A user authentication method and server

Abstract

This invention provides a user authentication method whereby a user is associated with one or more roles, and each role is configured with one or more permissions. If one of the permissions of the multiple roles associated with the user is in a changed state, the current user is in a first restricted state; if one of the permissions of the multiple roles associated with the user is in a frozen state, the current user is in a second restricted state. The user authentication method includes the following steps: querying the user's account status in a non-relational database, the account status including the first restricted state and the second restricted state; if the account status is the first restricted state, forcing the user to log in again; if the account status is the second restricted state, verifying in a relational database whether the user has any permissions in a frozen state; if so, prohibiting the user from accessing the database; otherwise, allowing the user to access the database.

Description

Technical Field

[0001] This invention relates to the field of user authentication technology, and in particular to a user authentication method and server. Background Technology

[0002] The most widely used access control method in typical user management systems is Role-Based Access Control (RBAC), which implements enterprise security policies. However, this results in users having different roles, each with different permissions. When any role changes, the permissions of all associated users change. In this case, access control either needs to check the user's latest permissions for every action, or requires the relevant user to log in again to obtain the updated permissions. Neither of these methods is optimal. In complex systems, querying user permissions every time consumes significant computing power and processing time, while requiring users to log in again degrades the user experience.

[0003] The highway system comprises numerous departments and business systems, each with its own user account management system. However, the users are all the same entity, which causes significant inconvenience and repetitive work for frontline staff. Furthermore, due to the lack of uniformity in account and user systems, effective collaboration and linkage between users are impossible. Summary of the Invention

[0004] In order to overcome the above-mentioned technical defects, the purpose of this invention is to provide a user authentication method and server that can perform authentication more quickly when the user's status changes.

[0005] This invention discloses a user authentication method. A user is associated with one or more roles, and each role is configured with one or more permissions. If one of the permissions of the multiple roles associated with the user is in a changed state, the current user is in a first restricted state. If one of the permissions of the multiple roles associated with the user is in a frozen state, the current user is in a second restricted state. The user authentication method includes the following steps: querying the user's account status in a non-relational database, the account status including the first restricted state and the second restricted state; if the account status is the first restricted state, forcing the user to log in again; if the account status is the second restricted state, checking in a relational database whether the user has any permissions in a frozen state, if so, prohibiting the user from accessing, if not, allowing the user to access.

[0006] Preferably, the role includes the job position associated with the user and the organization to which the user belongs; if one of the multiple permissions of the multiple roles associated with the user is in a changed state, then the current user is in a first restricted state, which includes: if one of the multiple permissions of the job position associated with the user and / or the organization to which the user belongs is in a changed state, then the current user is in a first restricted state; if one of the multiple permissions of the multiple roles associated with the user is in a frozen state, then the current user is in a second restricted state, which includes: if one of the multiple permissions of the job position associated with the user and / or the organization to which the user belongs is in a frozen state, then the current user is in a second restricted state.

[0007] Preferably, before querying the user's account status in the non-relational database, the method further includes: querying the user's login token in the non-relational database; if the user's login token is found, then the user's account status is queried in the non-relational database; if the user's login token is not found, then the user's access is prohibited.

[0008] Preferably, the account status also includes a normal status and a frozen status; querying the user's account status in the non-relational database includes: if the account status is the normal status, then the user is allowed to access; if the account status is the frozen status, then the user is prohibited from access.

[0009] Preferably, the step of verifying in the relational database whether the user has any permissions frozen also includes: saving the account status retrieved in the relational database to a non-relational database.

[0010] Preferably, before querying the user's account status in the non-relational database, the method further includes: querying whether the account is available in the non-relational database; if available, querying the user's account status in the non-relational database; if unavailable, querying the user's account status in the relational database.

[0011] This invention also discloses a user authentication method for traffic management, including the above-described user authentication method; the organization to which the user belongs includes service areas, toll stations, parking areas, monitoring centers, and maintenance centers; the account status of users associated with the monitoring center is refreshed in a non-relational database at a first preset time, and the account status of users associated with the service areas, toll stations, parking areas, and maintenance centers is refreshed at a second preset time; the first preset time is less than the second preset time.

[0012] This invention also discloses a user authentication system, comprising a relational database and a non-relational database; a user is associated with one or more roles, and each role is configured with one or more permissions; if one of the permissions of the multiple roles associated with the user is in a changed state, the current user is in a first restricted state; if one of the permissions of the multiple roles associated with the user is in a frozen state, the current user is in a second restricted state; the system queries the user's account status in the non-relational database, the account status including the first restricted state and the second restricted state; if the account status is the first restricted state, the user is forced to log in again; if the account status is the second restricted state, the system checks in the relational database whether any permissions of the user are frozen; if so, the user is prohibited from accessing the database; otherwise, the user is allowed to access the database.

[0013] The present invention also discloses a server, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the user authentication method described above.

[0014] Compared with existing technologies, the above technical solution has the following advantages:

[0015] 1. The system determines whether a user needs to log in again by recognizing their account status, rather than requiring a new login for every change in role or permission. Furthermore, the account status query is performed in a non-relational database, resulting in faster query speeds, reduced user waiting time, and an improved user experience.

[0016] 2. When the non-relational database is unavailable, query the relational database. Combining the two databases and using them alternately improves verification efficiency, reduces detection time, and enhances user experience. Attached Figure Description

[0017] Figure 1 A schematic diagram illustrating changes in account status provided by this invention;

[0018] Figure 2 This is a flowchart illustrating the user authentication method provided by the present invention. Detailed Implementation

[0019] The advantages of the present invention will be further illustrated below with reference to the accompanying drawings and specific embodiments.

[0020] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this disclosure as detailed in the appended claims.

[0021] The terminology used in this disclosure is for the purpose of describing particular embodiments only and is not intended to be limiting of the disclosure. The singular forms “a,” “the,” and “the” as used in this disclosure and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any and all possible combinations of one or more of the associated listed items.

[0022] It should be understood that although the terms first, second, third, etc., may be used in this disclosure to describe various information, such information should not be limited to these terms. These terms are used only to distinguish information of the same type from one another. For example, without departing from the scope of this disclosure, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."

[0023] In the description of this invention, it should be understood that the terms "longitudinal", "lateral", "up", "down", "front", "rear", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer", etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this invention.

[0024] In the description of this invention, unless otherwise specified and limited, it should be noted that the terms "installation", "connection" and "linking" should be interpreted broadly. For example, they can refer to mechanical or electrical connections, or internal connections between two components. They can be direct connections or indirect connections through an intermediate medium. Those skilled in the art can understand the specific meaning of the above terms according to the specific circumstances.

[0025] In the following description, suffixes such as "module," "part," or "unit" used to denote elements are used only for the convenience of the description of the invention and have no specific meaning in themselves. Therefore, "module" and "part" can be used interchangeably.

[0026] Role-based Access Control (RBAC) is an effective access control method for implementing enterprise security policies. It consists of three basic components: users, roles, and permissions. Unlike Access Control Programming (ACL) technologies, RBAC controls user permissions by defining role permissions and assigning roles to users, thus achieving a logical separation between users and permissions and greatly simplifying permission management. In RBAC, each user has a unique user account and is assigned different roles. Different roles have different permissions, typically referring to access permissions. It also includes the mapping relationship between users and roles, as well as the mapping relationship between roles and permissions.

[0027] For example, if users include User 1 and User 2, and User 1's role is an administrator while User 2's role is a regular user, then User 1 can be configured with permissions to create users, freeze users, modify personal information, and view user profiles. User 2, however, can only be configured with permissions to modify personal information and view user profiles.

[0028] Authentication refers to verifying whether a user has the right to access the system.

[0029] The most typical data structure in relational databases is the table, which is a data organization composed of two-dimensional tables and the relationships between them. Its advantages are: 1. Easy to maintain: all data uses a table structure with a consistent format; 2. Convenient to use: the SQL language is universal and can be used for complex queries; 3. Complex operations: it supports SQL and can be used for very complex queries between a single table and multiple tables. Its disadvantages are: 1. Relatively poor read / write performance, especially for high-efficiency read / write of massive amounts of data; 2. Fixed table structure, resulting in slightly less flexibility; 3. For high-concurrency read / write requirements, disk I / O is a significant bottleneck for traditional relational databases.

[0030] Strictly speaking, NoSQL databases are not a type of database, but rather a collection of data structure storage methods, which can be documents or key-value pairs, etc. Their advantages include: 1. Flexible format: Data can be stored in key-value formats, document formats, image formats, etc., offering flexibility and wide applicability, while relational databases only support basic data types. 2. High speed: NoSQL can use hard disks or random access storage as its storage medium, while relational databases can only use hard disks. 3. High scalability. 4. Low cost: NoSQL databases are easy to deploy and are mostly open-source software. Their disadvantages include: 1. No SQL support, resulting in a higher learning and usage cost; 2. No transaction processing; 3. Relatively complex data structures, slightly lacking in complex query capabilities.

[0031] User data is typically stored in relational databases, but relational database queries are slow. Therefore, this invention stores some data in a non-relational database, resulting in faster query speeds. While non-relational databases offer fast queries, they are generally unsuitable for long-term data storage. Therefore, this invention combines both types of databases to store user data. The non-relational database is used first; if it becomes unavailable or no relevant data is found, the query is then performed in the relational database.

[0032] Typically, a user is associated with at least one role, and each role is configured with one or more permissions. When a permission changes, existing technologies usually require the user to log in again. This invention, however, determines whether a re-login is needed by obtaining the user's current state, rather than requiring the user to log in again for every state.

[0033] See appendix Figure 1 Firstly, this invention defines: normal state; frozen state; first restricted state; and second restricted state. A user enters a frozen state when they are frozen, or when other attributes associated with the user are frozen. If one of the permissions of multiple roles associated with the user is in a changed state, the current user is in the first restricted state; if one of the permissions of multiple roles associated with the user is in a frozen state, the current user is in the second restricted state.

[0034] This can be understood as follows: if the permissions of a user's associated role change, then all users associated with that role will be in a state of changed permissions; this state is called the first restricted state. If a user is frozen and any of their associated attributes are unfrozen, but it's uncertain which of the multiple attributes is unfrozen, or whether the others are still frozen, then the user's state after unfreezing is unknown; this state is called the second restricted state.

[0035] Because permission changes are a sensitive operation, this invention only requires users to log in again to restore their normal status when their account status is in the first restricted state (permission change state). When the user is in the second restricted state (unknown state), the user status needs to be further verified in the relational database.

[0036] For details, please see the appendix. Figure 2 The user authentication method includes the following steps:

[0037] Query a user's account status in a non-relational database:

[0038] If the account status is normal, then the user is allowed to access;

[0039] If the account is frozen, the user is prohibited from accessing the system.

[0040] If the account status is in the first restricted state, the user will be forced to log in again;

[0041] If the account status is the second restricted status, then check the relational database to see if the user has any permissions that are frozen. If so, then the user is prohibited from accessing the database; otherwise, the user is allowed to access the database.

[0042] This invention firstly forces users to log in again without any changes, improving the user experience; secondly, it avoids verifying changed user permissions after every change, only performing further verification when the user's status is in the second restricted state, thus improving verification speed; and thirdly, user status queries are performed in a non-relational database, resulting in fast query speeds. This invention solves the problem of permission changes occurring after a user logs in, reducing the need for re-login and minimizing user response time, thereby improving the user experience.

[0043] For a better option, please refer to the appendix. Figure 1 Roles include the user's associated job title and the organization to which the user belongs (or is associated). If a user is frozen, or the user's associated job title is frozen, or the user's associated organization is frozen, the user changes from a normal state to a frozen state. If one of the permissions for the user's associated job title and / or the user's associated organization is in a changed state, the current user is in a first restricted state. If a user is unfrozen, or the user's associated job title is unfrozen, or the user's associated organization is unfrozen (but it is uncertain which attribute is unfrozen, or whether other attributes are unfrozen), the user changes from a frozen state to a second restricted state.

[0044] User actions typically require carrying a user identifier, which is usually a token issued by the system after login (referred to as a "token" in computer terminology). This token identifies the user's login token at that time. Like the user's account status, this login token is stored in a non-relational database, which offers fast query and processing speeds.

[0045] See appendix for further details. Figure 1 During authentication, the system first checks if the token exists in a non-relational database. If not, the user is denied access. If the token exists, the system then checks the user's account status.

[0046] Ideally, when verifying whether a user has any frozen permissions in the relational database, the account status retrieved in the relational database is also saved to the non-relational database.

[0047] Relational databases are used in conjunction with non-relational databases. If the non-relational database is inaccessible, the relational database can be accessed, thus achieving high availability.

[0048] This invention also discloses a user authentication method for the field of traffic management. In the field of traffic management, the highway operation and management department has multiple management offices and sub-offices. Each management office manages multiple highways. Each management office has multiple service areas, toll stations, parking areas, monitoring centers, maintenance centers, and other functional departments. Each functional department has many management personnel, and some personnel may hold multiple positions and work in different departments. That is, a user is associated with multiple roles, and each role has different permissions due to different departments, levels, etc.

[0049] In a preferred embodiment, the account status of users associated with the monitoring center is refreshed in a non-relational database at a first preset time, and the account status of users associated with the service area, toll station, parking area, and maintenance center is refreshed at a second preset time. The first preset time is shorter than the second preset time, meaning that the refresh speed is faster for users of the monitoring center with more permissions and higher levels compared to users of the service area, toll station, parking area, and maintenance center.

[0050] This invention also discloses a user authentication system, comprising a relational database and a non-relational database. Users are associated with one or more roles, and each role is configured with one or more permissions.

[0051] If one of the permissions associated with a user's multiple roles is in a changed state, the current user is in a first restricted state. If one of the permissions associated with a user's multiple roles is in a frozen state, the current user is in a second restricted state.

[0052] Query a user's account status in a non-relational database:

[0053] If the account status is in the first restricted state, the user will be forced to log in again;

[0054] If the account status is the second restricted status, then check the relational database to see if the user has any permissions that are frozen. If so, then the user is prohibited from accessing the database; otherwise, the user is allowed to access the database.

[0055] The present invention also discloses a server, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the above-described user authentication method.

[0056] It should be noted that the embodiments of the present invention have better implementability and are not intended to limit the present invention in any way. Any person skilled in the art may use the above-disclosed technical content to change or modify it into equivalent effective embodiments. However, any modifications or equivalent changes and modifications made to the above embodiments based on the technical essence of the present invention without departing from the content of the technical solution of the present invention shall still fall within the scope of the technical solution of the present invention.

Claims

1. A user authentication method, characterized in that, A user is associated with one or more roles, and each role is configured with one or more permissions; if one of the permissions of the multiple roles associated with a user is in a changed state, the current user is in a first restricted state; if one of the permissions of the multiple roles associated with a user is in a frozen state, the current user is in a second restricted state; the user authentication method includes the following steps: Query the user's account status in a non-relational database, where the account status includes the first restriction status and the second restriction status; If the account status is the first restricted status, then the user is forced to log in again; If the account status is the second restricted status, then check the relational database to see if the user has any permissions that are frozen. If so, then the user is prohibited from accessing the database; otherwise, the user is allowed to access the database. The roles include the job position associated with the user and the organization to which the user belongs; If one of the permissions of the multiple roles associated with the user is in a changed state, then the current user is in a first restricted state, which includes: if one of the permissions of the job associated with the user and / or the organization to which the user belongs is in a changed state, then the current user is in a first restricted state. If one of the permissions of the multiple roles associated with the user is frozen, then the current user is in the second restricted state, which includes: if one of the permissions of the job associated with the user and / or the organization to which the user belongs is frozen, then the current user is in the second restricted state. The process of querying a user's account status in a non-relational database also includes: Retrieve the user's login token in a non-relational database; If the user's login token is found, continue querying the user's account status in the non-relational database; If the user's login token is not found, the user's access is prohibited.

2. The user authentication method according to claim 1, characterized in that, The account status also includes normal status and frozen status; The querying of a user's account status in a non-relational database includes: If the account status is normal, the user is allowed to access; if the account status is frozen, the user is prohibited from accessing.

3. The user authentication method according to claim 1, characterized in that, The step of verifying in the relational database whether the user has any permissions that are frozen also includes: The account status retrieved from the relational database is saved to a non-relational database.

4. The user authentication method according to claim 1, characterized in that, The process of querying a user's account status in a non-relational database also includes: Check if it is available in a non-relational database; If available, query the user's account status in the non-relational database; if unavailable, query the user's account status in the relational database.

5. A user authentication method for use in the field of traffic management, characterized in that, Includes the user authentication method described in any one of claims 1-4 above; The organizations to which the user belongs include service areas, toll stations, parking areas, monitoring centers, and maintenance centers; The account status of the user associated with the monitoring center is refreshed in the non-relational database at a first preset time, and the account status of the user associated with the service area, toll station, parking area, and maintenance center is refreshed at a second preset time; the first preset time is less than the second preset time.

6. A user authentication system, characterized in that, This includes relational databases and non-relational databases; a user is associated with one or more roles, and each role is configured with one or more permissions; if one of the permissions of the multiple roles associated with a user is in a changed state, then the current user is in a first restricted state; If one of the permissions of the multiple roles associated with a user is frozen, then the current user is in a second restricted state. Query the user's account status in a non-relational database, where the account status includes the first restriction status and the second restriction status; If the account status is the first restricted status, then the user is forced to log in again; If the account status is the second restricted status, then check the relational database to see if the user has any permissions that are frozen. If so, then the user is prohibited from accessing the database; otherwise, the user is allowed to access the database. The roles include the job position associated with the user and the organization to which the user belongs; If one of the permissions of the multiple roles associated with the user is in a changed state, then the current user is in a first restricted state, which includes: if one of the permissions of the job associated with the user and / or the organization to which the user belongs is in a changed state, then the current user is in a first restricted state. If one of the permissions of the multiple roles associated with the user is frozen, then the current user is in the second restricted state, which includes: if one of the permissions of the job associated with the user and / or the organization to which the user belongs is frozen, then the current user is in the second restricted state. The process of querying a user's account status in a non-relational database also includes: Retrieve the user's login token in a non-relational database; If the user's login token is found, continue querying the user's account status in the non-relational database; If the user's login token is not found, the user's access is prohibited.

7. A server, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the user authentication method as described in any one of claims 1-4.

Images