Access method and device of application system, gateway and readable storage medium

Abstract

The application discloses an application system access method and device, a gateway and a readable storage medium. The application system access method comprises the following steps: receiving interactive data of a target application system forwarded through a second gateway, wherein the second gateway adds a user fixed identifier to the interactive data sent by a client, and forwards the interactive data with the added user fixed identifier to the first gateway; acquiring the user fixed identifier in the interactive data; and when it is determined according to the user fixed identifier that the target application system has access permission, sending the interactive data to the target application system. In this way, the first gateway can identify the access permission according to the user fixed identifier, and the security of target application system access can be improved.

Description

Technical Field

[0001] The present invention relates to the field of data access technology, and in particular to an access method and device for an application system, a gateway, and a readable storage medium. Background Art

[0002] There are currently two main methods for accessing data in application systems: one is access based on the client's IP address; the other is access based on user login information after authentication. However, access based on IP addresses cannot accurately distinguish between different users sharing a common IP address, making it impossible to accurately determine access rights. Access based on user login information easily exposes authentication interfaces, posing a risk of hacker intrusion. Therefore, whether access is based on IP addresses or login information, access to application systems poses security risks. Summary of the Invention

[0003] The main purpose of the present invention is to provide an application system access method and device, a gateway and a readable storage medium, aiming to improve the security of application system access.

[0004] To achieve the above object, the present invention provides an application system access method, which is applied to a first gateway, and the method comprises the following steps:

[0005] receiving interaction data of a target application system forwarded by a second gateway, wherein the second gateway adds a fixed user identifier to the interaction data sent by the client, and forwards the interaction data with the fixed user identifier added to the first gateway;

[0006] Obtaining a user fixed identifier from the interaction data;

[0007] When it is determined that the user has access rights to the target application system according to the fixed user identifier, the interaction data is sent to the target application system.

[0008] Optionally, after the step of obtaining the user fixed identifier in the interaction data, the method further includes:

[0009] It is determined whether the fixed user identifier matches a preset fixed user identifier in a whitelist associated with the target application system, wherein when the fixed user identifier does not match the preset fixed user identifier, it is determined that the user does not have access rights to the target application system.

[0010] Optionally, before the step of determining whether the fixed user identifier matches a preset fixed user identifier in a whitelist associated with the target application system, the method further includes:

[0011] receiving an updated whitelist sent by the target application system, and using the updated whitelist as the whitelist associated with the target application system; or

[0012] An update management operation of a whitelist is received, and the whitelist associated with the target application system is updated according to the update management operation.

[0013] Optionally, after the step of obtaining the user fixed identifier in the interaction data, the method further includes:

[0014] If there is no abnormality in the interaction data, then when it is determined that the user has access rights to the target application system according to the fixed user identifier, executing the step of sending the interaction data to the target application system;

[0015] If the interaction data is abnormal, the interaction data is intercepted, and the user who sent the interaction data is tracked according to the fixed identifier of the user.

[0016] Optionally, after the step of obtaining the user fixed identifier in the interaction data, the method further includes:

[0017] When it is determined according to the fixed user identifier that the user does not have the access authority to the target application system, the interactive data is intercepted, and a prompt message indicating access failure is sent to the client that sent the interactive data.

[0018] In addition, to achieve the above-mentioned purpose, the present invention further provides an application system access method, which is applied to the second gateway, and the method comprises the following steps:

[0019] Receive interaction data of the target application system sent by the client;

[0020] Adding a fixed user identifier corresponding to the client to the interaction data;

[0021] The interaction data after adding the user fixed identifier is sent to the first gateway, wherein the first gateway receives the interaction data of the target application system forwarded by the second gateway, obtains the user fixed identifier in the interaction data, and sends the interaction data to the target application system when it is determined that the user has access rights to the target application system based on the user fixed identifier.

[0022] Optionally, the step of adding a fixed user identifier corresponding to the client to the interaction data includes:

[0023] If the interactive data is transmitted based on a plain text protocol, adding the user fixed identifier to the message header of the interactive data;

[0024] If the interactive data is transmitted based on a ciphertext protocol, the user fixed identifier is added to a secure socket protocol handshake message of the interactive data.

[0025] In addition, to achieve the above-mentioned purpose, the present invention also provides a gateway, which includes a memory, a processor, and an access program for the application system stored on the processor and runable on the processor, and when the processor executes the access program for the application system, the steps of the access method for the application system as described above are implemented.

[0026] In addition, to achieve the above-mentioned purpose, the present invention further provides an access device for an application system, the access device for the application system comprising a first receiving module, an acquiring module, and a second sending module, wherein:

[0027] The first receiving module is configured to receive interaction data of a target application system forwarded by a second gateway, wherein the second gateway adds a fixed user identifier to the interaction data sent by the client and forwards the interaction data with the fixed user identifier to the first gateway;

[0028] The acquisition module is used to acquire the user fixed identifier in the interaction data;

[0029] The first sending module is configured to send the interaction data to the target application system when it is determined that the user has access rights to the target application system according to the fixed user identifier;

[0030] Alternatively, the access device of the application system includes a second receiving module, an adding module and a second sending module, wherein:

[0031] The second receiving module is used to receive the interaction data of the target application system sent by the client;

[0032] The adding module is used to add the user fixed identifier corresponding to the client to the interaction data;

[0033] The second sending module is used to send the interaction data after adding the user fixed identifier to the first gateway, wherein the first gateway receives the interaction data of the target application system forwarded by the second gateway, obtains the user fixed identifier in the interaction data, and sends the interaction data to the target application system when it is determined that the user has access rights to the target application system based on the user fixed identifier.

[0034] In addition, to achieve the above purpose, the present invention also provides a readable storage medium, which stores an access program of the application system. When the access program of the application system is executed by the processor, the steps of the access method of the application system described above are implemented.

[0035] In an embodiment of the present invention, after the second gateway adds a fixed user identifier to the interactive data sent by the client and forwards the interactive data with the fixed user identifier to the first gateway, the first gateway receives the interactive data of the target application system forwarded by the second gateway and obtains the fixed user identifier in the interactive data. When it is determined based on the fixed user identifier that the user has access rights to the target application system, the first gateway sends the interactive data to the target application system. This can avoid sending the interactive data to the target application system when the user does not have access rights to the target application system, which may lead to security risks in the target application system. Furthermore, determining that the user has access rights to the target application system based on the fixed user identifier does not require the user to enter login information or obtain the IP address corresponding to the client. This can avoid exposing the login interface or the inability to accurately determine the access rights to the target application system due to changes in the IP address, which may lead to security risks in accessing the target application system. That is, by having the first gateway determine that the user has access rights to the target application system based on the fixed user identifier, the security of access to the target application system can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 A schematic diagram of the structure of an access device for an integrated application system in a hardware operating environment according to an embodiment of the present invention;

[0037] Figure 2 This is a flow chart of an embodiment of an access method for an application system of the present invention;

[0038] Figure 3 A flow chart of another embodiment of the method for accessing an application system of the present invention;

[0039] Figure 4 A flowchart of another embodiment of the method for accessing an application system of the present invention;

[0040] Figure 5 A schematic diagram of functional modules of an embodiment of an access device of an application system of the present invention;

[0041] Figure 6 This is a functional module diagram of another embodiment of the access device of the application system of the present invention.

[0042] The purpose, features and advantages of the present invention will be further described with reference to the accompanying drawings and in conjunction with the embodiments. DETAILED DESCRIPTION

[0043] It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0044] The main solution of the application is: receiving the interactive data of the target application system forwarded through the second gateway, wherein the second gateway adds a user fixed identifier to the interactive data sent by the client, and forwards the interactive data with the added user fixed identifier to the first gateway; obtaining the user fixed identifier in the interactive data; when it is determined according to the user fixed identifier that the target application system has access permission, the interactive data is sent to the target application system.

[0045] In the prior art, access permission is mainly identified by the IP address corresponding to the client to realize the access of the application system, or the access permission is identified by the user input login information to realize the access of the application system. However, the IP address will change with the change of the Internet access mode and other factors, so that the access permission identification is inaccurate, and the access of the application system has a security risk; and when the user inputs the login information, the authentication interface is easily exposed, which causes the risk of hacker intrusion. Therefore, the present application provides the above-mentioned solution, which aims to improve the security of the access of the application system.

[0046] Reference Figure 1 , Figure 1 The application system access device structure diagram of the hardware running environment involved in the embodiment of the application.

[0047] Optionally, the application system access device can be a gateway, for example, a first gateway or a second gateway. The first gateway refers to a gateway device deployed before the target application system, used for managing and controlling the interactive data of the target application system (such as identity authentication, traffic limitation, etc.), such as a GGSN gateway of an operator mobile network; the second gateway refers to a gateway device deployed before the first gateway, used for user identity identification of the interactive data sent by the client, such as a transparent gateway.

[0048] As shown in Figure 1 , the application system access device can include a communication bus 1002, a processor 1001 such as a CPU, a user interface 1003, a network interface 1004, and a memory 1005. The communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 can include a display screen (Display), an input unit such as a keyboard (Keyboard), and an optional user interface 1003, which can also include a standard wired interface, a wireless interface. The network interface 1004 can optionally include a standard wired interface, a wireless interface (such as a WI-FI interface). The memory 1005 can be a high-speed RAM memory, or a stable memory (non-volatile memory) such as a magnetic disk memory. The memory 1005 can also be an independent storage device from the aforementioned processor 1001.

[0049] Those skilled in the art will understand that Figure 1 The access device structure of the application system shown in the figure does not constitute a limitation on the access device of the application system, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0050] exist Figure 1 In the access device of the application system shown, the network interface 1004 is mainly used to connect to the background server and communicate data with the background server; the user interface 1003 is mainly used to connect to the client (user end) and communicate data with the client; and the processor 1001 can be used to call the access program of the application system stored in the memory 1005, and execute the relevant steps of each embodiment of the following application system access method.

[0051] Reference Figure 2 , Figure 2 The flowchart of an embodiment of the method for accessing an application system of the present invention is shown in FIG. The method for accessing an application system proposed in this embodiment is applied to a first gateway, and the method for accessing an application system includes the following steps:

[0052] Step S10: receiving interaction data of the target application system forwarded by the second gateway, wherein the second gateway adds a fixed user identifier to the interaction data sent by the client, and forwards the interaction data with the fixed user identifier added to the first gateway;

[0053] It should be noted that the first gateway refers to a gateway device deployed before the target application system, which is used to manage and control the interactive data of the target application system (such as identity authentication, traffic restriction, etc.); the second gateway refers to a gateway device deployed before the first gateway, which is used to identify the user identity of the interactive data sent by the client; the target application system refers to the application system with which the client needs to interact; the user fixed identification refers to identification information that can uniquely identify the interactive data sent by each client and will not change due to external factors, such as telephone numbers, identity information associated with telephone numbers, etc.

[0054] Optionally, the first gateway may be a transparent gateway, and the second gateway may be a GGSN gateway of the operator's mobile network. The GGSN gateway of the operator's mobile network can obtain the user's fixed identifier (e.g., mobile phone number) corresponding to the client when the client accesses a designated address through the mobile network and add it to the interaction data. The interaction data with the added user's fixed identifier is then sent to the transparent gateway, which performs access authentication based on the user's fixed identifier. In this way, through the mutual cooperation of the first gateway and the second gateway, the user can be authenticated without the user's awareness, without the need for the user to enter login information or perform network adaptation based on the client's IP, thereby improving the security of access to the target application system.

[0055] Specifically, when the user sends interaction data to the target application system through the client, for example, the user sends an access request to the target application system through the domain name on the client, the client can send the interaction data carrying the domain name to the second gateway through the communication network. The second gateway determines whether the target application system accessed by the client is the specified system associated with the second gateway according to the domain name. If the target application system accessed by the client is the specified system associated with the second gateway, the second gateway obtains the fixed identifier of the user corresponding to the client according to the mobile network used by the client when sending the interaction data, adds the fixed identifier of the user to the interaction data, and then forwards the interaction data with the added fixed identifier of the user to the first gateway. Alternatively, the second gateway can also send the fixed identifier of the user associated with the interaction data to the first gateway.

[0056] Step S20: obtaining the fixed identifier of the user in the interaction data;

[0057] After the first gateway receives the interaction data of the target application system forwarded by the second gateway, since the second gateway has previously added the fixed identifier of the user in the interaction data of the target application system, the first gateway can directly obtain the fixed identifier of the user from the interaction data, and further perform authentication processing on the current interaction data according to the fixed identifier of the user to determine whether the access right of the target application system is possessed.

[0058] Alternatively, the first gateway has a whitelist associated with the target application system in advance, and the fixed identifier of the user can be matched with the preset fixed identifier of the user in the whitelist associated with the target application system to determine whether the access right of the target application system is possessed. Specifically, after obtaining the fixed identifier of the user in the interaction data, it is judged whether the fixed identifier of the user matches the preset fixed identifier of the user in the whitelist associated with the target application system. If there is a preset fixed identifier of the user in the whitelist associated with the target application system that matches the obtained fixed identifier of the user, it is considered that the access right of the target application system is possessed; if there is no preset fixed identifier of the user in the whitelist associated with the target application system that matches the obtained fixed identifier of the user, it is considered that the access right of the target application system is possessed.

[0059] Optionally, in order to facilitate real-time updates of the whitelist associated with the target application system and improve the reliability of the first gateway authentication, the whitelist associated with the target application system can be updated before determining the access rights. The specific update method can be: after the user performs update operations such as adding, deleting, and replacing the preset user fixed identifiers in the whitelist associated with the target application system in the target application system, the target application system automatically synchronizes the updated whitelist to the first gateway; or the user performs update management operations such as adding, deleting, and replacing the preset user fixed identifiers in the whitelist associated with the target application system on the management platform of the first gateway to achieve the update of the whitelist associated with the target application system. Of course, it can also be a combination of the above methods. In this way, by flexibly selecting the update method of the whitelist associated with the target application system, the effectiveness of the update of the whitelist associated with the target application system can be improved, thereby improving the effectiveness of authentication.

[0060] Thus, before determining whether the user's fixed identifier matches the preset user fixed identifier in the whitelist associated with the target application system, in order to improve the effectiveness of the first gateway's identity authentication, it can first detect whether there has been an update to the whitelist. If there has been an update to the whitelist, the user's fixed identifier is matched with the preset user fixed identifier in the updated whitelist to determine whether the user has access rights to the target application system. This avoids the situation where, when the whitelist is updated, the updated whitelist is not used as the authentication basis in a timely manner, resulting in a decrease in the accuracy of the authentication result. In this way, by updating the whitelist in a timely manner, it is possible to prevent some users who do not have access rights from interacting with the target application system, leading to risks such as data leakage; and it is possible to prevent the interaction data of some users who have access rights from being intercepted, thereby affecting the user experience.

[0061] Step S30: When it is determined that the user has access rights to the target application system according to the fixed user identifier, the interaction data is sent to the target application system;

[0062] When the client determines that it has access rights to the target application system based on the fixed user identifier, the interaction environment is deemed secure and the interaction data can be sent to the target application system. After receiving the interaction data forwarded by the first gateway, the target application system can respond to the interaction data and feed the response data back to the client. Upon confirming access rights to the target application system, the first gateway also generates an authentication identifier for the target application system and binds it to the fixed user identifier to form a session identifier carrying the fixed user identifier (all subsequent interaction data from the client will carry this session identifier). The session identifier is then stored in the session cache block corresponding to the target application system on the first gateway. In this manner, during the next interaction, if the interaction data carries the session identifier, the first gateway will query the session cache block corresponding to the target application system for the session identifier carrying the authentication information and the fixed user identifier. If the session identifier for the target application is found, access rights to the target application system are granted, and there is no need to retrieve the fixed user identifier for authentication. If the session identifier for the target application is not found, the step of obtaining the fixed user identifier from the interaction data is performed and re-authentication is required.

[0063] When a user's fixed identifier determines that they lack access rights to the target application system, the user's interaction data will be intercepted to enhance the security of access to the target application system. This will hide the target application system and prevent the target application system from being displayed to the client without access rights, potentially leading to network attacks and other security risks. Optionally, after intercepting the exchanged data, a prompt indicating access failure can be sent to the client sending the interaction data, allowing the user to take appropriate action based on the prompt. For example, if an interception error occurs, the user can re-authenticate or file an appeal.

[0064] In this embodiment, the first gateway automatically performs authentication based on the user's fixed identifier. The user's fixed identifier is added by the first gateway without the need for manual input by the user and will not change with changes in the application environment. This can improve the reliability of authentication. Authentication based on the user's fixed identifier does not require authentication based on login information or IP address, which can avoid security risks caused by factors such as exposed authentication interfaces or unstable IP addresses, thereby improving the security of access to the target application system.

[0065] Based on the above embodiment, another embodiment of the access method of the application system of the present invention is proposed. Figure 3 The access method of the application system proposed in this embodiment is applied to the first gateway, and the access method of the application system further includes:

[0066] Step S10: receiving interaction data of the target application system forwarded by the second gateway, wherein the second gateway adds a fixed user identifier to the interaction data sent by the client, and forwards the interaction data with the fixed user identifier added to the first gateway;

[0067] Step S20: Obtaining a user fixed identifier in the interaction data;

[0068] Step S31: determining whether the interaction data is abnormal;

[0069] Step S301: When it is determined that the user has access rights to the target application system according to the fixed user identifier, the interaction data is sent to the target application system;

[0070] Step S302: intercepting the interaction data, and tracking the user who sent the interaction data according to the fixed user identifier.

[0071] Because the interaction data may inherently contain security risks such as cyberattacks, the first gateway, when authenticating access rights to the target application system based on the user's fixed identifier, can only guarantee the security of the access identity, not the security of the interaction data itself. Therefore, to further improve the security of interactions between the client and the target application system, anomaly detection can be performed on the interaction data after obtaining the user's fixed identifier from the interaction data and before the first gateway determines access rights to the target application system. Alternatively, anomaly detection can be performed on the interaction data by the first gateway, or by adding security protection devices such as firewalls before the first gateway.

[0072] If the interaction data is detected for anomalies via the first gateway, after the first gateway obtains the fixed user identifier in the interaction data, the interaction data may be detected for anomalies first, and then the access rights may be identified based on the fixed user identifier. Optionally, the interaction data may be detected for anomalies based on the fixed user identifier in the interaction data. For example, if the fixed user identifier is a phone number, the interaction data may be considered abnormal if the phone number is an overseas number, a marketing number, or a fraudulent number. Alternatively, the interaction data may be detected for anomalies based on a combination of the fixed user identifier in the interaction data and at least one other piece of information (e.g., the IP address corresponding to the client), etc., which are not specifically limited here.

[0073] On the one hand, when it is determined that there is no abnormality in the interaction data, it can be determined whether the user has access rights to the target application system based on the user's fixed identifier. When it is determined that the user has access rights to the target application system based on the user's fixed identifier, the interaction data will be sent to the target application system, so that while achieving identity authentication, the data security of the interaction data itself can also be ensured, achieving dual protection of data security and access security.

[0074] On the other hand, when it is determined that there is an anomaly in the interactive data, the interactive data can be intercepted in a timely manner to avoid forwarding the abnormal interactive data to the target application system after authentication is passed, which may cause security risks to the target application system. Optionally, after intercepting the interactive data, the user who sent the interactive data can be tracked and processed based on the user fixed identifier in the interactive data. For example, the user fixed identifier in the interactive data with abnormal interaction can be added to the blacklist of interactive data anomaly monitoring, so that the next time the interactive data is received, even if the user has changed the IP address, as long as the user fixed identifier is detected, the interactive data carrying the user fixed identifier can be directly intercepted without authentication, which can improve the reliability of interactive data anomaly monitoring.

[0075] Optionally, detecting anomalies in the interaction data and determining access rights to the target application system based on the user's fixed identifier may be performed simultaneously. In this case, if the user's fixed identifier determines that the user has access rights to the target application system and the interaction data does not contain anomalies, the step of sending the interaction data to the target application system is performed.

[0076] This embodiment performs anomaly detection on the interaction data after obtaining the user fixed identifier in the interaction data, so that the interaction data is sent to the target application system only when it is determined that the user has access rights to the target application system based on the user fixed identifier. This not only confirms the access rights to the target application system but also confirms the data security of the interaction data itself, thereby providing dual protection for data security and access security.

[0077] Based on the above embodiment, another embodiment of the access method of the application system of the present invention is proposed. Figure 4 The access method of the application system proposed in this embodiment is applied to the second gateway, and the access method of the application system further includes:

[0078] Step S01: receiving interaction data of a target application system sent by a client;

[0079] Step S02: Adding a fixed user identifier corresponding to the client to the interaction data;

[0080] Step S03: Send the interaction data after adding the user fixed identifier to the first gateway, wherein the first gateway receives the interaction data of the target application system forwarded by the second gateway, obtains the user fixed identifier in the interaction data, and sends the interaction data to the target application system when it is determined that the user has access rights to the target application system based on the user fixed identifier.

[0081] It should be noted that the first gateway refers to a gateway device deployed before the target application system, which is used to manage and control the interactive data of the target application system (such as identity authentication, traffic restriction, etc.); the second gateway refers to a gateway device deployed before the first gateway, which is used to identify the user identity of the interactive data sent by the client; the target application system refers to the application system with which the client needs to interact; the user fixed identification refers to identification information that can uniquely identify the interactive data sent by each client and will not change due to external factors, such as a telephone number.

[0082] In order to achieve seamless authentication and improve the accuracy of determining the interaction permissions with the target application system, the second gateway can obtain the user fixed identifier corresponding to the client and add it to the interaction data, so that the first gateway can determine the access permissions when accessing the target application system based on the user fixed identifier in the interaction data.

[0083] Optionally, the first gateway may be a transparent gateway, and the second gateway may be a GGSN gateway of the operator's mobile network. The GGSN gateway of the operator's mobile network can obtain the user's fixed identifier (e.g., mobile phone number) corresponding to the client when the client accesses a designated application system through a mobile network and add it to the interaction data. The interaction data with the added user's fixed identifier is then sent to the transparent gateway, which performs access authentication based on the user's fixed identifier. In this way, through the mutual cooperation of the first gateway and the second gateway, the user can be authenticated without the user's awareness, without the need for the user to enter login information or perform network adaptation based on the client's IP, thereby improving the security of access to the target application system.

[0084] Specifically, when a user sends interactive data to a target application system through a client, for example, when a user sends an access request to a target application system through a domain name through a client, the client can send the interactive data carrying the domain name to the second gateway through a communication network. The second gateway can determine whether the target application system is a designated system associated with the second gateway based on the domain name in the interactive data. If the target application system is a designated system associated with the second gateway, and the interactive data is sent by the client through a mobile network, the second gateway can obtain the user fixed identifier (such as a mobile phone number) corresponding to the client. After obtaining the user fixed identifier, in order to mark the interactive data for authentication by the first gateway, the user fixed identifier can be added to the interactive data, and the interactive data with the user fixed identifier added can be sent to the first gateway. Optionally, in some other embodiments, the user fixed identifier can be associated with the interactive data and then sent to the first gateway.

[0085] The location where the corresponding fixed user identifier is added to the interaction data varies depending on the transmission protocol used for the interaction data. To effectively add the fixed user identifier to the interaction data and facilitate authentication by the second gateway based on the fixed user identifier, interaction data transmitted using different protocols can be differentiated and the fixed user identifier can be added to the corresponding location accordingly.

[0086] Specifically, based on the protocol type used during transmission, interactive data can be divided into first-category interactive data transmitted over a plaintext protocol and second-category interactive data transmitted over a ciphertext protocol. When the interactive data is the first-category interactive data transmitted over a plaintext protocol, a fixed user identifier can be added to the message header of the interactive data. This allows the first gateway to quickly retrieve the fixed user identifier stored in the message header for authentication after receiving the interactive data, thereby improving authentication efficiency and avoiding long user wait times. When the interactive data is the second-category interactive data transmitted over a ciphertext protocol, the fixed user identifier can be added to the secure socket protocol handshake message of the interactive data. This can prevent the second gateway from effectively adding the fixed user identifier to the interactive data due to the encrypted message header during ciphertext transmission. Furthermore, adding the fixed user identifier to the secure socket protocol handshake message of the interactive data allows the first gateway to quickly retrieve the fixed user identifier for authentication during the handshake with the first gateway, thereby improving authentication efficiency. Optionally, the plaintext protocol can be, for example, http; and the ciphertext protocol can be, for example, https.

[0087] After the user fixed identifier is added to the interaction data, the interaction data with the user fixed identifier added thereto can be sent to the first gateway so that the first gateway can authenticate the interaction data based on the user fixed identifier. After receiving the interaction data of the target application system forwarded by the second gateway, the first gateway will obtain the user fixed identifier in the interaction data, and when it is determined based on the user fixed identifier that the user has access rights to the target application system, the interaction data will be sent to the target application system. That is, when the user does not have access rights to the target application system, the target application system is invisible to the accessing user, which can improve the confidentiality of the target application system. Among them, the relevant embodiments of the first gateway receiving the interaction data and sending the interaction data to the target application system when it is determined based on the user fixed data in the interaction data that the user has access rights to the target application system have been described in the above embodiments and will not be repeated here.

[0088] This embodiment, after receiving interaction data from a client for a target application system, adds a fixed user identifier corresponding to the client to the interaction data, and sends the interaction data with the fixed user identifier added to the first gateway, so that the first gateway can perform access rights authentication based on the fixed user identifier in the interaction data. This eliminates the need for the user to manually enter login information such as a login account and password for access rights authentication. It also avoids the problem of automatic authentication based on IP addresses, which can change with factors such as Internet access methods, hindering the accuracy of access rights authentication. In this way, by automatically adding the fixed user identifier to the interaction data through the first gateway, not only can seamless authentication be achieved, but the accuracy of access rights determination when accessing the target application system can also be improved.

[0089] In addition, the present application also provides an access device for an application system, which includes a memory, a processor, and an access program for the application system stored in the memory and running on the processor. When the processor executes the access program for the application system, the steps of the access method for the application system as described above are implemented.

[0090] Optionally, the access device of the application system may be a gateway, such as a first gateway or a second gateway. The first gateway refers to a gateway device deployed before the target application system and used to manage and control the target application system's interactive data (e.g., identity authentication, traffic restriction, etc.), such as a GGSN gateway of an operator's mobile network; the second gateway refers to a gateway device deployed before the first gateway and used to identify the user identity of the interactive data sent by the client, such as a transparent gateway.

[0091] In one embodiment, referring to Figure 5 The access device 100 of the application system may include: a first receiving module 10, an acquisition module 20 and a first sending module 30, wherein:

[0092] A first receiving module 10 is configured to receive interaction data of a target application system forwarded by a second gateway, wherein the second gateway adds a fixed user identifier to the interaction data sent by the client and forwards the interaction data with the fixed user identifier to the first gateway;

[0093] An acquisition module 20 is configured to acquire a user fixed identifier from the interaction data;

[0094] The first sending module 30 is configured to send the interaction data to the target application system when it is determined that the user has access rights to the target application system according to the fixed user identifier.

[0095] In one embodiment, referring to Figure 6The access device 100 of the application system may include: a second receiving module 40, an adding module 50 and a second sending module 60, wherein:

[0096] The second receiving module 40 is used to receive the target application system interaction data sent by the client;

[0097] An adding module 50, configured to add a fixed user identifier corresponding to the client to the interaction data;

[0098] The second sending module 60 is used to send the interaction data after adding the user fixed identifier to the first gateway, wherein the first gateway receives the interaction data of the target application system forwarded by the second gateway, obtains the user fixed identifier in the interaction data, and sends the interaction data to the target application system when it is determined that the user has access rights to the target application system based on the user fixed identifier.

[0099] It should be noted that the various embodiments of the access device 100 of the application system are basically the same as the various embodiments of the access method of the above-mentioned application system, and will not be described in detail here.

[0100] In addition, an embodiment of the present invention further provides a readable storage medium, on which an access program of an application system is stored. When the access program of the application system is executed by a processor, the steps of the above-mentioned method for accessing the application system are implemented.

[0101] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or system comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or system. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or system comprising the element.

[0102] The serial numbers of the above embodiments of the present invention are for description only and do not represent the advantages or disadvantages of the embodiments.

[0103] Those skilled in the art can clearly understand the above-mentioned embodiment method can be realized by means of software and the necessary general hardware platform, of course, also can be through hardware, but in many cases the former is the better embodiment. Based on such understanding, the technical solutions of the present application essentially or say the part of the prior art contribution can be embodied in the form of software products, the computer software product is stored in a storage medium (such as ROM / RAM, magnetic disc, optical disc) as described above, including a number of instructions to make a terminal device (may be a mobile phone, computer, server, television, or network equipment, etc.) executes the method described in various embodiments of the present application.

[0104] The above is only the preferred embodiment of the present application, not therefore limit the patent scope of the present application, any equivalent structure or equivalent flow transformation made by using the content of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A method for accessing an application system, characterized in that: Applied to the first gateway, the access method of the application system includes the following steps: receiving interaction data of a target application system forwarded by a second gateway, wherein the second gateway adds a fixed user identifier to the interaction data sent by the client, and forwards the interaction data with the fixed user identifier added to the first gateway; Obtaining a fixed user identifier in the interaction data, wherein when the interaction data is transmitted based on the HTTPS protocol, the fixed user identifier is in a secure socket protocol handshake message of the interaction data, and the first gateway obtains the fixed user identifier based on the secure socket protocol handshake message; If the interaction data is abnormal, the interaction data is intercepted, and the user who sent the interaction data is tracked according to the fixed user identifier, wherein the abnormality detection of the interaction data and the determination of the access rights to the target application system are performed simultaneously; When it is determined that the user has access rights to the target application system according to the fixed user identifier, the interaction data is sent to the target application system.

2. The method for accessing an application system according to claim 1, wherein: After the step of obtaining the user fixed identifier in the interaction data, the method further includes: It is determined whether the fixed user identifier matches a preset fixed user identifier in a whitelist associated with the target application system, wherein when the fixed user identifier does not match the preset fixed user identifier, it is determined that the user does not have access rights to the target application system.

3. The method for accessing an application system according to claim 2, wherein: Before the step of determining whether the fixed user identifier matches a preset fixed user identifier in the whitelist associated with the target application system, the method further includes: receiving an updated whitelist sent by the target application system, and using the updated whitelist as the whitelist associated with the target application system; or An update management operation of a whitelist is received, and the whitelist associated with the target application system is updated according to the update management operation.

4. The method for accessing an application system according to claim 1, wherein: After the step of obtaining the user fixed identifier in the interaction data, the method further includes: If there is no abnormality in the interaction data, then when it is determined that the user has access rights to the target application system according to the fixed user identifier, the step of sending the interaction data to the target application system is performed.

5. The method for accessing an application system according to claim 1, wherein: After the step of obtaining the user fixed identifier in the interaction data, the method further includes: When it is determined according to the fixed user identifier that the user does not have the access authority to the target application system, the interactive data is intercepted, and a prompt message indicating access failure is sent to the client that sent the interactive data.

6. A method for accessing an application system, characterized in that: Applied to the second gateway, the access method of the application system includes the following steps: Receive interaction data of the target application system sent by the client; Adding a fixed user identifier corresponding to the client to the interaction data, wherein if the interaction data is transmitted based on the HTTPS protocol, the fixed user identifier is added to a secure socket protocol handshake message of the interaction data; The interaction data after adding the user fixed identifier is sent to the first gateway, wherein the first gateway receives the interaction data of the target application system forwarded by the second gateway, obtains the user fixed identifier in the interaction data, and when it is determined that the user has access rights to the target application system based on the user fixed identifier, sends the interaction data to the target application system. If there is an abnormality in the interaction data, the first gateway intercepts the interaction data and tracks the user who sent the interaction data based on the user fixed identifier.

7. The method for accessing an application system according to claim 6, wherein: The step of adding the user fixed identifier corresponding to the client to the interaction data includes: If the interactive data is transmitted based on a plain text protocol, the user fixed identifier is added to the message header of the interactive data.

8. A gateway, characterized in that: The gateway includes a memory, a processor, and an access program of the application system stored in the memory and running on the processor. When the processor executes the access program of the application system, the steps of the application system access method according to any one of claims 1 to 7 are implemented.

9. An access device for an application system, characterized in that: The access device of the application system includes a first receiving module, an acquiring module and a first sending module, wherein: The first receiving module is configured to receive interaction data of a target application system forwarded by a second gateway, wherein the second gateway adds a fixed user identifier to the interaction data sent by the client, and forwards the interaction data with the fixed user identifier to the first gateway; The acquisition module is configured to acquire a fixed user identifier in the interaction data, wherein when the interaction data is transmitted based on the HTTPS protocol, the fixed user identifier is in a secure socket protocol handshake message of the interaction data, and the first gateway acquires the fixed user identifier based on the secure socket protocol handshake message; The first sending module is configured to send the interaction data to the target application system when it is determined that the user has access rights to the target application system according to the fixed user identifier; Alternatively, the access device of the application system includes a second receiving module, an adding module and a second sending module, wherein: The second receiving module is used to receive the interaction data of the target application system sent by the client; The adding module is configured to add a fixed user identifier corresponding to the client to the interaction data, wherein if the interaction data is transmitted based on the HTTPS protocol, the fixed user identifier is added to a secure socket protocol handshake message of the interaction data; The second sending module is used to send the interaction data after adding the user fixed identifier to the first gateway, wherein the first gateway receives the interaction data of the target application system forwarded by the second gateway, obtains the user fixed identifier in the interaction data, and sends the interaction data to the target application system when it is determined that the user has access rights to the target application system based on the user fixed identifier. If there is an abnormality in the interaction data, the first gateway intercepts the interaction data and tracks the user who sent the interaction data based on the user fixed identifier.

10. A readable storage medium, characterized in that: The readable storage medium stores an access program of the application system, and when the access program of the application system is executed by the processor, the steps of the application system access method according to any one of claims 1 to 7 are implemented.

Images