Authentication method and device for access request, electronic device, and storage medium

Abstract

The application discloses an authentication method and device for access request, electronic equipment and a storage medium. The method comprises the following steps: obtaining a webpage access request, wherein the webpage access request is generated by a third-party system, and the third-party system is embedded into a target operating system through a proxy address; authenticating the webpage access request according to system configuration information to obtain an authentication result; returning a request data set corresponding to the webpage access request in the case that the authentication result indicates that the authentication is passed; and confirming authentication failure and issuing an error prompt information in the case that the authentication result indicates that the authentication is not passed. The application solves the technical problem that the existing web service system is incomplete, the authentication of the external third-party system cannot be realized when multi-system authentication is performed, and the security of the target system cannot be ensured.

Description

Technical Field

[0001] This invention relates to the field of Internet technology, and more specifically, to an authentication method and apparatus for access requests, an electronic device, and a storage medium. Background Technology

[0002] With the development of internet technology, more and more companies and enterprises are investing in software and web development. A complete web system typically includes multiple sub-business systems or external third-party systems. Multi-system authentication is a challenge in system integration. The common solution in existing technologies is through single sign-on or authentication through user service systems. However, this only solves the integration of internal third-party systems and is not applicable to external third-party systems. In addition, the uncertainty of third-party systems can also lead to security issues in the target system.

[0003] In the prior art, CN108040090A discloses a method for integrating multiple Web systems, which integrates multiple Web systems through single sign-on and solves the problem of multi-system integration with minimal manpower. However, this solution has the following drawbacks: First, the user information of the subsystem needs to be consistent with that of the target system, and the permissions of the subsystem cannot be controlled independently; Second, the real IP address of the subsystem is exposed, and the subsystem can be accessed directly in other environments; Third, the subsystem can only be an internal system and cannot be controlled by external third-party systems.

[0004] There is currently no effective solution to the above problems. Summary of the Invention

[0005] This invention provides an authentication method, apparatus, electronic device, and storage medium for access requests, to at least solve the technical problems in the prior art where Web business systems are incomplete, unable to authenticate external third-party systems when performing multi-system authentication, and unable to guarantee the security of the target system.

[0006] According to one aspect of the present invention, an authentication method for access requests is provided, applied to an authentication device of a target operating system, the target operating system integrating multiple business subsystems, including: acquiring a webpage access request, wherein the webpage access request is generated by a third-party system, the third-party system being embedded in the target operating system through a proxy address; authenticating the webpage access request according to system configuration information to obtain an authentication result; if the authentication result indicates successful authentication, returning a request data set corresponding to the webpage access request; if the authentication result indicates unsuccessful authentication, confirming authentication failure and issuing an error message.

[0007] Optionally, the type of the third-party system includes at least: an internal business subsystem with source code, wherein, when the type of the third-party system is the internal business subsystem with source code, a proxy address that can access the internal business subsystem is determined; user information, permission mapping relationship, and accessible network protocols of the internal business subsystem are configured to obtain the system configuration information.

[0008] Optionally, after obtaining the system configuration information, the method further includes: the internal business subsystem receiving a system access request from the target operating system, wherein the system access request carries at least: user information of the current user; the internal business subsystem parsing the system access request to obtain the user information; and rendering the system function page of the internal business subsystem based on the user information.

[0009] Optionally, the type of the third-party system further includes: an external third-party subsystem without source code, wherein, when the type of the external third-party subsystem is the external third-party subsystem without source code, a proxy address that can access the external third-party subsystem is configured; network request permissions that can access the external third-party subsystem are configured to obtain the system configuration information.

[0010] Optionally, the step of obtaining a webpage access request includes: using a virtual interceptor to intercept the request initiated by the third-party system to obtain the webpage access request.

[0011] Optionally, after obtaining the webpage access request, the method further includes: determining whether the current user's login token has expired; if the login token has expired, confirming the request failure and redirecting to the login page; if the login token has not expired, performing a request authentication operation.

[0012] Optionally, the third-party system includes at least one of the following: a weather forecast system, an information query system, a library management system, and a sports system.

[0013] According to another aspect of the present invention, an authentication device for access requests is also provided, applied to an authentication device of a target operating system, the target operating system integrating multiple business subsystems, including: an acquisition unit, configured to acquire a webpage access request, wherein the webpage access request is generated by a third-party system, the third-party system being embedded in the target operating system through a proxy address; an authentication unit, configured to authenticate the webpage access request according to system configuration information and obtain an authentication result; a return unit, configured to return a request data set corresponding to the webpage access request if the authentication result indicates successful authentication; and a confirmation unit, configured to confirm authentication failure and issue an error message if the authentication result indicates unsuccessful authentication.

[0014] Optionally, the type of the third-party system includes at least: an internal business subsystem with source code, and the acquisition unit includes: a first determining module, used to determine the proxy address that can access the internal business subsystem when the type of the third-party system is the internal business subsystem with source code; and a first configuration module, used to configure the user information, permission mapping relationship, and accessible network protocols of the internal business subsystem to obtain the system configuration information.

[0015] Optionally, the first configuration module includes: a first receiving submodule, used by the internal business subsystem to receive a system access request from the target operating system, wherein the system access request carries at least: user information of the current user; a first parsing submodule, used by the internal business subsystem to parse the system access request to obtain the user information; and a first rendering submodule, used to render the system function page of the internal business subsystem based on the user information.

[0016] Optionally, the type of the third-party system further includes: an external third-party subsystem without source code, and the acquisition unit further includes: a second configuration module, used to configure a proxy address that can access the external third-party subsystem when the type of the external third-party subsystem is the external third-party subsystem without source code; and a third configuration module, used to configure network request permissions that can access the external third-party subsystem to obtain the system configuration information.

[0017] Optionally, the acquisition unit further includes: a first interception module, used to intercept the request initiated by the third-party system using a virtual interceptor to obtain the webpage access request.

[0018] Optionally, the authentication device for the access request further includes: a judgment module for judging whether the usage time of the current user's login token has expired; a first confirmation module for confirming the failure of the login request and redirecting to the login page if the login token's login time has expired; and an execution module for performing the authentication request operation if the login token's login time has not expired.

[0019] Optionally, the third-party system includes at least one of the following: a weather forecast system, an information query system, a library management system, and a sports system.

[0020] According to another aspect of the present invention, an electronic device is also provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform an authentication method for an access request as described above by executing the executable instructions.

[0021] According to another aspect of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the authentication method for the access request described in any one of the above embodiments.

[0022] This application employs the following steps to obtain a webpage access request, wherein the webpage access request is generated by a third-party system embedded in the target operating system through a proxy address; the webpage access request is authenticated according to system configuration information to obtain an authentication result; if the authentication result indicates successful authentication, a request data set corresponding to the webpage access request is returned; if the authentication result indicates failed authentication, authentication failure is confirmed and an error message is issued. This application configures the third-party system information through a proxy address, precisely controlling the third-party system's permissions, ensuring that the real address of the third-party system is not leaked, and providing configurable authentication rules. Authentication of webpage access requests is implemented based on system configuration information, allowing for flexible application to various third-party systems and control over their requests, thereby ensuring the security of the target system. This solves the technical problem in existing technologies where incomplete web business systems cannot achieve authentication of external third-party systems during multi-system authentication, and the security of the target system cannot be guaranteed.

[0023] In this application, a unified authentication scheme is used to not only control the authentication of various internal business subsystems, but also to verify the permissions of external third-party systems. This allows multiple systems, including external third-party systems without source code, to access each other without repeated logins. By intercepting requests from third-party systems through the target system, the validity of user access throughout the entire system (integrated system and subsystems) is ensured to be consistent, and network requests from third-party systems are restricted, thereby ensuring the security of the target system. Attached Figure Description

[0024] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0025] Figure 1 This is a schematic diagram of an access request authentication method according to an embodiment of the present invention;

[0026] Figure 2 This is a flowchart of an optional access request authentication method proposed according to an embodiment of the present invention;

[0027] Figure 3 This is an architecture diagram of an optional access request authentication system proposed according to an embodiment of the present invention;

[0028] Figure 4 This is a schematic diagram of an optional access request authentication device according to an embodiment of the present invention;

[0029] Figure 5 This is a hardware structure block diagram of an electronic device (or mobile device) according to an embodiment of the present invention for an authentication method of an access request. Detailed Implementation

[0030] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0031] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0032] To facilitate understanding of the present invention by those skilled in the art, some terms or nouns involved in the various embodiments of the present invention are explained below:

[0033] Web system: an abbreviation for World Wide Web, is a network service built on the Internet. Based on hypertext and the HTTP protocol, it provides a graphical, easy-to-access, and intuitive interface for users to find and browse information on the Internet.

[0034] A proxy address is an intermediary platform in the process of accessing the Internet. The user's terminal first accesses the proxy address, and then the proxy address accesses the web page. The access record of the page records the proxy address, not the user's local IP address.

[0035] A token is a value / virtual module used to determine a user's login status. After a user successfully logs in, the backend (server-side) generates a unique value based on the user's information; this value is the login token. The principle of accessing the network via tokens is "only those with a token can send messages." By transmitting unique tokens across the network, ordered and contention-free network access is achieved.

[0036] Source code is an uncompiled text file written according to certain programming language specifications, which translates readable text into binary instructions that a computer can execute.

[0037] The Uniform Resource Locator (URL) is a method used in World Wide Web services on the Internet to specify the location of information.

[0038] Transmission Control Protocol (TCP) is a connection-oriented, reliable, byte-stream-based transport layer communication protocol.

[0039] The Hypertext Transfer Protocol, or HTTP for short, is a simple request-response protocol that uses text format.

[0040] The Internet Protocol, or IP protocol for short, is a network layer protocol in the TCP / IP architecture. It improves network scalability and provides hosts with a connectionless, unreliable, best-effort data packet transmission service.

[0041] The User Datagram Protocol (UDP) provides an application with a method to send encapsulated IP packets without establishing a connection.

[0042] This invention can be applied to authentication systems / products / devices for various access requests. By configuring information of third-party systems through proxy addresses, it can accurately control the permissions of third-party systems, ensure that the real addresses of third-party systems are not disclosed, and the authentication rules are configurable and can be flexibly applied to various third-party systems to control their requests, thereby ensuring the security of the target system.

[0043] The present invention will now be described in detail with reference to various embodiments.

[0044] Example 1

[0045] According to an embodiment of the present invention, an authentication method for access requests is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0046] Figure 1 This is a schematic diagram of an access request authentication method according to an embodiment of the present invention, as shown below. Figure 1 As shown, the method includes the following steps:

[0047] Step S102: Obtain a webpage access request, wherein the webpage access request is generated by a third-party system, and the third-party system is embedded into the target operating system through a proxy address;

[0048] Step S104: Authenticate the webpage access request according to the system configuration information and obtain the authentication result;

[0049] Step S106: If the authentication result indicates that the authentication is successful, return the request data set corresponding to the webpage access request;

[0050] Step S108: If the authentication result indicates that the authentication has failed, confirm the authentication failure and issue an error message.

[0051] Through the above steps, a webpage access request is obtained. This request is generated by a third-party system, which is embedded in the target operating system via a proxy address. The webpage access request is authenticated based on system configuration information, and an authentication result is obtained. If the authentication result indicates successful authentication, the request data set corresponding to the webpage access request is returned. If the authentication result indicates failed authentication, the authentication failure is confirmed, and an error message is issued. In this embodiment, by configuring the third-party system information through a proxy address, the permissions of the third-party system are precisely controlled, ensuring that the real address of the third-party system is not leaked. Furthermore, the authentication rules are configurable and can be flexibly applied to various third-party systems to control their requests, thereby ensuring the security of the target system. This solves the technical problem in existing technologies where incomplete web business systems cannot achieve authentication of external third-party systems during multi-system authentication, and the security of the target system cannot be guaranteed.

[0052] The following section will explain in detail each of the above implementation steps.

[0053] Step S102: Obtain a webpage access request, wherein the webpage access request is generated by a third-party system, which is embedded into the target operating system through a proxy address.

[0054] It should be noted that the aforementioned web page access requests can be generated by third-party systems such as user terminals / user web / enterprise terminals. There can be one or more such web page access requests, and there is no limitation on the request type (such as HTTP request). The target system can be deployed on user terminals / user web / enterprise terminals to authenticate users after receiving web page access requests.

[0055] The access request authentication involved in this embodiment aims to address the problems in existing technologies, such as the inability to integrate external third-party systems and the inability to guarantee the security of the target system. By configuring the information of the third-party system through the proxy address, the permissions of the third-party system can be precisely controlled, ensuring that the real address of the third-party system is not disclosed. Furthermore, the authentication rules are configurable and can be flexibly applied to various third-party systems to control the requests of the third-party system, thereby ensuring the security of the target system.

[0056] The access request authentication involved in this embodiment uses a unified authentication scheme to not only control the authentication of internal subsystems, but also to realize the permission verification of external third-party systems. This allows multiple business subsystems, including external third-party subsystems without source code, to access each other without repeated logins. By intercepting requests from third-party systems through the target system, the validity of user access throughout the entire system (integrated system and subsystems) is ensured to be consistent, and network requests from third-party systems are restricted, thus enabling the target system to access third-party systems.

[0057] The target system integrates two types of third-party systems: internal business subsystems with source code and external third-party subsystems without source code. These two types of third-party systems will be described below.

[0058] In this embodiment of the invention, the type of third-party system includes at least: an internal business subsystem with source code. In the case that the type of third-party system is an internal business subsystem with source code, the proxy address that can access the internal business subsystem is determined; the user information, permission mapping relationship, and accessible network protocol of the internal business subsystem are configured to obtain system configuration information.

[0059] The user information includes, but is not limited to: user name, user IP address, user login device, and user login time; the permission mapping relationship is the correspondence between the target system and various business subsystems; the accessible network protocols include, but are not limited to: HTTP protocol, IP protocol, TCP protocol, and UDP protocol. This embodiment uses the HTTP protocol for illustration.

[0060] In this embodiment of the invention, after obtaining the system configuration information, the method further includes: the internal business subsystem receiving a system access request from the target operating system, wherein the system access request carries at least: the user information of the current user; the internal business subsystem parsing the system access request to obtain the user information; and rendering the system function page of the internal business subsystem based on the user information.

[0061] For internal business subsystems, it is necessary to configure information such as the business subsystem access address (proxy address), user information, permission mapping (target system-subsystem) relationship, and accessible network protocols. When the target system accesses the business subsystem, the configuration information is passed into the business subsystem and the page is rendered.

[0062] In this embodiment of the invention, the type of third-party system further includes: an external third-party subsystem without source code. In the case where the type of external third-party subsystem is an external third-party subsystem without source code, a proxy address that can access the external third-party subsystem is configured; network request permissions that can access the external third-party subsystem are configured to obtain system configuration information.

[0063] In this embodiment, for external third-party subsystems, access addresses and network request permissions need to be configured before normal access to the third-party subsystems can be achieved.

[0064] The aforementioned external third-party subsystem is embedded into the target system through a proxy address. Thus, whenever the third-party subsystem needs to send a request or other subsystems need to send a request to the external third-party subsystem, the user token verification and configuration information authentication must be performed through the target system. Only when the authentication is successful will the target system forward the request.

[0065] In this embodiment of the invention, in addition to controlling the authentication of internal business subsystems, permission verification of external third-party subsystems can also be implemented, and the authentication rules are configurable and can be flexibly applied to various third-party systems.

[0066] In this embodiment of the invention, a virtual interceptor is used to intercept requests initiated by a third-party system to obtain webpage access requests.

[0067] In this embodiment of the invention, after obtaining the webpage access request, the method further includes: determining whether the current user's login token usage time has expired; if the login token's login time has expired, confirming the request failure and redirecting to the login page; if the login token's login time has not expired, performing the request authentication operation.

[0068] It should be noted that if the login token times out, in addition to confirming the failure of the request, a request failure message can also be returned, the web page access request initiated by the third-party system will not be forwarded, and the user will be directly redirected to the login page to re-authenticate.

[0069] Step S104: Authenticate the webpage access request based on the system configuration information and obtain the authentication result.

[0070] Step S106: If the authentication result indicates that the authentication is successful, return the request data set corresponding to the webpage access request.

[0071] In this embodiment, the database or the corresponding system can be called or the request data, data type or operation result can be obtained based on the specific request data, data type and operation instruction content of the webpage access request, thus obtaining a request data set.

[0072] Step S108: If the authentication result indicates that the authentication has failed, confirm the authentication failure and issue an error message.

[0073] It should be noted that if the authentication result indicates that the authentication failed, in addition to confirming the authentication failure, you can also confirm that the request will not be forwarded and that the login token timeout will not be updated.

[0074] In this embodiment of the invention, the system type included in the specific third-party system is not limited. The third-party system includes at least one of the following: weather forecast system, information query system, library management system, and sports system. Each system can be understood as the aforementioned external third-party subsystem.

[0075] The aforementioned third-party systems include, but are not limited to, weather forecasting systems, information query systems, library management systems, and sports systems. For example, when a system needs to integrate a third-party weather forecasting system, directly embedding this system into the target system would make it impossible to control the weather forecasting system's behavior, posing a security risk. In this case, the aforementioned access request authentication method is needed. This involves configuring a proxy address for the weather forecasting system, configuring accessible requests, and then accessing the system through the proxy address. The target system can access the weather forecasting system and intercept all requests within it, forwarding only legitimate requests, thus ensuring the security of the target system to a certain extent.

[0076] Figure 2 This is a flowchart of an optional access request authentication method proposed according to an embodiment of the present invention, such as... Figure 2 As shown, after the third-party system is embedded into the target system, the operation permissions are uniformly managed by the target system. The authentication process of the third-party system is as follows:

[0077] Step 1: Begin;

[0078] Step 2: The target system uses a proxy address to access the third-party system;

[0079] Step 3: Determine if the third-party system has the source code; if it does, proceed to step 4; if it does not, proceed to step 5.

[0080] Step 4: For third-party systems with source code (corresponding to the aforementioned internal subsystems with source code), the third-party system parses user information and renders the page;

[0081] Step 5: For third-party systems without source code (corresponding to the aforementioned external third-party systems without source code), render the third-party system;

[0082] Step 6: The third-party system initiates an HTTP request;

[0083] Step 7: The target system intercepts the current HTTP request;

[0084] Step 9: Has the login token expired? If yes, proceed to step 10; otherwise, proceed to step 11.

[0085] Step 10: Do not forward the current request, and redirect to the login page to proceed to Step 15;

[0086] Step 11: The target system performs authentication based on the configuration of the third-party system;

[0087] Step 12: Determine if the authentication is successful; if yes, proceed to step 13; otherwise, proceed to step 14.

[0088] Step 13: The target system forwards the request and updates the timeout of the login token, then proceeds to step 15;

[0089] Step 14: Forward the request, do not update the login token timeout, and then proceed to Step 15;

[0090] Step 15: End.

[0091] In this embodiment of the invention, the target system accesses a third-party system using a proxy address. The third-party system initiates an HTTP request. The target system intercepts the current HTTP request and determines whether the current user's login has timed out. If the user's login time has expired, the request is not forwarded, and the user is redirected to the login page. If the user is still within the login validity period, the authentication module performs authentication processing on the current request. If authentication fails, the request is not forwarded, and the user's timeout is not updated. If authentication succeeds, the request is forwarded, and the user's timeout is updated. This series of steps ensures that user operation permissions are uniformly managed by the target system, achieving consistency and configurability of user permissions between the target system and the third-party system. It also guarantees that the user timeout time of the subsystem is consistent with that of the target system, preventing situations where the subsystem can access the system but the target system cannot.

[0092] Figure 3 This is an architecture diagram of an optional access request authentication system proposed according to an embodiment of the present invention, such as... Figure 3 As shown, the third-party system is embedded into the target system through a proxy address. The target system and the third-party system establish a connection through an authentication and authorization mechanism, enabling the target system to access the third-party system. The access process is as follows:

[0093] First, the target system administrator configures the third-party system information, including access address, user permission mapping relationship, network protocol, etc., and generates a proxy address for the third-party system through these configurations;

[0094] After logging in, users access third-party systems using a proxy address;

[0095] The internal third-party system parses the URL to obtain the current user information and renders the page (if it is an external third-party system, the page is rendered directly).

[0096] The third-party system initiates an HTTP request;

[0097] The target system intercepts HTTP requests from third-party systems;

[0098] Based on the configuration information from the first step, the target system determines whether the current user request is legitimate. If the request is legitimate, it returns the actual result, and the authentication and authorization device returns the address of the third-party system after proxying to enable the target system to access the third-party system. If the request is illegitimate, it displays an error message.

[0099] The above implementation method configures the information of the third-party system through the proxy address, accurately controls the permissions of the third-party system, ensures that the real address of the third-party system is not disclosed, and the authentication rules are configurable and can be flexibly applied to various third-party systems to control the requests of the third-party system, thereby ensuring the security of the target system. This solves the technical problem in the prior art that the Web business system is incomplete and cannot realize the authentication of external third-party systems when performing multi-system authentication, and cannot guarantee the security of the target system.

[0100] The invention will now be described in conjunction with another alternative embodiment.

[0101] Example 2

[0102] This embodiment provides an authentication device for access requests, wherein each implementation unit included in the authentication device corresponds to each implementation step in Embodiment 1.

[0103] Figure 4 This is a schematic diagram of an optional access request authentication device according to an embodiment of the present invention, such as... Figure 4 As shown, it includes: an acquisition unit 40, an authentication unit 42, a return unit 44, and a determination unit 46, wherein,

[0104] The acquisition unit 40 is used to acquire web page access requests, wherein the web page access requests are generated by a third-party system, which is embedded into the target operating system through a proxy address.

[0105] It should be noted that the aforementioned web page access requests can be generated by third-party systems such as user terminals / user web / enterprise terminals. There can be one or more such web page access requests, and there is no limitation on the request type (such as HTTP request). The target system can be deployed on user terminals / user web / enterprise terminals to authenticate users after receiving web page access requests.

[0106] The access request authentication involved in this embodiment aims to address the problems in existing technologies, such as the inability to integrate external third-party systems and the inability to guarantee the security of the target system. By configuring the information of the third-party system through the proxy address, the permissions of the third-party system can be precisely controlled, ensuring that the real address of the third-party system is not disclosed. Furthermore, the authentication rules are configurable and can be flexibly applied to various third-party systems to control the requests of the third-party system, thereby ensuring the security of the target system.

[0107] The access request authentication involved in this embodiment uses a unified authentication scheme to not only control the authentication of internal subsystems, but also to realize the permission verification of external third-party systems. This allows multiple business subsystems, including external third-party subsystems without source code, to access each other without repeated logins. By intercepting requests from third-party systems through the target system, the validity of user access throughout the entire system (integrated system and subsystems) is ensured to be consistent, and network requests from third-party systems are restricted, thus enabling the target system to access third-party systems.

[0108] Among them, the target system integrates two types of third-party systems: one is an internal business subsystem with source code, and the other is an external third-party subsystem without source code.

[0109] The authentication unit 42 is used to authenticate web page access requests based on system configuration information and obtain authentication results.

[0110] The system configuration information is generated based on user information, permission mapping relationships, and accessible network protocols used by the internal business subsystems. User information includes, but is not limited to, user name, user IP address, user login device, and user login time. The permission mapping relationship is the relationship between the target system and the subsystem.

[0111] Return unit 44 is used to return the request data set corresponding to the web page access request if the authentication result indicates that the authentication is successful.

[0112] In this embodiment, the database or the corresponding system can be called or the request data, data type or operation result can be obtained based on the specific request data, data type and operation instruction content of the webpage access request, thus obtaining a request data set.

[0113] The determining unit 46 is used to confirm the authentication failure and issue an error message when the authentication result indicates that the authentication has failed.

[0114] It should be noted that if the authentication result indicates that the authentication failed, in addition to confirming the authentication failure, you can also confirm that the request will not be forwarded and that the login token timeout will not be updated.

[0115] The authentication device for the aforementioned access request can acquire a webpage access request through the acquisition unit 40. This webpage access request is generated by a third-party system, which is embedded in the target operating system via a proxy address. The authentication unit 42 authenticates the webpage access request based on system configuration information, obtaining an authentication result. Then, the return unit 44 returns the request data set corresponding to the webpage access request if the authentication result indicates successful authentication. The determination unit 46 confirms authentication failure and issues an error message if the authentication result indicates unsuccessful authentication. In this embodiment, by configuring the third-party system information through the proxy address, the permissions of the third-party system are precisely controlled, ensuring that the real address of the third-party system is not leaked. Furthermore, the authentication rules are configurable and can be flexibly applied to various third-party systems to control their requests, thereby ensuring the security of the target system. This solves the technical problem in the prior art where incomplete web business systems cannot achieve authentication of external third-party systems during multi-system authentication, and the security of the target system cannot be guaranteed.

[0116] Optionally, the type of the third-party system includes at least: an internal business subsystem with source code, and the acquisition unit includes: a first determining module, used to determine the proxy address that can access the internal business subsystem when the type of the third-party system is an internal business subsystem with source code; and a first configuration module, used to configure the user information, permission mapping relationship, and accessible network protocols of the internal business subsystem to obtain system configuration information.

[0117] The user information includes, but is not limited to: user name, user IP address, user login device, and user login time; the permission mapping relationship is the correspondence between the target system and various business subsystems; the accessible network protocols include, but are not limited to: HTTP protocol, IP protocol, TCP protocol, and UDP protocol. This embodiment uses the HTTP protocol for illustration.

[0118] Optionally, the first configuration module includes: a first receiving submodule, used by the internal business subsystem to receive a system access request from the target operating system, wherein the system access request carries at least: user information of the current user; a first parsing submodule, used by the internal business subsystem to parse the system access request and obtain the user information; and a first rendering submodule, used to render the system function page of the internal business subsystem based on the user information.

[0119] For internal business subsystems, it is necessary to configure information such as the business subsystem access address (proxy address), user information, permission mapping (target system-subsystem) relationship, and accessible network protocols. When the target system accesses the business subsystem, the configuration information is passed into the business subsystem and the page is rendered.

[0120] Optionally, the type of third-party system also includes: external third-party subsystems without source code, and the acquisition unit further includes: a second configuration module, used to configure a proxy address that can access the external third-party subsystem when the type of external third-party subsystem is an external third-party subsystem without source code; and a third configuration module, used to configure network request permissions that can access the external third-party subsystem and obtain system configuration information.

[0121] In this embodiment, for external third-party subsystems, access addresses and network request permissions need to be configured before normal access to the third-party subsystems can be achieved.

[0122] The aforementioned external third-party subsystem is embedded into the target system through a proxy address. Thus, whenever the third-party subsystem needs to send a request or other subsystems need to send a request to the external third-party subsystem, the user token verification and configuration information authentication must be performed through the target system. Only when the authentication is successful will the target system forward the request.

[0123] In this embodiment of the invention, in addition to controlling the authentication of internal business subsystems, permission verification of external third-party subsystems can also be implemented, and the authentication rules are configurable and can be flexibly applied to various third-party systems.

[0124] Optionally, the acquisition unit further includes: a first interception module, used to intercept requests initiated by a third-party system using a virtual interceptor to obtain web page access requests.

[0125] Optionally, the authentication device for the access request further includes: a judgment module for judging whether the usage time of the current user's login token has expired; a first confirmation module for confirming the failure of the login request and redirecting to the login page if the login token's login time has expired; and an execution module for executing the authentication request operation if the login token's login time has not expired.

[0126] It should be noted that if the login token times out, in addition to confirming the failure of the request, a request failure message can also be returned, the web page access request initiated by the third-party system will not be forwarded, and the user will be directly redirected to the login page to re-authenticate.

[0127] Optionally, the third-party system includes at least one of the following: weather forecast system, information query system, library management system, and sports system.

[0128] In this embodiment of the invention, the system type included in the specific third-party system is not limited. The third-party system includes at least one of the following: weather forecast system, information query system, library management system, and sports system. Each system can be understood as the aforementioned external third-party subsystem.

[0129] The aforementioned third-party systems include, but are not limited to, weather forecasting systems, information query systems, library management systems, and sports systems. For example, when a system needs to integrate a third-party weather forecasting system, directly embedding this system into the target system would make it impossible to control the weather forecasting system's behavior, posing a security risk. In this case, the aforementioned access request authentication method is needed. This involves configuring a proxy address for the weather forecasting system, configuring accessible requests, and then accessing the system through the proxy address. The target system can access the weather forecasting system and intercept all requests within it, forwarding only legitimate requests, thus ensuring the security of the target system to a certain extent.

[0130] The aforementioned authentication device for access requests may also include a processor and a memory. The aforementioned acquisition unit 40, authentication unit 42, return unit 44, determination unit 46, etc., are all stored in the memory as program units, and the processor executes the aforementioned program units stored in the memory to realize the corresponding functions.

[0131] The aforementioned processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured to access third-party system information via proxy addresses, precisely controlling third-party system permissions, ensuring the real addresses of third-party systems are not leaked, and providing configurable authentication rules for flexible application to various third-party systems. This allows control over requests from third-party systems, enabling the target system to access them.

[0132] The aforementioned memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0133] According to another aspect of the present invention, an electronic device is also provided, including: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform an authentication method for an access request of any of the above via executing the executable instructions.

[0134] According to another aspect of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored computer program, wherein, when the computer program is running, an authentication method for controlling the device where the computer-readable storage medium is located to execute the access request of any of the above-mentioned methods is provided.

[0135] This application also provides a computer program product, which, when executed on a data processing device, is suitable for executing an initialization program having the following method steps: obtaining a web page access request, wherein the web page access request is generated by a third-party system, and the third-party system is embedded in the target operating system through a proxy address; authenticating the web page access request according to system configuration information and obtaining an authentication result; if the authentication result indicates that the authentication has passed, returning a request data set corresponding to the web page access request; if the authentication result indicates that the authentication has failed, confirming the authentication failure and issuing an error message.

[0136] Figure 5 This is a hardware structure block diagram of an electronic device (or mobile device) according to an embodiment of the present invention for an authentication method of an access request. Figure 5 As shown, the electronic device may include one or more processors 502 (shown as 502a, 502b, ..., 502n in the figure) 502 (processor 502 may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 504 for storing data. In addition, it may include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, a keyboard, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 5 The structure shown is for illustrative purposes only and does not limit the structure of the electronic device described above. For example, the electronic device may also include components that are more... Figure 5 The more or fewer components shown, or having the same Figure 5 The different configurations shown.

[0137] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0138] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0139] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some interfaces; indirect couplings or communication connections between units or modules may be electrical or other forms.

[0140] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0141] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0142] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0143] The above are merely preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for authenticating access requests, characterized in that, An authentication device applied to a target operating system, which integrates multiple business subsystems, including: Obtain a webpage access request, wherein the webpage access request is generated by a third-party system, and the third-party system is embedded into the target operating system through a proxy address. The types of the third-party system include at least: internal business subsystems with source code and external third-party subsystems without source code. In the case where the third-party system is an internal business subsystem with source code, determine the proxy address that can access the internal business subsystem; configure the user information, permission mapping relationship, and accessible network protocols for using the internal business subsystem to obtain system configuration information; In the case where the type of the third-party system is the external third-party subsystem without source code, configure a proxy address that can access the external third-party subsystem; configure network request permissions that can access the external third-party subsystem, and obtain the system configuration information; The webpage access request is authenticated based on the system configuration information, and the authentication result is obtained; If the authentication result indicates that the authentication was successful, return the request data set corresponding to the webpage access request; If the authentication result indicates that the authentication has failed, the authentication failure will be confirmed and an error message will be issued.

2. The authentication method according to claim 1, characterized in that, After obtaining the system configuration information, the following is also included: The internal business subsystem receives a system access request from the target operating system, wherein the system access request carries at least: the user information of the current user; The internal business subsystem parses the system access request to obtain the user information; Based on the user information, the system function page of the internal business subsystem is rendered.

3. The authentication method according to claim 1, characterized in that, The steps to obtain a webpage access request include: A virtual interceptor is used to intercept the requests initiated by the third-party system to obtain the webpage access requests.

4. The authentication method according to claim 1, characterized in that, After obtaining the webpage access request, it also includes: Determine if the current user's login token has expired. If the login token times out, the confirmation request fails and the user is redirected to the login page. If the login token's login duration has not expired, perform a request authentication operation.

5. The authentication method according to any one of claims 1 to 4, characterized in that, The third-party system includes at least one of the following: weather forecast system, information query system, library management system, and sports system.

6. A target operating system authentication device for access request authentication, characterized in that, The target operating system integrates multiple business subsystems, including: The acquisition unit is used to acquire web page access requests, wherein the web page access requests are generated by a third-party system, and the third-party system is embedded in the target operating system through a proxy address. The types of the third-party system include at least: internal business subsystems with source code and external third-party subsystems without source code. The acquisition unit includes: a first determining module, configured to determine, when the type of the third-party system is the internal business subsystem with source code, a proxy address that can access the internal business subsystem; and a first configuration module, configured to configure user information, permission mapping relationships, and accessible network protocols for using the internal business subsystem, thereby obtaining system configuration information; The acquisition unit further includes: a second configuration module, configured to configure a proxy address that can access the external third-party subsystem when the type of the third-party system is the external third-party subsystem without source code; and a third configuration module, configured to configure network request permissions that can access the external third-party subsystem to obtain the system configuration information. The authentication unit is used to authenticate the webpage access request based on system configuration information and obtain the authentication result; The return unit is used to return the request data set corresponding to the webpage access request if the authentication result indicates that the authentication has been passed. The confirmation unit is used to confirm the authentication failure and issue an error message when the authentication result indicates that the authentication has failed.

7. An electronic device, characterized in that, include: processor; as well as Memory for storing the executable instructions of the processor; The processor is configured to execute the authentication method for the access request as described in any one of claims 1 to 5 by executing the executable instructions.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device on which the computer-readable storage medium is located to perform the authentication method for the access request as described in any one of claims 1 to 5.

Images