and generating a role category addition work order based on the input role information; when the role category addition work order is approved, it is determined that the role category has been successfully added.

[0154] Specifically, before displaying the role category set, you can also add a new role category. System access personnel can add a new role category through the role management page, and then associate the newly added role category with the permission bit. In this way, the flexibility of role category association is improved.

[0155] In one of the embodiments, in response to a link editing operation on a permission bit, an accessible page link associated with the permission bit edited by the link editing operation is displayed, including: displaying a link editing control corresponding to the created permission bit; in response to a triggering operation on the link editing control, displaying a set of functional modules included in the business system; in response to a selection operation on the set of functional modules, using a page link included in the target functional module selected by the selection operation as the accessible page link associated with the permission bit.

[0156] Specifically, since the permission bit can point to a functional module in the business system, the accessible page link associated with the permission bit can be determined by selecting the functional module. The terminal can display a link editing control corresponding to the created permission bit. When the system access personnel clicks the link editing control, the terminal can display a set of functional modules included in the business system, and the system access personnel can select a target functional module from them. Since the target functional module may include multiple pages, for example, the kanban module may include a kanban display page, a kanban content statistics page, etc., the terminal may use the link of the page included in the target functional module as an accessible page link associated with the permission bit, and send the accessible page link to the permission engine system background, so that the permission engine system background generates a first association relationship between the permission bit and the accessible page link.

[0157] In this embodiment, the accessible page link associated with the permission bit is determined by selecting a function module, which greatly improves the efficiency of obtaining the accessible page link compared to inputting the accessible page links one by one.

[0158] In one embodiment, reference Fig.16 , provides an authentication method, including:

[0159] S1602, the permission engine system obtains the login account and login password entered through the login page of the permission engine system; when the login account and the login password match, an authorization code is generated according to the login account, and the authorization code is fed back and a pre-configured redirection page link is obtained.

[0160] S1604, the permission engine system sends the authorization code and redirection page link to the front end of the business system; the redirection page link sent is used to trigger the front end of the business system to display the corresponding redirection page; the feedback authorization code is used to trigger the business system to generate an authentication ticket generation request carrying the authorization code.

[0161] S1606, when receiving the authentication ticket generation request, the permission engine system parses the authorization code to obtain the login account of the target object; determines the pre-configured object identity information corresponding to the login account; encrypts the object identity information to obtain identity encryption information.

[0162] S1608, the permission engine system signs the identity encryption information and the object identifier of the target object through a preset private key, obtains an authentication ticket, and sends the authentication ticket to the business system.

[0163] S1610, the permission engine system obtains the permission bit identifier acquisition request sent by the business system according to the received authentication ticket, parses the permission bit identifier acquisition request, and obtains the authentication ticket carried by the permission bit identifier acquisition request.

[0164] S1612, the permission engine system parses the authentication ticket to obtain the object identifier of the target object; determines the corresponding permission bit identifier based on the object identifier, and sends the permission bit identifier to the business system; the sent permission bit identifier is used to trigger the business system to cache.

[0165] S1614, when the target object accesses the target page in the business system of the access permission engine system, the permission engine system obtains the permission bit identifier of the target object and the authentication ticket obtained by logging into the permission engine system; the permission bit identifier matches the role category of the target object.

[0166] S1616, the permission engine system verifies the authentication ticket, and when the authentication ticket verification passes, determines a pre-configured accessible page link associated with the permission bit identifier.

[0167] S1618, the permission engine system feeds back the accessible page link to the business system; the fed-back accessible page link is used to instruct the business system to determine the target object's access rights to the target page based on the matching relationship between the page link of the target page and the accessible page link.

[0168] Since the permission engine system is an open and accessible independent system, it can be connected to multiple business systems, thereby realizing permission management of multiple business systems through one permission engine system, reducing the resources consumed by repeated development of permission management modules, and thus improving authentication efficiency.

[0169] In one embodiment, reference Fig.17 , provides a business system access method, including:

[0170] S1702, the terminal displays a permission bit creation page in response to an access operation of connecting the business system to the permission engine system, and displays a created permission bit in response to a permission bit creation operation triggered by the permission bit creation page.

[0171] S1704, the terminal displays a role management page; the role management page displays a role category new addition control; in response to a trigger operation for the role category new addition control, a role category new addition page is displayed.

[0172] S1706, the terminal displays the input role information in response to the input operation on the role category adding page, and generates a role category adding work order according to the input role information; when the role category adding work order is approved, it is determined that the role category is successfully added.

[0173] S1708, the terminal displays a role editing control corresponding to the created permission bit; and in response to a triggering operation on the role editing control, displays a role category set.

[0174] S1710: In response to a selection operation on a role category set, the terminal displays a target role category selected by the selection operation, and establishes a second association relationship between the target role category and the created permission bit.

[0175] S1712, the terminal displays a link editing control corresponding to the created permission bit; in response to a triggering operation on the link editing control, displays a set of functional modules included in the business system.

[0176] S1714: In response to the selection operation on the function module set, the terminal uses the page link included in the target function module selected by the selection operation as an accessible page link associated with the permission bit.

[0177] S1716, in response to the completion of the link editing operation, the terminal triggers the first association relationship between the permission bit and the accessible page link to take effect in the permission engine system; the first association relationship is used for authentication when the target object of the role category accesses the page in the business system.

[0178] Since the permission engine system is an open and accessible independent system, it can be connected to multiple business systems, thereby realizing permission management of multiple business systems through one permission engine system, reducing the resources consumed by repeated development of permission management modules, and thus improving authentication efficiency.

[0179] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0180] Based on the same inventive concept, the embodiment of the present application also provides an authentication device for implementing the authentication method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more authentication device embodiments provided below can refer to the limitations on the authentication method above, and will not be repeated here.

[0181] In one embodiment, Fig.18 As shown, an authentication device 1800 is provided, including: a ticket acquisition module 1802, a link acquisition module 1804 and a feedback module 1806, wherein:

[0182] The ticket acquisition module 1802 is used to obtain the target object's permission bit identifier and the authentication ticket obtained by logging into the permission engine system when the target object accesses the target page in the business system of the access permission engine system; the permission bit identifier matches the role category of the target object;

[0183] The link acquisition module 1804 is used to verify the authentication ticket and, when the authentication ticket is verified, determine the pre-configured accessible page link associated with the permission bit identifier;

[0184] Feedback module 1806 is used to feed back the accessible page link to the business system; the fed-back accessible page link is used to instruct the business system to determine the target object's access rights to the target page based on the matching relationship between the page link of the target page and the accessible page link.

[0185] In one embodiment, the authentication device 1800 also includes a ticket generation module 1808, which is used to generate an authentication ticket according to the login account of the target object when logging into the permission engine system, and to feedback the authentication ticket to the business system; wherein the feedback authentication ticket is used to instruct the business system to cache the authentication ticket and set the validity period, and to send the authentication ticket to the permission engine system when it is determined that the target object has accessed the target page and the authentication ticket is within the validity period.

[0186] In one of the embodiments, the ticket generation module 1808 is also used to trigger the display of a login page; the target object logs in to the permission engine system through the login page of the permission engine system; the login page is the page displayed when the target object accesses the business system for the first time within a preset time period; when the target object accesses the business system and the session object of the business system does not include an authentication ticket or the authentication ticket is invalid, it is determined that the target object is accessing the business system for the first time within the preset time period.

[0187] In one of the embodiments, the ticket generation module 1808 is also used to obtain the login account and login password entered through the login page of the permission engine system; when the login account and the login password match, obtain a preconfigured redirection page link; send the redirection page link to the front end of the business system; the sent redirection page link is used to trigger the front end of the business system to display the corresponding redirection page, and the redirection page displays an access control for accessing the target page.

[0188] In one of the embodiments, the ticket generation module 1808 is also used to obtain a login account entered through a login page of an authentication system; generate an authorization code based on the login account, and feedback the authorization code; the feedback authorization code is used to trigger the business system to generate an authentication ticket generation request carrying the authorization code; receive the authentication ticket generation request sent by the business system, and generate an authentication ticket based on the authorization code in the authentication ticket generation request.

[0189] In one of the embodiments, the authentication ticket generation module 1808 is also used to parse the authorization code to obtain the login account of the target object; determine the pre-configured object identity information corresponding to the login account; encrypt the object identity information to obtain identity encryption information; and sign the identity encryption information and the object identifier of the target object through a preset private key to obtain an authentication ticket.

[0190] In one of the embodiments, the ticket generation module 1808 is also used to obtain an encryption function and a key; divide the object identity information to obtain multiple identity information fragments; encrypt each identity information fragment through the encryption function and the key to obtain the encrypted fragment corresponding to each identity information fragment; and combine the encrypted fragments corresponding to each identity information fragment to obtain identity encryption information.

[0191] In one of the embodiments, the authentication device 1800 is also used to obtain a permission bit identifier acquisition request sent by the business system, and parse the permission bit identifier acquisition request to obtain an authentication ticket carried by the permission bit identifier acquisition request; parse the authentication ticket to obtain the object identifier of the target object; determine the corresponding permission bit identifier based on the object identifier, and send the permission bit identifier to the business system; the sent permission bit identifier is used to trigger the business system to cache.

[0192] In one of the embodiments, the authentication device 1800 is further used to determine the role category to which the target object belongs according to the object identifier; and to search for the pre-configured permission bit associated with the role category to obtain the corresponding permission bit identifier.

[0193] In one of the embodiments, the authentication device 1800 is also used to obtain the security level of the business system based on the system identifier of the business system when the target object accesses the business system for the first time within a preset time period; when the security level of the business system is greater than or equal to the preset level threshold, determine whether the target object has passed the internal authentication of the enterprise to which the business system belongs; when the target object passes the internal authentication, determine whether the target object has logged in to the permission engine system, and when it is determined that the target object has logged in to the permission engine system, trigger the front end of the business system to display an access control for accessing the target page in the business system.

[0194] In one of the embodiments, the feedback module 1806 is also used to trigger the business system to determine the target object's authority to the target access page; when the page link of the target page does not belong to an accessible page link, the business system determines that the target object does not have the authority to access the target access page; when the target object does not have the authority to access the target access page, the business system triggers the front end of the permission engine system to display a role application page, so that the target object applies for the role category required to access the target page through the role application page.

[0195] Based on the same inventive concept, the embodiment of the present application also provides a business system access device for implementing the business system access method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more business system access device embodiments provided below can refer to the limitations on the business system access method above, and will not be repeated here.

[0196] In one embodiment, Fig.19 As shown, a business system access device 1900 is provided, including: a permission position creation module 1902, a role category association module 1904 and a link association module 1906, wherein:

[0197] The permission bit creation module 1902 is used to display the permission bit creation page in response to the access operation of accessing the business system to the permission engine system, and to display the created permission bit in response to the permission bit creation operation triggered by the permission bit creation page;

[0198] The role category association module 1904 is used to respond to the role editing operation on the permission bit and display the role category associated with the permission bit edited by the role editing operation;

[0199] Link association module 1906 is used to respond to a link editing operation on a permission bit and display an accessible page link associated with the permission bit edited through the link editing operation; in response to the completion of the link editing operation, trigger the first association relationship between the permission bit and the accessible page link to take effect in the permission engine system; the first association relationship is used for authentication when the target object of the role category accesses a page in the business system.

[0200] In one embodiment, the role category association module 1904 is also used to display a role editing control corresponding to the created permission bit; in response to a trigger operation on the role editing control, display a role category set; in response to a selection operation on the role category set, display a target role category selected by the selection operation, and establish a second association relationship between the target role category and the created permission bit.

[0201] In one of the embodiments, business system access 1900 is also used to display a role management page; the role management page displays a role category addition control; in response to a trigger operation on the role category addition control, a role category addition page is displayed; in response to an input operation on the role category addition page, the input role information is displayed, and a role category addition work order is generated based on the input role information; when the role category addition work order is approved, it is determined that the role category has been successfully added.

[0202] In one of the embodiments, the link association module 1906 is also used to display a link editing control corresponding to the created permission bit; in response to a trigger operation on the link editing control, display a set of functional modules included in the business system; in response to a selection operation on the set of functional modules, use the page link included in the target functional module selected by the selection operation as an accessible page link associated with the permission bit.

[0203] Each module in the above authentication device and business system access device can be implemented in whole or in part by software, hardware and their combination. Each module can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the corresponding operations of each module.

[0204] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Fig. 20 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store authentication data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, an authentication method is implemented.

[0205] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Fig.21 As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a service system access method is implemented. The display unit of the computer device is used to form a visually visible image, and can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen. The input device of the computer device can be a touch layer covered on the display screen, or a button, trackball or touchpad set on the computer device casing, or an external keyboard, touchpad or mouse, etc.

[0206] Those skilled in the art will understand that Figure 20 to Figure 21The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0207] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0208] In one embodiment, a computer-readable storage medium is provided, storing a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0209] In one embodiment, a computer program product or computer program is provided, the computer program product or computer program includes computer instructions, the computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the steps in the above-mentioned method embodiments.

[0210] It should be noted that the user information, object identity information, object information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0211] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0212] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0213] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. An authentication method, characterized in that: The method comprises: When the target object logs into the permission engine system, the pre-configured object identity information corresponding to the login account is encrypted to obtain identity encryption information; The identity encryption information and the object identifier of the target object are signed by a preset private key to obtain an authentication ticket, and the authentication ticket is fed back to the business system of the access authority engine system; When obtaining the permission bit identifier acquisition request carrying the authentication ticket sent by the business system, parsing the authentication ticket carried in the permission bit identifier acquisition request to obtain the object identifier of the target object; Determine a corresponding permission bit identifier according to the object identifier of the target object, and send the permission bit identifier to the business system; the permission bit identifier is included in the permission bit, and the permission bit also includes a permission bit name, and the permission bit name represents a functional module in the business system pointed to by the permission bit; When the target object accesses the target page in the business system of the access permission engine system, the permission bit identifier of the target object and the authentication ticket obtained by logging into the permission engine system are obtained; the permission bit identifier matches the role category of the target object; Verifying the authentication ticket, and when the authentication ticket is verified, determining a preconfigured accessible page link associated with the permission bit identifier; The accessible page link is fed back to the business system; the fed back accessible page link is used to instruct the business system to determine the target object's access rights to the target page based on a matching relationship between the page link of the target page and the accessible page link.

2. The method according to claim 1, characterized in that Before the target object accesses the target page in the business system of the access authority engine system, the feeding back the authentication ticket to the business system of the access authority engine system includes: The fed-back authentication ticket is used to instruct the business system to cache the authentication ticket and set a validity period, and to send the authentication ticket to the permission engine system when it is determined that the target object accesses the target page and the authentication ticket is within the validity period.

3. The method according to claim 1, characterized in that The target object logs in to the permission engine system through the login page of the permission engine system; the login page is a page displayed when the target object accesses the business system for the first time within a preset time period; when the target object accesses the business system and the session object of the business system does not include an authentication ticket or the authentication ticket is invalid, it is determined that the target object accesses the business system for the first time within the preset time period.

4. The method according to claim 1, characterized in that: The method further comprises: Obtaining the login account and login password entered through the login page of the permission engine system; When the login account and the login password match, obtaining a preconfigured redirection page link; The redirection page link is sent to the front end of the business system; the sent redirection page link is used to trigger the front end of the business system to display a corresponding redirection page, and the redirection page displays an access control for accessing the target page.

5. The method according to claim 1, characterized in that The method further comprises: Obtain the login account entered through the login page of the authentication system; Generate an authorization code according to the login account, and feedback the authorization code; the feedback authorization code is used to trigger the business system to generate an authentication ticket generation request carrying the authorization code; Receive an authentication ticket generation request sent by the business system.

6. The method according to claim 5, characterized in that The method further comprises: The authorization code in the authentication ticket generation request is parsed to obtain the login account of the target object.

7. The method according to claim 1, characterized in that The step of encrypting the object identity information to obtain encrypted identity information includes: Get the encryption function and key; Dividing the object identity information to obtain multiple identity information fragments; Encrypting each of the identity information fragments by using the encryption function and the key to obtain an encrypted fragment corresponding to each of the identity information fragments; The encrypted fragments corresponding to each of the identity information fragments are combined to obtain identity encryption information.

8. The method according to claim 1, characterized in that The sending the permission bit identifier to the business system includes: sending the permission bit identifier to the business system, and the sent permission bit identifier is used to trigger the business system to perform caching.

9. The method according to claim 1, characterized in that: The determining the corresponding permission bit identifier according to the object identifier of the target object includes: Determining the role category to which the target object belongs according to the object identifier; The pre-configured permission bit associated with the role category is searched to obtain a corresponding permission bit identifier.

10. The method according to claim 1, characterized in that Before the target object accesses the target page in the business system of the access authority engine system, the method further includes: When the target object accesses the business system for the first time within a preset time period, obtaining the security level of the business system according to the system identification of the business system; When the security level of the business system is greater than or equal to a preset level threshold, determining whether the target object has passed the internal authentication of the enterprise to which the business system belongs; When the target object passes the internal authentication, it is determined whether the target object has logged in to the permission engine system, and when it is determined that the target object has logged in to the permission engine system, the front end of the business system is triggered to display an access control for accessing the target page in the business system.

11. The method according to claim 1, characterized in that: After feeding back the accessible page link to the business system, the method further includes: When the page link of the target page does not belong to the accessible page link, the business system determines that the target object does not have the authority to access the target page; When the target object does not have permission to access the target page, the business system triggers the front end of the permission engine system to display a role application page, so that the target object applies for the role category required to access the target page through the role application page.

12. A method for accessing a business system, characterized in that: The method comprises: In response to an access operation of accessing the business system to the permission engine system, a permission bit creation page is displayed, and in response to a permission bit creation operation triggered by the permission bit creation page, a created permission bit is displayed; the permission bit at least includes a permission bit identifier and a permission bit name; the permission bit name represents a functional module in the business system pointed to by the permission bit; In response to a role editing operation on the permission bit, displaying a role category associated with the permission bit edited by the role editing operation; In response to a link edit operation on the permission bit, displaying a link edit control corresponding to the created permission bit; In response to a triggering operation on the link editing control, displaying a set of functional modules included in the business system; In response to a selection operation on a set of function modules, the target function module selected by the selection operation is used as the function module in the business system pointed to by the created permission bit, and the page link included in the target function module is used as the accessible page link associated with the permission bit; in response to the completion of the link editing operation, a first association relationship between the permission bit and the accessible page link is triggered to take effect in the permission engine system; the first association relationship is used for authentication when the target object of the role category accesses a page in the business system.

13. The method according to claim 12, characterized in that In response to the role editing operation on the permission bit, displaying the role category associated with the permission bit edited by the role editing operation includes: Display the role edit control corresponding to the created permission bit; In response to a trigger operation on the role editing control, displaying a role category set; In response to a selection operation on the role category set, the target role category selected by the selection operation is displayed, and a second association relationship between the target role category and the created permission bit is established.

14. The method according to claim 13, characterized in that Before displaying the role category set, the method further includes: Displaying a role management page; the role management page displays a new role category control; In response to a triggering operation for adding a new control for the role category, displaying a role category adding page; In response to an input operation on the role category new adding page, displaying the input role information, and generating a role category new adding work order according to the input role information; When the new work order for the role category is approved, it is determined that the role category is successfully added.

15. An authentication device, characterized in that: The device comprises: A ticket generation module is used to encrypt the pre-configured object identity information corresponding to the login account when the target object logs in to the permission engine system to obtain identity encryption information; sign the identity encryption information and the object identifier of the target object through a preset private key to obtain an authentication ticket, and feed back the authentication ticket to the business system connected to the permission engine system; when obtaining the permission bit identifier acquisition request carrying the authentication ticket sent by the business system, parse the authentication ticket carried by the permission bit identifier acquisition request to obtain the object identifier of the target object; determine the corresponding permission bit identifier according to the object identifier of the target object, and send the permission bit identifier to the business system; the permission bit identifier is included in the permission bit, and the permission bit also includes a permission bit name, and the permission bit name represents the functional module in the business system pointed to by the permission bit; A ticket acquisition module, used to acquire the permission bit identifier of the target object and the authentication ticket obtained by logging into the permission engine system when the target object accesses the target page in the business system of the access permission engine system; the permission bit identifier matches the role category of the target object; A link acquisition module, used to verify the authentication ticket and, when the authentication ticket is verified, determine a pre-configured accessible page link associated with the permission bit identifier; A feedback module is used to feed back the accessible page link to the business system; the fed-back accessible page link is used to instruct the business system to determine the target object's access rights to the target page based on the matching relationship between the page link of the target page and the accessible page link.

16. The device according to claim 15, characterized in that The fed-back authentication ticket is used to instruct the business system to cache the authentication ticket and set a validity period, and to send the authentication ticket to the permission engine system when it is determined that the target object accesses the target page and the authentication ticket is within the validity period.

17. The device according to claim 15, characterized in that The ticket generation module is also used to trigger the display of a login page; the target object logs in to the permission engine system through the login page of the permission engine system; the login page is the page displayed when the target object accesses the business system for the first time within a preset time period; when the target object accesses the business system and the session object of the business system does not include an authentication ticket or the authentication ticket is invalid, it is determined that the target object is accessing the business system for the first time within the preset time period.

18. The device according to claim 15, characterized in that The ticket generation module is also used to obtain the login account and login password input through the login page of the permission engine system; when the login account and the login password match, obtain a pre-configured redirection page link; Sending the redirection page link to the front end of the business system; The redirection page link sent is used to trigger the front end of the business system to display a corresponding redirection page, and the redirection page displays an access control for accessing the target page.

19. The device according to claim 15, characterized in that The ticket generation module is also used to obtain the login account entered through the login page of the authentication system; generate an authorization code based on the login account and feedback the authorization code; the feedback authorization code is used to trigger the business system to generate an authentication ticket generation request carrying the authorization code; receive the authentication ticket generation request sent by the business system.

20. The device according to claim 19, characterized in that The ticket generation module is also used to parse the authorization code in the authentication ticket generation request to obtain the login account of the target object.

21. The device according to claim 15, characterized in that The ticket generation module is also used to obtain an encryption function and a key; divide the object identity information to obtain multiple identity information fragments; encrypt each of the identity information fragments using the encryption function and the key to obtain an encrypted fragment corresponding to each of the identity information fragments; and obtain identity encryption information by combining the encrypted fragments corresponding to each of the identity information fragments.

22. The device according to claim 15, characterized in that The authentication device is further used to send the permission bit identifier to the business system, and the sent permission bit identifier is used to trigger the business system to perform caching.

23. The device according to claim 15, characterized in that The authentication device is also used to determine the role category to which the target object belongs according to the object identifier; and to search for a pre-configured permission bit associated with the role category to obtain a corresponding permission bit identifier.

24. The device according to claim 15, characterized in that The authentication device is also used to obtain the security level of the business system according to the system identification of the business system when the target object accesses the business system for the first time within a preset time period; when the security level of the business system is greater than or equal to a preset level threshold, determine whether the target object has passed the internal authentication of the enterprise to which the business system belongs; When the target object passes the internal authentication, it is determined whether the target object has logged in to the permission engine system, and when it is determined that the target object has logged in to the permission engine system, the front end of the business system is triggered to display an access control for accessing the target page in the business system.

25. The device according to claim 15, characterized in that The feedback module is also used for, when the page link of the target page does not belong to the accessible page link, the business system determines that the target object does not have the authority to access the target page; When the target object does not have permission to access the target page, the business system triggers the front end of the permission engine system to display a role application page, so that the target object applies for the role category required to access the target page through the role application page.

26. A service system access device, characterized in that: The device comprises: A permission bit creation module, for displaying a permission bit creation page in response to an access operation of connecting a business system to a permission engine system, and for displaying a created permission bit in response to a permission bit creation operation triggered by the permission bit creation page; the permission bit at least includes a permission bit identifier and a permission bit name; the permission bit name represents a functional module in the business system pointed to by the permission bit; A role category association module, configured to respond to a role editing operation on the permission bit and display a role category associated with the permission bit edited by the role editing operation; A link association module is used to, in response to a link editing operation on the permission bit, display a link editing control corresponding to the created permission bit; in response to a triggering operation on the link editing control, display a set of functional modules included in the business system; in response to a selection operation on the set of functional modules, use the target functional module selected by the selection operation as the functional module in the business system pointed to by the created permission bit, and use the page link included in the target functional module as the accessible page link associated with the permission bit; in response to completion of the link editing operation, trigger a first association relationship between the permission bit and the accessible page link to take effect in the permission engine system; the first association relationship is used for authentication when a target object of the role category accesses a page in the business system.

27. The device according to claim 26, characterized in that The role category association module is further used to display a role editing control corresponding to the created permission bit; in response to a trigger operation on the role editing control, display a role category set; In response to a selection operation on the role category set, the target role category selected by the selection operation is displayed, and a second association relationship between the target role category and the created permission bit is established.

28. The device according to claim 27, characterized in that The business system access device is also used to display a role management page; the role management page displays a role category new control; in response to a trigger operation on the role category new control, a role category new page is displayed; in response to an input operation on the role category new page, the input role information is displayed, and a role category new work order is generated based on the input role information; when the role category new work order is approved, it is determined that the role category has been successfully added.

29. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 11 or 12 to 14 are implemented.

30. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 11 or 12 to 14 are implemented.

31. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 11 or 12 to 14 are implemented.

Images