A dynamic permission device and a permission management method thereof
The dynamic permission system, which employs dual authentication on both the client and server sides, uses asymmetric encryption and dynamic key management to solve the security and reliability issues of the permission module in the software system, and achieves effective defense against malicious attacks and protection of user information.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- WUHAN MARITIME COMMUNICATION RESEARCH INSTITUTE
- Filing Date
- 2022-09-06
- Publication Date
- 2026-05-19
AI Technical Summary
The existing software system's permission module has poor security and reliability, making it vulnerable to malicious attackers who can obtain additional information by capturing requests and modifying the source code. Furthermore, the symmetric encryption key is fixedly stored on the client side, leading to the leakage of authentication information.
The dynamic permission system employs dual client-side and server-side authentication, including client-side and server-side permission authentication modules. It generates dynamic keys through asymmetric encryption, combines random code verification, timestamps, and trial-and-error mechanisms, and renders user permissions in real time to prevent unauthorized operations and attacks.
It improves the security and reliability of the software system, prevents the expansion and leakage of privileges, enhances the defense against malicious attacks, and ensures the protection of user information.
Smart Images
Figure CN115580433B_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of software development and application technology, and more specifically, relates to a dynamic permission device and its permission management method. Background Technology
[0002] With the increasing prevalence of various information technology applications, enterprises are becoming more reliant on software in their daily management work, leading to higher demands on the software. Among these, the requirements for system security and reliability are becoming increasingly prominent in most management software.
[0003] Currently, in most systems' permission modules, the client code only displays the permissions the client possesses, hiding those it doesn't. This method of hiding permissions allows attackers to view which permissions are hidden by reading the client's source code. By directly modifying the source code on the client side, these hidden permissions can be made visible, posing a risk of privilege escalation and leakage. Furthermore, in most systems' permission modules, the server-side doesn't intercept requests, or even if it does, it doesn't further assess or restrict the user's legitimacy or the request's rationality. Therefore, malicious attackers can repeatedly try different requests until they discover which requests the server can accept, thus obtaining additional information. Some systems use encrypted authentication on both the client and server sides, but when using symmetric encryption to transmit information, the symmetric encryption key is often fixed and stored directly on the client. By capturing requests using packet sniffing tools, authentication information can be obtained, and this authentication information can be continuously misused as long as the user's authentication password remains unchanged. Furthermore, by capturing a large number of encrypted request messages and using analysis tools, the symmetric encryption key can be reverse-engineered, allowing attackers to obtain the encrypted information. Summary of the Invention
[0004] In view of the shortcomings of the prior art, the purpose of this invention is to provide a dynamic permission system, device and permission management method, which aims to solve the problem of poor security and reliability of existing software systems.
[0005] To achieve the above objectives, in a first aspect, the present invention provides a client-side authorization system, comprising: a client-side command sending and receiving module, a client-side sentry mode operation module, a dynamic routing module, a dynamic component rendering module, a client-side password authentication module, and a command binding module;
[0006] The output of the client sending and receiving command module is connected to the input of the client-side sentry mode operation module; the input of the dynamic routing module is connected to the client, and its output is connected to the input of the dynamic component rendering module; the output of the command binding module is connected to the input of the dynamic component rendering module; the input of the client-side password authentication module is connected to the output of the client-side sentry mode operation module, and its output is connected to the server.
[0007] The client-side command sending and receiving module is used to receive or send client-side requests; the client-side sentry mode operation module is used to intercept page routes, filter out page routes that are not whitelisted and lack security password authentication and permissions, perform unified exception handling, and redirect to the login authentication page; the dynamic routing module is used to reset page routes in real time when users actively switch roles and permissions, and call the dynamic component rendering module to switch to the reset page; the dynamic component rendering module is used to render and present the page and permission buttons in real time; the command binding module is used to destroy the current button component in real time when user permissions change, and call the dynamic component rendering module to render a new button with permissions.
[0008] Secondly, the present invention provides a server-side permission authentication system, including: a server-side command sending and receiving module, a server-side sentry mode operation module, a server-side password authentication module, a permission filtering module, a duplicate request filtering module, and a malicious attack identification module.
[0009] The input of the server-side sentinel mode operation module is connected to the output of the server-side send / receive command module; the input of the permission filtering module is connected to the output of the server-side sentinel mode operation module; the input of the duplicate request filtering module is connected to the output of the permission filtering module; and the input of the anti-malicious attack identification module is connected to the outputs of the server-side password authentication module, permission filtering module, and duplicate request filtering module.
[0010] The server-side command sending and receiving module is used to receive or send server-side requests; the server-side sentry mode operation module is used to set security password verification switches and permission filtering switches when intercepting client requests; the server-side password authentication module and the client-side password authentication module are used to use dynamic security password encryption authentication, and authorize user access behavior by setting random code verification, adding timestamp information and trial and error mechanism; the permission filtering module is used to handle the security verification of requests, and only allow access requests with authorization; the duplicate request filtering module is used to intercept duplicate submissions and continuous malicious attacks; the anti-malicious attack identification module is used to set reference data indicators for security password authentication anomalies, permission anomalies and duplicate requests, and send prompt information to take defensive actions when the anomaly threshold is reached.
[0011] Thirdly, the present invention provides a dynamic permission device, including a client permission authentication system and a server permission authentication system;
[0012] The client-side authorization system includes a client-side command sending and receiving module, a client-side sentry mode operation module, a dynamic routing module, a dynamic component rendering module, a client-side password authentication module, and a command binding module.
[0013] The client-side command sending and receiving module is used to receive or send client-side requests; the client-side sentry mode operation module is used to intercept page routes, filter out page routes that are not whitelisted and lack security password authentication and permissions, perform unified exception handling, and redirect to the login authentication page; the dynamic routing module is used to reset page routes in real time when users actively switch roles and permissions, and call the dynamic component rendering module to switch to the reset page; the dynamic component rendering module is used to render and present the page and permission buttons in real time; the command binding module is used to destroy the current button component in real time when user permissions change, and call the dynamic component rendering module to render a new button with permissions.
[0014] The server-side access control system includes a server-side command sending and receiving module, a server-side sentry mode operation module, a server-side password authentication module, an access control filtering module, a duplicate request filtering module, and a malicious attack detection module.
[0015] The server-side command sending and receiving module is used to receive or send server-side requests; the server-side sentry mode operation module is used to set security password verification switches and permission filtering switches when intercepting client requests; the server-side password authentication module and the client-side password authentication module are used to use dynamic security password encryption authentication, and authorize user access behavior by setting random code verification, adding timestamp information and trial and error mechanism; the permission filtering module is used to handle the security verification of requests, and only allow access requests with authorization; the duplicate request filtering module is used to intercept duplicate submissions and continuous malicious attacks; the anti-malicious attack identification module is used to set reference data indicators for security password authentication anomalies, permission anomalies and duplicate requests, and send prompt information to take defensive actions when the anomaly threshold is reached.
[0016] Fourthly, based on the aforementioned dynamic permission device, this invention provides a corresponding secure password authentication method, comprising the following steps:
[0017] D1: The client-side password authentication module initiates the first handshake request to the server-side password authentication module;
[0018] D2: After receiving the first handshake request from the client-side password authentication module, the server-side password authentication module uses an asymmetric encryption algorithm to generate a pair of asymmetric keys. The server-side password authentication module stores the asymmetric private key in memory and sends the asymmetric public key to the client for storage.
[0019] D3: The client-side password authentication module initiates a second handshake request to the server-side password authentication module to obtain the symmetric encryption key for encrypting the parameter information.
[0020] D4: After receiving the second handshake request initiated by the client-side password authentication module, the server-side password authentication module uses a symmetric encryption algorithm to generate a symmetric key. The server-side password authentication module stores the symmetric key in memory and encrypts the symmetric key using an asymmetric private key. Then, it sends the encrypted symmetric key to the client for storage.
[0021] D5: The client-side password authentication module decrypts the received encrypted symmetric encryption key using the public key of the asymmetric key to obtain the symmetric key, and then encrypts the user's password information using the symmetric key.
[0022] D6: The client-side password authentication module initiates a third password authentication request to the server-side password authentication module. The client-side password authentication module will send the password information encrypted with a symmetric key to the server-side password authentication module.
[0023] D7: The service-side password authentication module receives the third password authentication request initiated by the client-side password authentication module, obtains the password information encrypted with the symmetric key, decrypts the password information using the symmetric key, obtains the real password information, and performs verification of the password information.
[0024] D8: If the password information verification passes, the server-side password authentication module generates an encrypted authorization password based on the password information and timestamp, and sends the authorization password to the client-side password authentication module. If the password information verification fails, the server-side password authentication module sends the verification result information to the client-side password authentication module. When the client-side password authentication module receives the password authentication failure information, the client displays a prompt message. The user decides to modify the password information based on the prompt message and sends the password authentication request again.
[0025] Fifthly, based on the aforementioned dynamic permission device, the present invention provides a corresponding secure request execution method, comprising the following steps:
[0026] S1: The client-side command sending and receiving module initiates a request;
[0027] S2: The client-side sentinel mode running module initiates request interception, determines whether the request is a whitelisted page route, and if the determination result is yes, then execute S4; otherwise, execute S3.
[0028] S3: The client-side sentinel mode module determines whether the client has performed secure password authentication. If the result is yes, the request carrying the password information is sent to the server-side send / receive command module and S4 is executed; otherwise, secure password authentication is performed.
[0029] S4: The server-side command sending and receiving module receives a request carrying password information. The server-side sentry mode running module verifies the password information of the request. If the password information verification passes, S5 is executed; otherwise, S8 is executed.
[0030] S5: The permission filtering module compares the request carrying the password information with the user's permissions. If the request passes, proceed to S6; otherwise, proceed to S8.
[0031] S6: The duplicate request filtering module records the time and information of the current request and compares it with the time and information of the previous request to determine whether the current request is a duplicate request. If the result is no, proceed to S7; otherwise, proceed to S8.
[0032] S7: This request enters the business layer logic to perform business operations, then executes S9;
[0033] S8: Record and process any exceptions for this request, then execute S9;
[0034] S9: The server-side command sending and receiving module returns the result information of this request to the client-side command sending and receiving module.
[0035] More preferably, the secure password authentication method includes the following steps:
[0036] D1: The client-side password authentication module initiates the first handshake request to the server-side password authentication module;
[0037] D2: After receiving the first handshake request from the client-side password authentication module, the server-side password authentication module uses an asymmetric encryption algorithm to generate a pair of asymmetric keys. The server-side password authentication module stores the asymmetric private key in memory and sends the asymmetric public key to the client for storage.
[0038] D3: The client-side password authentication module initiates a second handshake request to the server-side password authentication module;
[0039] D4: After receiving the second handshake request initiated by the client-side password authentication module, the server-side password authentication module uses a symmetric encryption algorithm to generate a symmetric key. The server-side password authentication module stores the symmetric key in memory and encrypts the symmetric key using an asymmetric private key. Then, it sends the encrypted symmetric key to the client for storage.
[0040] D5: The client-side password authentication module decrypts the received encrypted symmetric encryption key using the public key of the asymmetric key to obtain the symmetric key, and then encrypts the user's password information using the symmetric key.
[0041] D6: The client-side password authentication module initiates a third password authentication request to the server-side password authentication module. The client-side password authentication module will send the password information encrypted with a symmetric key to the server-side password authentication module.
[0042] D7: The service-side password authentication module receives the third password authentication request initiated by the client-side password authentication module, obtains the password information encrypted with the symmetric key, decrypts the password information using the symmetric key, obtains the real password information, and performs verification of the password information.
[0043] D8: If the password information verification passes, the server-side password authentication module generates an encrypted authorization password based on the password information and timestamp, and sends the authorization password to the client-side password authentication module. If the password information verification fails, the server-side password authentication module sends the verification result information to the client-side password authentication module. When the client-side password authentication module receives the password authentication failure information, the client displays a prompt message. The user decides to modify the password information based on the prompt message and sends the password authentication request again.
[0044] More preferably, the abnormal information in S8 includes abnormal data such as client IP, user information, timestamp, and request parameter information.
[0045] In summary, the technical solutions conceived by this invention have the following beneficial effects compared with the prior art:
[0046] This invention incorporates a client-side password authentication module and a command binding module in the client-side authorization system. Similarly, the server-side authorization system includes a server-side password authentication module, a permission filtering module, a duplicate request filtering module, and a malicious attack detection module. This allows for strict control over user actions, preventing unauthorized and malicious operations. Unlike traditional permission designs and filtering methods, this invention employs a one-time password encryption authentication method to protect user information. Permission filtering utilizes dual-end verification on both the client and server sides, preventing attackers from bypassing the client and directly attacking the server. Furthermore, strict rendering measures are implemented for user page presentation. The client uses the user permissions returned by the server, rendering only pages and buttons that the user has the necessary permissions for, and excluding pages and buttons that the user lacks the necessary permissions for, preventing attackers from expanding their attacks by obtaining client-side source code. This invention significantly improves the security and reliability of the software system. Attached Figure Description
[0047] Figure 1This is a system design module diagram provided in an embodiment of the present invention;
[0048] Figure 2 This is a schematic diagram of the security request execution process of the dynamic permission system provided in this embodiment of the invention;
[0049] Figure 3 This is a schematic diagram of the security password authentication process of the dynamic permission system provided in this embodiment of the invention;
[0050] Figure 4 This is a schematic diagram of the dynamic rendering process of the components of the dynamic permission system provided in this embodiment of the invention. Detailed Implementation
[0051] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.
[0052] The dynamic permission system provided by this invention involves several concepts, including client-side sentinel mode, dynamic routing, dynamic component rendering, command binding, server-side sentinel mode, password authentication, permission filtering, duplicate request filtering, and malicious attack prevention identification. These are explained in detail below:
[0053] Client-side sentinel mode protects user page routing by intercepting accessed pages and verifying authentication and permission information to prevent malicious access.
[0054] Dynamic routing is used to dynamically load, render, and present the pages that a user can access to the user.
[0055] Dynamic component rendering is used to render and present pages, key information, and permission buttons in real time.
[0056] Command binding is used to determine the user's authorized actions and to present page information based on the permission determination result.
[0057] The server-side sentinel mode provides unified security interception and processing for all client requests;
[0058] Password authentication is the act of authorizing legitimate users to access the server.
[0059] Permission filtering is used for security checks on the server side when processing requests, allowing only authorized access requests to pass.
[0060] Duplicate request filtering effectively intercepts duplicate submissions and persistent malicious attacks.
[0061] The anti-malicious attack identification is used to mark unauthorized requests and persistent malicious requests in the permission filtering and to restrict abnormal behavior.
[0062] Based on the above, the present invention makes the following improvements:
[0063] The client-side sentinel mode intercepts page routes, filters out page routes that are not on the whitelist and lack password authentication and permissions, performs unified exception handling, and redirects the user to the login authentication page.
[0064] Dynamic routing: When a user actively switches roles and permissions, the page routing is reset in real time according to the permissions the role has, and dynamic components are invoked to render, switching to the new page and destroying the previous page;
[0065] Command binding: When user permissions change, the current button component is destroyed in real time, and dynamic component rendering is invoked to render a new button with the correct permissions;
[0066] Server-side Sentinel Mode: When intercepting client requests, password verification and permission filtering switches can be set as needed; hierarchical control can be implemented for different requests to improve software efficiency and avoid redundant processes; other core processing can also be performed according to business needs, such as setting cross-domain requests and unified exception handling.
[0067] Password authentication can incorporate random code verification, timestamp information, and a trial-and-error mechanism; it can also help detect and stop malicious attackers in a timely manner.
[0068] During use, the anti-malicious attack identification system sets reference data indicators for behaviors such as abnormal password authentication, abnormal permissions, and repeated requests. When the abnormal threshold is reached, a prompt message will be sent to the system administrator. Upon receiving the prompt, the system administrator can take proactive defensive actions, such as blocking access and locking the account.
[0069] Therefore, the present invention provides a corresponding client permission authentication system, including: a client-side command sending and receiving module, a client-side sentry mode operation module, a dynamic routing module, a dynamic component rendering module, a client-side password authentication module, and a command binding module;
[0070] The output of the client sending and receiving command module is connected to the input of the client-side sentry mode operation module; the input of the dynamic routing module is connected to the client, and its output is connected to the input of the dynamic component rendering module; the output of the command binding module is connected to the input of the dynamic component rendering module; the input of the client-side password authentication module is connected to the output of the client-side sentry mode operation module, and its output is connected to the server.
[0071] The client-side command sending and receiving module is used to receive or send client-side requests; the client-side sentry mode operation module is used to intercept page routes, filter out page routes that are not whitelisted and lack security password authentication and permissions, perform unified exception handling, and redirect to the login authentication page; the dynamic routing module is used to reset page routes in real time when users actively switch roles and permissions, and call the dynamic component rendering module to switch to the reset page; the dynamic component rendering module is used to render and present the page and permission buttons in real time; the command binding module is used to destroy the current button component in real time when user permissions change, and call the dynamic component rendering module to render a new button with permissions.
[0072] This invention also provides a corresponding server-side authorization system, including: a server-side command sending and receiving module, a server-side sentry mode operation module, a server-side password authentication module, an authorization filtering module, a duplicate request filtering module, and a malicious attack identification module;
[0073] The input of the server-side sentinel mode operation module is connected to the output of the server-side send / receive command module; the input of the permission filtering module is connected to the output of the server-side sentinel mode operation module; the input of the duplicate request filtering module is connected to the output of the permission filtering module; and the input of the anti-malicious attack identification module is connected to the outputs of the server-side password authentication module, permission filtering module, and duplicate request filtering module.
[0074] The server-side command sending and receiving module is used to receive or send server-side requests; the server-side sentry mode operation module is used to set security password verification switches and permission filtering switches when intercepting client requests; the server-side password authentication module and the client-side password authentication module are used to use dynamic security password encryption authentication, and authorize user access behavior by setting random code verification, adding timestamp information and trial and error mechanism; the permission filtering module is used to handle the security verification of requests, and only allow access requests with authorization; the duplicate request filtering module is used to intercept duplicate submissions and continuous malicious attacks; the anti-malicious attack identification module is used to set reference data indicators for security password authentication anomalies, permission anomalies and duplicate requests, and send prompt information to take defensive actions when the anomaly threshold is reached.
[0075] The server-side and client-side authentication systems together form a dynamic permission device.
[0076] like Figure 2 As shown, this invention provides a secure request execution method for a dynamic permission system. This method involves both a client and a server, and specifically includes the following steps:
[0077] Step 1: The client-side command sending and receiving module initiates a request;
[0078] Step 2: The client-side sentinel mode module intercepts the request and determines whether it is a whitelisted route. If the result is yes, proceed to step 4; otherwise, proceed to step 3.
[0079] Step 3: In the client-side sentry mode running module, determine whether the client has performed password authentication. If the result is yes, request to send the password information to the server-side send and receive command module and execute Step 4; otherwise, enter the secure password authentication process.
[0080] Step 4: The server-side command sending and receiving module receives a request carrying password information. The server-side sentry mode operation module verifies the password information of the request. If the password information passes the verification, proceed to the next step; otherwise, proceed to step 8.
[0081] Step 5: The server-side permission filtering module compares the request with the user's permissions. If the request passes the permission comparison, proceed to the next step; otherwise, proceed to step 8.
[0082] Step Six: The service-side duplicate request filtering module records the time and information of this request and compares it with the time and information of the previous request to determine whether the request is a duplicate request. If the result is no, proceed to Step Seven; if the result is yes, proceed to Step Eight.
[0083] Step 7: This request enters the business layer logic, processes normal business operations, and then proceeds to Step 9;
[0084] Step 8: Record the exception information for this request, including client IP, user information, timestamp, and request parameter information, and process the exception information uniformly before proceeding to Step 9;
[0085] Step 9: The server-side command sending and receiving module returns the result information of this request to the client-side command sending and receiving module.
[0086] like Figure 3 As shown in the diagram, this invention provides a schematic of a secure password authentication method for a dynamic permission system, which specifically includes the following steps:
[0087] Step 1: The client-side password authentication module initiates the first handshake request to the server-side password authentication module;
[0088] Step 2: After receiving the first handshake request from the client-side password authentication module, the server-side password authentication module uses an asymmetric encryption algorithm to generate a pair of asymmetric keys. The server-side password authentication module stores the asymmetric private key in memory and sends the asymmetric public key to the client for storage.
[0089] Step 3: The client-side password authentication module initiates a second handshake request to the server.
[0090] Step 4: After receiving the second handshake request initiated by the client-side password authentication module, the server-side password authentication module uses a symmetric encryption algorithm to generate a symmetric key. The server-side password authentication module stores the symmetric key in memory and encrypts the symmetric key using an asymmetric private key. Then, it sends the encrypted symmetric key to the client for storage.
[0091] Step 5: The client-side password authentication module decrypts the received encrypted symmetric key using the public key of the asymmetric key to obtain the symmetric key, and then encrypts the user's password information using the symmetric key.
[0092] Step Six: The client-side password authentication module initiates a third password authentication request to the server-side password authentication module. The client-side password authentication module sends the password information encrypted with a symmetric key to the server-side password authentication module.
[0093] Step 7: The service-side password authentication module receives the third password authentication request initiated by the client-side password authentication module, obtains the password information encrypted with the symmetric key, decrypts the password information using the symmetric key, obtains the real password information, and performs verification of the password information.
[0094] Step 8: If the password information verification passes, the server-side password authentication module generates an encrypted authorization password based on the password information and timestamp, and sends the authorization password to the client-side password authentication module; if the password information verification fails, the server-side password authentication module sends the verification result information to the client-side password authentication module.
[0095] Step Nine: If the client-side password authentication module receives an authorization password, it can operate and be used normally. All subsequent requests from the client-side password authentication module to the service-side password authentication module must include this authorization password. If the client-side password authentication module receives a message indicating that the password authentication failed, it will display a prompt message. The user can then decide to modify the password information based on the prompt message and resend the password authentication request.
[0096] like Figure 4 As shown in the diagram, this invention provides a schematic diagram of the dynamic rendering process of components in a dynamic permission system, which specifically includes the following steps:
[0097] Step 1: Compile the page template into a render function;
[0098] Step 2: Instance mounting, calling the render function to recursively generate the virtual DOM;
[0099] Step 3: Based on the component data, compare the virtual DOM and render it to the real DOM;
[0100] Step 4: If the component has child components, repeat steps 1, 2, and 3.
[0101] In summary, the technical solution provided by this invention has the following advantages compared with the prior art:
[0102] This invention incorporates a client-side password authentication module and a command binding module in the client-side authorization system. Similarly, the server-side authorization system includes a server-side password authentication module, a permission filtering module, a duplicate request filtering module, and a malicious attack detection module. This allows for strict control over user actions, preventing unauthorized and malicious operations. Unlike traditional permission designs and filtering methods, this invention employs a one-time password encryption authentication method to protect user information. Permission filtering utilizes dual-end verification on both the client and server sides, preventing attackers from bypassing the client and directly attacking the server. Furthermore, strict rendering measures are implemented for user page presentation. The client uses the user permissions returned by the server, rendering only pages and buttons that the user has the necessary permissions for, and excluding pages and buttons that the user lacks the necessary permissions for, preventing attackers from expanding their attacks by obtaining client-side source code. This invention significantly improves the security and reliability of the software system.
[0103] Those skilled in the art will readily understand that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.
Claims
1. A dynamic permission device, characterized in that, This includes client-side authentication systems and server-side authentication systems. The client-side permission authentication system includes a client-side command sending and receiving module, a client-side sentry mode operation module, a dynamic routing module, a dynamic component rendering module, a client-side password authentication module, and a command binding module. The output of the client sending and receiving command module is connected to the input of the client-side sentry mode operation module; the input of the dynamic routing module is connected to the client, and its output is connected to the input of the dynamic component rendering module; the output of the command binding module is connected to the input of the dynamic component rendering module; the input of the client-side password authentication module is connected to the output of the client-side sentry mode operation module, and its output is connected to the server. The client-side command receiving module is used to receive or send client-side requests. The client-side sentinel mode operation module is used to intercept page routes, filter out page routes that are not on the whitelist and do not have security password authentication and permissions, perform unified exception handling, and redirect to the login authentication page. The dynamic routing module is used to reset the page routing in real time when the user actively switches roles and permissions, and call the dynamic component rendering module to switch to the reset page; the dynamic component rendering module is used to render and present the page and permission buttons in real time. The instruction binding module is used to destroy the current button component in real time when the user's permissions change, and call the dynamic component rendering module to render a new button with the permissions. The server-side authorization system includes a server-side command sending and receiving module, a server-side sentry mode operation module, a server-side password authentication module, an authorization filtering module, a duplicate request filtering module, and a malicious attack identification module. The input terminal of the server-side sentinel mode operation module is connected to the output terminal of the server-side send and receive command module; the input terminal of the permission filtering module is connected to the output terminal of the server-side sentinel mode operation module; the input terminal of the duplicate request filtering module is connected to the output terminal of the permission filtering module; the input terminal of the anti-malicious attack identification module is connected to the output terminals of the server-side password authentication module, the permission filtering module, and the duplicate request filtering module. The server-side command sending and receiving module is used to receive or send server-side requests; The service-side sentinel mode operation module is used to set a security password verification switch and a permission filtering switch when intercepting client requests; the service-side password authentication module and the client-side password authentication module are used to use one-time password dynamic security password encryption authentication, and authorize user access behavior by setting random code verification, adding timestamp information and trial and error mechanism. The permission filtering module is used to process the security verification of requests, allowing only authorized access requests; the duplicate request filtering module is used to intercept duplicate submissions and continuous malicious attacks; the anti-malicious attack identification module is used to set reference data indicators for security password authentication anomalies, permission anomalies, and duplicate requests, and send prompt messages to take defensive actions when the anomaly threshold is reached.
2. A secure password authentication method based on the dynamic permission device described in claim 1, characterized in that, Includes the following steps: D1: The client-side password authentication module initiates the first handshake request to the server-side password authentication module; D2: After receiving the first handshake request from the client-side password authentication module, the server-side password authentication module uses an asymmetric encryption algorithm to generate a pair of asymmetric keys. The server-side password authentication module stores the asymmetric private key in memory and sends the asymmetric public key to the client for storage. D3: The client-side password authentication module initiates a second handshake request to the server-side password authentication module; D4: After receiving the second handshake request initiated by the client-side password authentication module, the server-side password authentication module uses a symmetric encryption algorithm to generate a symmetric key. The server-side password authentication module stores the symmetric key in memory and encrypts the symmetric key using an asymmetric private key. Then, it sends the encrypted symmetric key to the client for storage. D5: The client-side password authentication module decrypts the received encrypted symmetric key using the public key of the asymmetric key to obtain the symmetric key, and then encrypts the user's password information using the symmetric key. D6: The client-side password authentication module initiates a third password authentication request to the server-side password authentication module. The client-side password authentication module will send the password information encrypted with a symmetric key to the server-side password authentication module. D7: The service-side password authentication module receives the third password authentication request initiated by the client-side password authentication module, obtains the password information encrypted with the symmetric key, decrypts the password information using the symmetric key, obtains the real password information, and performs verification of the password information. D8: If the password information is verified, the server-side password authentication module generates an encrypted authorization password based on the password information and timestamp, and sends the authorization password to the client-side password authentication module. If the password verification fails, the server-side password authentication module sends the verification result information to the client-side password authentication module. When the client-side password authentication module receives the password verification failure information, the client displays a prompt message. The user decides to change the password information based on the prompt message and sends the password authentication request again.
3. A secure request execution method based on the dynamic permission device of claim 1, characterized in that, Includes the following steps: S1: The client-side command sending and receiving module initiates a request; S2: The client-side sentinel mode running module initiates request interception, determines whether the request is a whitelisted page route, and if the determination result is yes, then execute S4; otherwise, execute S3. S3: The client-side sentinel mode module determines whether the client has performed secure password authentication. If the result is yes, the request carrying the password information is sent to the server-side send / receive command module and S4 is executed; otherwise, secure password authentication is performed. S4: The server-side command sending and receiving module receives a request carrying password information. The server-side sentry mode running module verifies the password information of the request. If the password information verification passes, S5 is executed; otherwise, S8 is executed. S5: The permission filtering module compares the request carrying the password information with the user's permissions. If the request passes, proceed to S6; otherwise, proceed to S8. S6: The duplicate request filtering module records the time and information of the current request and compares it with the time and information of the previous request to determine whether the current request is a duplicate request. If the result is no, proceed to S7; otherwise, proceed to S8. S7: This request enters the business layer logic to perform business operations, then executes S9; S8: Record and process any exceptions for this request, then execute S9; S9: The server-side command sending and receiving module returns the result information of this request to the client-side command sending and receiving module.
4. The secure request execution method of the dynamic permission device according to claim 3, characterized in that, The secure password authentication method includes the following steps: D1: The client-side password authentication module initiates the first handshake request to the server-side password authentication module; D2: After receiving the first handshake request from the client-side password authentication module, the server-side password authentication module uses an asymmetric encryption algorithm to generate a pair of asymmetric keys. The server-side password authentication module stores the asymmetric private key in memory and sends the asymmetric public key to the client for storage. D3: The client-side password authentication module initiates a second handshake request to the server-side password authentication module; D4: After receiving the second handshake request initiated by the client-side password authentication module, the server-side password authentication module uses a symmetric encryption algorithm to generate a symmetric key. The server-side password authentication module stores the symmetric key in memory and encrypts the symmetric key using an asymmetric private key. Then, it sends the encrypted symmetric key to the client for storage. D5: The client-side password authentication module decrypts the received encrypted symmetric encryption key using the public key of the asymmetric key to obtain the symmetric key, and then encrypts the user's password information using the symmetric key. D6: The client-side password authentication module initiates a third password authentication request to the server-side password authentication module. The client-side password authentication module will send the password information encrypted with a symmetric key to the server-side password authentication module. D7: The service-side password authentication module receives the third password authentication request initiated by the client-side password authentication module, obtains the password information encrypted with the symmetric key, decrypts the password information using the symmetric key, obtains the real password information, and performs verification of the password information. D8: If the password information verification passes, the server-side password authentication module generates an encrypted authorization password based on the password information and timestamp, and sends the authorization password to the client-side password authentication module. If the password information verification fails, the server-side password authentication module sends the verification result information to the client-side password authentication module. When the client-side password authentication module receives the password authentication failure information, the client displays a prompt message. The user decides to modify the password information based on the prompt message and sends the password authentication request again.