Identity authentication method, system, device, apparatus and storage medium

Abstract

The application provides an identity authentication method, system, device, equipment and storage medium. In the method, a connector client is associated with an identity authentication system corresponding to at least one target application, and a session connection is established between the connector client and at least one connector server. The session connection is an outbound connection from the connector client to the connector server. Based on the session connection, if an identity authentication request for the identity authentication system corresponding to the target application is received from the connector server, the identity authentication request is sent to the identity authentication system, and an identity authentication page fed back by the identity authentication system is sent to the connector server. Based on the session connection between the connector client and the connector server, the identity authentication is performed through the identity authentication system in the intranet, so that the identity authentication system in the intranet is not exposed to the Internet, and the target application can be deployed in the Internet.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security, and particularly relates to an identity authentication method, system, device, equipment and storage medium. BACKGROUND

[0002] With the development of cloud computing technology, enterprise applications can be widely distributed in public clouds, private clouds and hybrid clouds, and enterprise employees' access requirements for enterprise applications also show new changes, such as mobilization, remote office, access of third-party partners and the like. Enterprises need to provide services for increasingly diversified and widely distributed users, and also need to ensure the security of applications.

[0003] In the related art, enterprises publish applications on a distributed cloud computing environment (such as CDN, cloud WAF, edge computing, etc.) to meet the trend of mobile office of employees, and the employees no longer need to access the nearest edge node by using VPN when accessing the applications, but directly access the nearest edge node, perform necessary identity authentication and permission check on the edge node, and then access the application that can be authorized to access. Under such business deployment, employees need to access the identity authentication system, some enterprises use external identity authentication systems, and the edge node can interact with the external identity authentication system to perform identity authentication and permission control on the employees. Some other enterprises use self-built identity authentication systems to perform identity authentication and permission control on the employees. Since the self-built identity authentication system is mostly in the enterprise, it is limited by the existing business architecture and security considerations, and cannot be exposed to the Internet, so it is impossible to deploy the business on the Internet. SUMMARY

[0004] The application provides an identity authentication method, system, device, equipment and storage medium, which realizes identity authentication of a user by using an identity authentication system corresponding to a target application without exposing the self-built identity authentication system corresponding to the target application to the Internet, so as to realize deployment of a business corresponding to the target application on the Internet.

[0005] The first aspect embodiment of the application provides an identity authentication method, which is applied to a connector client, the connector client is associated with at least one identity authentication system corresponding to a target application, a session connection is established between the connector client and at least one connector server, the session connection is an outbound connection from the connector client to the at least one connector server, and the method comprises the following steps.

[0006] Based on the session connection, if an identity authentication request for the identity authentication system corresponding to the target application sent by a target terminal and forwarded by a connector server is received, the identity authentication request is sent to the identity authentication system;

[0007] The identity authentication page fed back by the identity authentication system is sent to the connector server, and the identity authentication page is used for inputting user identity information to complete identity authentication.

[0008] The second aspect embodiment of the application provides an identity authentication method, applied to a connector server, and a session connection is established between the connector server and at least one connector client, the session connection is an outbound connection from the connector client to the connector server, and the connector client is associated with an identity authentication system corresponding to at least one target application, and the method comprises the following steps:

[0009] An identity authentication request for an identity authentication system corresponding to a target application is received, the identity authentication request being sent by a target terminal and forwarded by an edge node server;

[0010] A target connector client corresponding to the identity authentication system is determined;

[0011] According to a session connection corresponding to the target connector client, the identity authentication request is forwarded to the target connector client.

[0012] The third aspect embodiment of the application provides an identity authentication method, applied to an edge node server, and the method comprises the following steps:

[0013] An identity authentication request for an identity authentication system corresponding to a target application is received, the identity authentication request being sent by a target terminal and forwarded by an edge node server;

[0014] According to the identity authentication system, address information of a connector server corresponding to the identity authentication system is determined;

[0015] According to the address information of the connector server, the identity authentication request is forwarded to the connector server, so that the connector server forwards the identity authentication request to a target connector client according to a session connection between the connector server and the target connector client.

[0016] The fourth aspect embodiment of the application provides an identity authentication method, applied to a management platform, and the method comprises the following steps:

[0017] Application configuration information corresponding to a target application is generated, the application configuration information comprising at least one of the following: an identifier of the target application, a back-to-source address, identifier information of an associated connector client, identifier information of an associated identity authentication system, an identity authentication strategy, and an access permission control strategy; and the identifier information of the identity authentication system comprises at least one of the following: a domain name, an IP address, and a port of the identity authentication system.

[0018] generate authentication configuration information and domain name record of the identity authentication system corresponding to the target application, the authentication configuration information at least including identification information of a connector client associated with the identity authentication system, and the domain name record including a mapping relationship between address information of the identity authentication system and an IP address of the edge node server;

[0019] send the application configuration information of the target application and the authentication configuration information of the identity authentication system;

[0020] send the domain name record of the identity authentication system required by the DNS server.

[0021] The fifth aspect embodiment of the present application provides an identity authentication system, comprising: a management platform, an edge node server, a connector server and a connector client, wherein:

[0022] The management platform is configured to generate application configuration information of a target application, and generate authentication configuration information and domain name record of an identity authentication system corresponding to the target application; send the application configuration information of the target application and the authentication configuration information of the identity authentication system, and send the domain name record of the identity authentication system required by the DNS server.

[0023] The edge node server is configured to receive an access request for the target application sent by a target terminal, the access request containing identification of the target application; if it is determined that the access request does not include an identity credential, redirect the target terminal to an access address of the identity authentication system corresponding to the target application; and further configured to receive an identity authentication request for the identity authentication system corresponding to the target application sent by the target terminal; and according to identification information of the identity authentication system contained in the identity authentication request, send the identity authentication request to the corresponding connector server.

[0024] The connector server is configured to receive the identity authentication request sent by the edge node server; according to a session connection established with the connector client in advance, forward the identity authentication request to the corresponding connector client, and send an identity authentication page forwarded by the connector client to the edge node server.

[0025] The connector client is configured to receive the identity authentication request sent by the connector server, forward the identity authentication request to the corresponding identity authentication system, and send an identity authentication page fed back by the identity authentication system to the connector server.

[0026] The sixth aspect of the present application provides an identity authentication device, applied to a connector client, the connector client being associated with an identity authentication system corresponding to at least one target application, a session connection being established between the connector client and at least one connector server, the session connection being an outbound connection from the connector client to the at least one connector server, comprising:

[0027] A first sending module is configured to send, based on the session connection, an identity authentication request for the identity authentication system corresponding to the target application if the identity authentication request sent by the target terminal and forwarded by the connector server is received.

[0028] A second sending module is configured to send an identity authentication page fed back by the identity authentication system to the connector server, the identity authentication page being used for inputting user identity information to complete identity authentication.

[0029] The seventh aspect of the present application provides an identity authentication device, applied to a connector server, the connector server having a session connection established with at least one connector client, the session connection being an outbound connection from the connector client to the connector server, the connector client being associated with an identity authentication system corresponding to at least one target application, comprising:

[0030] A first receiving module is configured to receive an identity authentication request for the identity authentication system corresponding to the target application and sent by a target terminal and forwarded by an edge node server.

[0031] A first determining module is configured to determine a target connector client corresponding to the identity authentication system.

[0032] A third sending module is configured to forward the identity authentication request to the target connector client according to a session connection corresponding to the target connector client.

[0033] The eighth aspect of the present application provides an identity authentication device, applied to an edge node server, comprising:

[0034] A second receiving module is configured to receive an identity authentication request for the identity authentication system corresponding to the target application and sent by a target terminal, the identity authentication request comprising identification information of the identity authentication system.

[0035] A second determining module is configured to determine address information of a connector server corresponding to the identity authentication system according to the identification information of the identity authentication system.

[0036] The fourth sending module is configured to forward the identity authentication request to the connector server according to the address information of the connector server, so that the connector server forwards the identity authentication request to the target connector client according to a session connection between the connector server and the target connector client.

[0037] The ninth aspect of the present application provides an identity authentication device, applied to a management platform, comprising:

[0038] The generating module is configured to generate application configuration information corresponding to the target application, the application configuration information comprising at least one of an identity of the target application, a back-to-source address, identity information of an associated connector client, identity information of an associated identity authentication system, an identity authentication policy, and an access permission control policy; the identity information of the identity authentication system comprising at least one of a domain name, an IP address, and a port of the identity authentication system; generate authentication configuration information and domain name records of the identity authentication system corresponding to the target application, the authentication configuration information comprising at least the identity information of the connector client associated with the identity authentication system; and the domain name records comprising a mapping relationship between the address information of the identity authentication system and the IP address of the edge node server.

[0039] The fifth sending module is configured to send the application configuration information of the target application and the authentication configuration information of the identity authentication system, and send the domain name records of the identity authentication system required by the DNS server.

[0040] The tenth aspect of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method of any one of the first to fourth aspects.

[0041] The eleventh aspect of the present application provides a computer-readable storage medium having a computer program stored thereon, wherein the program is executed by a processor to implement the method of any one of the first to fourth aspects.

[0042] The technical solutions provided in the embodiments of the present application have at least the following technical effects or advantages:

[0043] In the embodiment of the present application, based on the outgoing session connection between the connector client and the connector server, identity authentication of a user is implemented through the identity authentication system in the intranet, the identity authentication system in the intranet is not exposed to the Internet, and the target application in the intranet can be deployed in the Internet based on the identity authentication function of the identity authentication system. The target terminal can access the target application in the intranet without using a VPN server, and the problem of unstable and difficult-to-maintain VPN servers is solved. The target application is directly published to the public network, and the user access experience is better. Whether the user passes the identity authentication is judged by the edge node server, and the user who does not pass the authentication is redirected to the corresponding identity authentication system, and the access permission authentication is performed through the edge node server, so that the risk of malicious attacks is eliminated. The target application in the intranet can be SaaS without modifying the original network topology. In addition, by increasing the number of edge node servers and connector servers, expansion can be easily performed, and the application scenario with a large number of target users can be adapted.

[0044] Additional aspects and advantages of the application will be set forth in part in the description which follows, and in part will become apparent to those skilled in the art upon examination of the following and / or can be learned by practice of the application. BRIEF DESCRIPTION OF DRAWINGS

[0045] Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The accompanying drawings are included to provide a description of the preferred embodiments and are not meant to limit the present application. Furthermore, the same reference numerals are used throughout the several views of the drawings to designate the same or similar parts.

[0046] In the drawings:

[0047] Figure 1 A schematic diagram of an exemplary system architecture to which the technical solutions of the embodiments of the present application can be applied is shown;

[0048] Figure 2 A signaling interaction diagram of an identity authentication method provided by an embodiment of the present application is shown;

[0049] Figure 3 An operation flowchart of a connector client in an identity authentication method provided by an embodiment of the present application is shown;

[0050] Figure 4 An operation flowchart of a connector server in an identity authentication method provided by an embodiment of the present application is shown;

[0051] Figure 5 An operation flowchart of an edge node server in an identity authentication method provided by an embodiment of the present application is shown;

[0052] Figure 6 An operation flow chart of a management platform in an identity authentication method provided by an embodiment of the present application is shown;

[0053] Figure 7 A structural schematic diagram of an identity authentication device applied to a connector client provided by an embodiment of the present application is shown;

[0054] Figure 8 A structural schematic diagram of an identity authentication device applied to a connector server provided by an embodiment of the present application is shown;

[0055] Figure 9 A structural schematic diagram of an identity authentication device applied to an edge node server provided by an embodiment of the present application is shown;

[0056] Figure 10 A structural schematic diagram of an identity authentication device applied to a management platform provided by an embodiment of the present application is shown;

[0057] Figure 11 A structural schematic diagram of an electronic device provided by an embodiment of the present application is shown;

[0058] Figure 12 A schematic diagram of a storage medium provided by an embodiment of the present application is shown. DETAILED DESCRIPTION

[0059] Exemplary embodiments of the present application will be described herein below with reference to the accompanying drawings. Although exemplary embodiments of the present application are shown in the drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided so that the present application can be more thoroughly and completely understood, and so that the scope of the present application can be accurately conveyed to those skilled in the art.

[0060] It should be noted that, unless otherwise specified, technical terms or scientific terms used in the present application should be understood as their common meanings by those skilled in the art to which the present application belongs.

[0061] An identity authentication method, system, device, equipment and storage medium according to embodiments of the present application are described below in conjunction with the accompanying drawings.

[0062] An identity authentication method provided by an embodiment of the present application is described below with reference to Figure 1The network system architecture based on the method comprises a connector client, a connector server, an edge node server, a management platform and a target terminal. The server configured with one or more connectors is referred to as a connector client, and the connector can be a software program for network communication. The connector client can be associated with at least one target application through the connector configured by itself. Specifically, each connector in the connector client can be in communication connection with one or more target applications. In an example, the target application can be an application in the intranet of a group such as an enterprise or a social organization, such as an OA system, a Web (website), an SSH (Secure Shell), a VNC (Virtual Network Console), an RDP (Remote Desktop Protocol), an internal IAM (Identity and Access Management), etc. In another example, the target application can also be an application program in the public network.

[0063] An internal identity authentication system such as AD, SAML, OIDC, CAS, etc. is also provided in the intranet. The target application in the intranet can correspond to the internal identity authentication system, and a user accessing the target application needs to be authenticated by the identity authentication system corresponding to the target application. The connector client is associated with the identity authentication system corresponding to at least one target application. Figure 1 The connector client is connected to the application system and the identity authentication system in the intranet, as shown in the middle of FIG. 1. The application system comprises one or more target applications.

[0064] The connector server can be a server capable of communicating with the connector client, and a session connection for transmitting information can be established between the connector server and the connector client. It should be understood that the address information of the connector server can comprise a domain name and / or an IP address. If it is a domain name, the domain name can be resolved to one or more IP addresses of the connector server. It should be noted that one connector server can communicate with one or more connector clients, and one connector client can also be connected to one or more connector servers, which is not specially limited in the present application.

[0065] The connector client establishes a session connection with the connector server, and the session connection is an outgoing communication connection, which can be a TCP (Transmission Control Protocol) connection, an HTTPS (Hyper Text Transfer Protocol over Secure Socket Layer) connection, an SSL / TLS connection, or the like. The edge node server communicates with the connector server and the target terminal, and the management platform communicates with the edge node server.

[0066] It should be noted that the target terminal in the above can include one or more of a smartphone, a tablet computer, a portable computer, or a desktop computer. It should be understood that Figure 1 The number of target terminals, edge node servers, management platforms, connector servers, and connector clients in the above is only illustrative, and any number of target terminals, edge node servers, management platforms, connector servers, and connector clients can be provided according to implementation needs. For example, the network architecture can include one or more edge node servers and one or more connector servers, Figure 1 Only one edge node server and one connector server are shown in the above.

[0067] It should be noted that the edge node server and the connector server mentioned in the embodiments of the present application are two logical concepts, which are separated for the purpose of understanding. In practice, they can be deployed separately or on the same server device, and the present application does not make special limitations thereon.

[0068] Based on the above network architecture, identity authentication of a user accessing a target application is implemented through an identity authentication system in an intranet, which does not expose the identity authentication system to the Internet, ensuring the security of the identity authentication system in the intranet and directly publishing the target application in the intranet to the public network. The original network topology does not need to be modified to SaaS (Software-as-a-Service) the target application in the intranet. Moreover, by increasing the number of edge node servers and connector servers, the capacity can be easily expanded, and the application scenario with a large number of target users can be adapted.

[0069] The implementation details of the technical solutions of the embodiments of the present application are described in detail as follows:

[0070] Figure 2 A signaling interaction diagram of an identity authentication method provided by an embodiment of the present application is shown. Referring to Figure 2 The method includes at least steps 101 to 115, which are described in detail as follows:

[0071] Step 101: The management platform generates application configuration information corresponding to the target application, the application configuration information including at least one of an identifier of the target application, a back-to-source address, identification information of an associated connector client, identification information of an associated identity authentication system, an identity authentication policy, and an access permission control policy; the identification information of the identity authentication system including at least one of a domain name, an IP address, and a port of the identity authentication system.

[0072] The management platform can be a cloud computing platform, such as a private cloud or a public cloud. Before accessing the target application, the management platform generates the application configuration information corresponding to the target application. Specifically, the management platform can support user configuration operations, and the user determines the target applications allowed for remote access according to the user's own needs, and then configures the application configuration information corresponding to the target applications on the management platform. The management platform can receive and store the application configuration information configured by the user, and associate the application configuration information with the corresponding target application.

[0073] The application configuration information generated by the management platform includes at least one of an identifier of the target application, a back-to-source address, identification information of an associated connector client, identification information of an associated identity authentication system, an identity authentication policy, and an access permission control policy.

[0074] The identifier of the target application can include a domain name of the target application, and the back-to-source address can include an IP address of a device where the target application is located and a port number opened to the outside by the device where the target application is located. The identification information of the associated connector client can include an IP address, a MAC (Media Access Control Address, hardware address) address, or a character sequence artificially set or automatically generated to uniquely identify the connector client. The identification information of the associated identity authentication system can include a domain name and an IP address of the identity authentication system. The identity authentication policy can be used to specify the identity authentication method of the target user, and the access permission control policy can be used to specify the user identity having access permission to the target application.

[0075] Step 102: The management platform generates authentication configuration information of the identity authentication system corresponding to the target application and domain name records, the authentication configuration information including at least the identification information of the connector client associated with the identity authentication system; and the domain name records including a mapping relationship between the domain name of the identity authentication system and the IP address of the edge node server.

[0076] Before accessing the target application, the management platform generates the authentication configuration information of the identity authentication system corresponding to the target application. Specifically, the management platform can support the configuration operation of the user, and the user determines the target application allowed to be remotely accessed and the identity authentication system corresponding to the target application according to the demand of the user, and then configures the authentication configuration information of the identity authentication system corresponding to the target application on the management platform. The management platform can receive and store the authentication configuration information configured by the user, and associate the authentication configuration information with the corresponding identity authentication system.

[0077] In an exemplary embodiment, the authentication configuration information can include the identification information of the identity authentication system and the identification information of the connector client associated with the identity authentication system. The identification information of the identity authentication system can be the domain name, IP address, etc. of the identity authentication system. The identification information of the connector client associated with the identity authentication system can include the IP address, MAC address, or character sequence artificially set or automatically generated to uniquely identify the connector client.

[0078] Through the operations of steps 101 and 102, the application configuration information corresponding to the target application and the authentication configuration information of the identity authentication system corresponding to the target application are generated on the management platform, and the target application is associated with the connector client by setting the identification information of the associated connector client in the application configuration information. The identity authentication system corresponding to the target application is associated with the connector client by setting the identification information of the connector client associated with the target application in the authentication configuration information.

[0079] It should be noted that the target application or the identity authentication system and the connector client can be in the same network, for example, both belong to the internal network, both belong to the public network, or belong to the same C segment network, etc. The target application or the identity authentication system and the connector client can also be in different networks, for example, one in the public network and the other in the internal network, etc. The present application does not make special limitation, as long as the target application or the identity authentication system and the connector client can communicate.

[0080] In some embodiments of the present application, before, after or at the same time as generating the authentication configuration information of the identity authentication system corresponding to the target application on the management platform, the domain name record corresponding to the identity authentication system is also generated, which includes the mapping relationship between the domain name of the identity authentication system and the IP address of the edge node server. The identity authentication system in the internal network is associated with the specified edge node server through the domain name record, so as to forward the communication data related to the identity authentication system by the specified edge node server.

[0081] Step 103: The management platform sends the application configuration information of the target application and the authentication configuration information of the identity authentication system.

[0082] The management platform can actively send the application configuration information of the target application and the authentication configuration information of the identity authentication system to each edge node server. The management platform can also send the application configuration information of the target application to each edge node server upon receiving a request from the edge node server for the application configuration information of the target application. In addition, the management platform can send the authentication configuration information of the identity authentication system corresponding to the target application to each edge node server upon receiving a request from the edge node server for the authentication configuration information of the identity authentication system corresponding to the target application.

[0083] Alternatively, the management platform can send the application configuration information of the target application to a configuration center or other intermediate medium, and the edge server obtains the application configuration information of the target application from the intermediate medium. The management platform can also send the authentication configuration information of the identity authentication system corresponding to the target application to an identity authentication module, and the edge server obtains the authentication configuration information of the identity authentication system from the identity authentication module.

[0084] Step 104: The management platform sends the domain name record of the identity authentication system required by the DNS server.

[0085] The management platform sends the domain name record of the identity authentication system to the DNS server, and the DNS server stores the domain name record of the identity authentication system. The domain name record includes the mapping relationship between the domain name of the identity authentication system and the IP address of the edge node server. After the DNS server stores the domain name record of the identity authentication system, if it receives a domain name resolution request for the identity authentication system, the domain name resolution request includes the domain name of the identity authentication system. The DNS server can return a domain name resolution result according to the domain name record of the identity authentication system, and the domain name resolution result includes the IP address of the edge node server corresponding to the domain name of the identity authentication system in the domain name record.

[0086] In addition to the above-mentioned application configuration information of the target application and the authentication configuration information of the identity authentication system, the management platform also generates connector configuration information corresponding to the connector client, which at least includes the identification information of the connector client and the address information of the connector server corresponding to the connector client. The identification information of the connector client includes the IP address, MAC address, or artificially set or automatically generated character sequence that can uniquely identify the connector client. The address information of the connector server can include a domain name and / or an IP address.

[0087] The management platform also sends the connector configuration information to each edge node server, or sends the connector configuration information to a configuration center or other intermediate medium, and then forwards it to the corresponding edge node server by the intermediate medium.

[0088] After the above operation is completed, the target application is published to the Internet. If a user needs to access a target application, the target terminal sends an access request for the target application to the edge node server, and the access request includes the identification of the target application.

[0089] The target terminal can be a user's mobile phone or computer device. The edge node server can be the edge node server closest to the location of the target terminal or the edge node server with the best network quality in the CDN (Content Delivery Network). The identification of the target application can include the domain name of the target application and / or the IP address of the physical device deploying the target application.

[0090] In a specific application scenario, when an employee working from home or on business needs to access a target application in the company intranet, the target terminal views multiple target applications published by the company on the public network and selects the target application that needs to be accessed, for example, by clicking. When the target terminal detects that a target application is clicked, the domain name of the clicked target application is obtained, and a resolution request for the domain name of the target application is sent to the domain name server. The domain name server resolves the domain name of the target application. Since all target applications published to the public network have their domain names resolved to the IP address of the edge node server, the domain name server can obtain the IP address of the corresponding edge node server by resolving the domain name of the current target application. The domain name server returns the IP address obtained by resolving the domain name to the target terminal. The target terminal sends an access request to the corresponding edge node server according to the IP address.

[0091] The edge node server receives the access request for the target application sent by the target terminal, and judges whether the information carried in the access request includes an identity credential. The identity credential is a credential generated by the user through the identity authentication of the identity authentication system corresponding to the target application.

[0092] If it is judged that the access request includes an identity credential, it means that the user has passed the authentication of the identity authentication system corresponding to the target application before initiating the current access request, and does not need to perform identity authentication again. Therefore, the edge node server obtains the application configuration information of the target application according to the identification of the target application included in the access request. The access request is authenticated according to the access permission control policy included in the application configuration information. If the access request passes the access permission authentication, the identification information of the connector client associated with the target application is obtained from the application configuration information of the target application.

[0093] According to the identification information of the connector client, the address information of the target connector server is obtained from the connector configuration information corresponding to the connector client obtained from the management platform or the configuration center. According to the address information of the target connector server, the access request is forwarded to the target connector server. The target connector server determines the connector client associated with the target application, and forwards the access request to the connector client through a session connection between the target connector server and the connector client. After the connector client receives the access request, the connector client forwards the access request to the corresponding target application according to the identification of the target application included in the access request. The target application feeds back request response information to the connector client after processing the access request. The connector client forwards the request response information to the connector server. The connector server forwards the request response information to the target terminal through the edge node server.

[0094] If the access permission authentication of the edge node server to the access request fails, the access request is discarded. In this case, the edge node server can also return prompt information to the target terminal that does not have access permission.

[0095] If it is determined that the access request does not include identity credentials, the target terminal is redirected to the access address of the identity authentication system corresponding to the target application. Specifically, if the edge node server determines that the received access request does not include identity credentials, it indicates that the user has not been authenticated by the identity authentication system corresponding to the target application before initiating the current access request, and therefore needs to be authenticated first. The edge node server redirects the target terminal to the access address of the identity authentication system corresponding to the target application, so that the target terminal sends an identity authentication request to the access address of the identity authentication system. The access address of the identity authentication system can include the domain name of the identity authentication system and / or the IP address of the edge server corresponding to the identity authentication system.

[0096] In an implementation manner, the edge node server sends a redirection instruction for the identity authentication system to the target terminal, and the redirection instruction carries the access address of the identity authentication system. If the access address is the domain name of the identity authentication system, the target terminal receives the redirection instruction, and first sends a domain name resolution request to the DNS server, and the domain name resolution request carries the access address of the identity authentication system. The DNS server obtains the IP address of the edge node server corresponding to the access address of the identity authentication system from the domain name record stored locally according to the access address of the identity authentication system, and returns the IP address of the edge node server to the target terminal. The target terminal sends an identity authentication request for the identity authentication system corresponding to the target application to the edge node server according to the IP address of the edge node server, and the identity authentication request includes the identification information of the identity authentication system.

[0097] In another implementation, an identity authentication module is also deployed in the whole system architecture, and the management platform sends the authentication configuration information of the identity authentication system to the identity authentication module. If the edge node server judges that the received access request does not include an identity credential, the edge node server can redirect the access request to the identity authentication module. The identity authentication module receives the access request, determines the identity authentication system corresponding to the identity of the target application carried in the access request, and then determines the authentication configuration information corresponding to the identity authentication system, determines that the identity authentication system corresponding to the access request is the identity authentication system in the intranet, and therefore redirects the target terminal to the access address of the identity authentication system. If the identity authentication module determines that there is no authentication configuration information corresponding to the identity information of the identity authentication system, it is determined that the identity authentication system is a third-party identity authentication system, and the target terminal is redirected to the third-party identity authentication system.

[0098] It should be noted that the edge node server and the identity authentication module mentioned in the embodiments of the present application are two logical concepts, which are separated for the purpose of understanding. In practice, they can be deployed separately or on the same device, and the present application does not make special limitations.

[0099] The present application judges whether the user has passed the identity authentication through the edge node server, and redirects the user who has not passed the identity authentication to the access address of the corresponding identity authentication system. For the user who has passed the identity authentication, the access permission of the user is verified through the access permission control policy corresponding to the target application. Only the access request that has passed the identity authentication and the access permission authentication will be forwarded to the connector server, and then finally forwarded to the corresponding target application, thereby improving the access security of the target application.

[0100] Step 105: The edge node server receives the identity authentication request for the identity authentication system corresponding to the target application sent by the target terminal, and determines the address information of the connector server corresponding to the identity authentication system according to the identity authentication system identification information included in the identity authentication request.

[0101] The identity authentication system identification information can include but is not limited to the domain name of the identity authentication system, the IP address of the physical device deploying the identity authentication system, or a character sequence that can uniquely identify the connector client and is artificially set or automatically generated.

[0102] The edge node server receives the identity authentication request, acquires authentication configuration information corresponding to the identity authentication system according to the identity authentication system identification information included in the identity authentication request, acquires the identity authentication system corresponding connector client identification information from the authentication configuration information, acquires the connector client corresponding connector configuration information according to the connector client identification information, and acquires the identity authentication system corresponding connector server address information from the connector configuration information.

[0103] Step 106: The edge node server forwards the identity authentication request to the connector server according to the connector server address information, so that the connector server forwards the identity authentication request to the target connector client according to the session connection between the corresponding target connector client.

[0104] Step 107: The connector server receives the identity authentication request sent by the target terminal for the target application corresponding identity authentication system forwarded by the edge node server, and determines the target connector client corresponding to the identity authentication system.

[0105] The connector server receives the identity authentication request forwarded by the edge node server, acquires the authentication configuration information corresponding to the identity authentication system according to the identity authentication system identification information included in the identity authentication request, and acquires the target connector client identification information associated with the identity authentication system from the authentication configuration information.

[0106] Step 108: The connector server forwards the identity authentication request to the target connector client according to the session connection corresponding to the target connector client.

[0107] The connector server determines the session connection corresponding to the target connector client according to the target connector client identification information associated with the identity authentication system, and forwards the identity authentication request to the target connector client through the session connection.

[0108] Step 109: The connector client sends the identity authentication request sent by the target terminal for the target application corresponding identity authentication system to the target application corresponding identity authentication system based on the session connection between the connector server and the connector client.

[0109] The connector client forwards the identity authentication request to the corresponding identity authentication system according to the identity authentication system identification information included in the identity authentication request if the connector client receives the identity authentication request forwarded by the connector server.

[0110] The identity authentication system receives the identity authentication request and returns an identity authentication page to the associated connector client. The identity authentication page is used for the user to input user identity information to complete identity authentication.

[0111] Step 110: The connector client sends the identity authentication page fed back by the identity authentication system to the connector server.

[0112] After the connector client receives the identity authentication page returned by the identity authentication system, the connector client sends the identity authentication page to the connector server through the session connection between the connector client and the connector server.

[0113] Step 111: The connector server receives the identity authentication page forwarded by the target connector client based on the session connection between the target connector client and the connector server, and forwards the identity authentication page to the target terminal via the edge node server.

[0114] After the connector server receives the identity authentication page, the connector server sends the identity authentication page to the edge node server, which can be the edge node server that previously forwarded the identity authentication request to the connector server. After the edge node server receives the identity authentication page, the edge node server forwards the identity authentication page to the target terminal.

[0115] After the target terminal receives the identity authentication page, the target terminal renders and displays the identity authentication page. The user can input his own identity information in the displayed identity authentication page, and the target terminal obtains the user identity information input by the user from the identity authentication page. Alternatively, the identity authentication page can include a scan code interface, and the target terminal detects that the user clicks the scan code interface, and calls the camera of the target terminal to scan a graphical code such as a two-dimensional code or a bar code containing user identity information, and parses the scanned graphical code to obtain user identity information. Alternatively, the identity authentication page can include a fingerprint acquisition interface, and the target terminal displays the identity authentication page and calls a fingerprint recording device on the target terminal, which can include a home button or a touch screen of the target terminal. The target terminal acquires the fingerprint information of the user through the fingerprint recording device, and takes the fingerprint information as the user identity information. Alternatively, the identity authentication page can include a face recognition interface, and the target terminal displays the identity authentication page and detects that the user clicks the face recognition interface, and then calls the camera of the target terminal, prompts the user to place his face in the shooting area of the camera, and takes an image of the face of the user through the camera, and takes the obtained face image as the user identity information. Alternatively, the target terminal can also extract face feature information from the taken face image, and take the extracted face feature information as the user identity information.

[0116] The above only lists some specific ways in which the target terminal obtains user identity information through the identity authentication page by way of example. However, the way in which the target terminal obtains user identity information through the identity authentication page is not limited to the above examples, and any way in which the target terminal can obtain user identity information through the identity authentication page is within the scope of the present application.

[0117] After the target terminal obtains the user identity information through the identity authentication page, the target terminal sends the user identity information to the edge node server.

[0118] Step 112: The edge node server receives the user identity information sent by the target terminal and forwards the user identity information to the connector server.

[0119] Step 113: The connector server forwards the user identity information to the target connector client through a session connection between the connector server and the target connector client. The target connector client then forwards the user identity information to the identity authentication system.

[0120] The identity authentication system performs identity authentication on the user identity information and returns the authentication result to the target connector client.

[0121] Step 114: The target connector client sends the authentication result to the connector server through a session connection between the target connector client and the connector server.

[0122] Step 115: The connector server receives the authentication result of the user identity information sent by the target connector client and forwards the authentication result to the target terminal via the edge node server.

[0123] If the identity authentication system authenticates the user identity information successfully, the authentication result can include an identity credential proving that the identity authentication is successful. If the identity authentication system fails to authenticate the user identity information, the authentication result can include prompt information prompting that the identity authentication fails.

[0124] After the target terminal obtains the authentication result including the identity credential, the target terminal can initiate an access request for the target application, and the access request includes the identity credential. After the edge node server receives the access request, determines that the access request includes the identity credential, and verifies that the access request passes the access permission, the edge node server forwards the access request to the target application via the connector server and the connector client associated with the target application in sequence. After the target application feeds back request response information corresponding to the access request to the corresponding connector client, the target application forwards the request response information to the target terminal via the connector server and the edge node server in sequence.

[0125] In the embodiments of the present application, based on the outgoing session connection between the connector client and the connector server, identity authentication of a user is implemented through the identity authentication system in the intranet, so that the identity authentication system in the intranet is not exposed to the Internet, and the target application in the intranet can be deployed in the Internet based on the identity authentication function of the identity authentication system. The target terminal can access the target application in the intranet without using a VPN server, solving the problem of unstable and difficult-to-maintain VPN servers. The target application is directly published to the public network, and the user access experience is better. The edge node server judges whether the user has passed the identity authentication, and redirects the user who has not passed the authentication to the corresponding identity authentication system, and performs access permission authentication through the edge node server, eliminating the risk of malicious attacks. The original network topology does not need to be modified to SaaS the target application in the intranet. In addition, by increasing the number of edge node servers and connector servers, the capacity can be easily expanded, and the application scenario with a large number of target users can be adapted.

[0126] Some other embodiments of the present application provide an identity authentication method applied to a connector client. Referring to Figure 3 , the method specifically includes the following steps:

[0127] Step 201: Based on the session connection, if the identity authentication request sent by the target terminal for the identity authentication system corresponding to the target application is received and forwarded by the connector server, the connector client sends the identity authentication request to the identity authentication system.

[0128] The connector client and at least one connector server establish a session connection, which is an outbound connection from the connector client to at least one connector server. The connector client is associated with at least one target application corresponding to an identity authentication system.

[0129] After the connector client receives the identity authentication request forwarded by the connector server, according to the identity authentication system identification information included in the identity authentication request, the connector client forwards the identity authentication request to the corresponding identity authentication system.

[0130] Step 202: The connector client sends the identity authentication page fed back by the identity authentication system to the connector server, and the identity authentication page is used for inputting user identity information to complete identity authentication.

[0131] The identity authentication system receives the identity authentication request forwarded by the connector client, and returns an identity authentication page to the connector client. The connector client receives the identity authentication page, and sends the identity authentication page to the connector server based on the session connection between the connector client and the connector server. The connector server receives the identity authentication page, and forwards the identity authentication page to the edge node server. The edge node server sends the identity authentication page to the target terminal.

[0132] The target terminal receives the identity authentication page, renders and displays the identity authentication page. The user inputs his / her identity information in the displayed identity authentication page. The target terminal obtains the user identity information input by the user from the identity authentication page, and sends the user identity information to the edge node server. The edge node server receives the user identity information sent by the target terminal, and forwards the user identity information to the connector server. The connector server forwards the user identity information to the target connector client through the session connection between the connector server and the target connector client. The target connector client forwards the user identity information to the identity authentication system.

[0133] The identity authentication system performs identity authentication on the user identity information, and returns the authentication result to the target connector client. The target connector client sends the authentication result to the connector server through the session connection between the target connector client and the connector server. The connector server receives the authentication result of the user identity information sent by the target connector client, and forwards the authentication result to the target terminal via the edge node server.

[0134] If the identity authentication system passes the authentication on the user identity information, the authentication result includes an identity credential for proving that the identity authentication passes. If the identity authentication system fails the authentication on the user identity information, the authentication result can include prompt information for prompting that the identity authentication fails.

[0135] After the target terminal obtains the authentication result including the identity credential, the target terminal can initiate an access request for the target application, and the access request includes the identity credential. The edge node server receives the access request, determines that the access request includes the identity credential, and passes the access permission verification on the access request, and forwards the access request to the target application via the connector server associated with the target application and the connector client. After the target application feeds back the request response information corresponding to the access request to the corresponding connector client, the target application forwards the request response information to the target terminal via the connector client, the connector server, and the edge node server.

[0136] In the embodiments of the present application, the connector client receives the identity authentication request or the user identity information from the target terminal through the session connection between the connector client and the connector server, and feeds back the identity authentication page or the authentication result fed back by the identity authentication system to the target terminal. The identity authentication of the user is implemented through the identity authentication system in the intranet, which does not expose the identity authentication system in the intranet to the Internet, and can deploy the target application in the intranet to the Internet based on the identity authentication function of the identity authentication system.

[0137] Some embodiments of the present application provide an identity authentication method applied to a connector server, referring to Figure 4 , the method specifically includes the following steps:

[0138] Step 301: The connector server receives the identity authentication request for the identity authentication system corresponding to the target application sent by the target terminal and forwarded by the edge node server.

[0139] The identity authentication request can include the identification information of the identity authentication system.

[0140] Step 302: The connector server determines the target connector client corresponding to the identity authentication system.

[0141] The connector server acquires the authentication configuration information corresponding to the identity authentication system according to the identification information of the identity authentication system included in the identity authentication request, and acquires the identification information of the target connector client associated with the identity authentication system from the authentication configuration information.

[0142] Step 303: The connector server forwards the identity authentication request to the target connector client according to the session connection corresponding to the target connector client.

[0143] The connector server determines the session connection corresponding to the target connector client according to the identification information of the target connector client associated with the identity authentication system. The identity authentication request is forwarded to the target connector client through the session connection. If the target connector client receives the identity authentication request forwarded by the connector server, the target connector client forwards the identity authentication request to the corresponding identity authentication system according to the identification information of the identity authentication system included in the identity authentication request. The identity authentication system returns an identity authentication page to the associated connector client after receiving the identity authentication request. The identity authentication page is used for the user to input the user identity information to complete the identity authentication.

[0144] The connector client receives the identity authentication page returned by the identity authentication system, and sends the identity authentication page to the connector server through the session connection between the connector client and the connector server. The connector server receives the identity authentication page forwarded by the target connector client based on the session connection between the connector server and the target connector client, and forwards the identity authentication page to the target terminal via the edge node server.

[0145] The target terminal receives the identity authentication page, renders and displays the identity authentication page. The user inputs his / her identity information in the displayed identity authentication page, and the target terminal obtains the user identity information input by the user from the identity authentication page and sends the user identity information to the edge node server. The edge node server receives the user identity information sent by the target terminal and forwards the user identity information to the connector server. The connector server forwards the user identity information to the target connector client through the session connection between the connector server and the target connector client. The target connector client forwards the user identity information to the identity authentication system.

[0146] The identity authentication system performs identity authentication on the user identity information and returns the authentication result to the target connector client. The target connector client sends the authentication result to the connector server through the session connection between the target connector client and the connector server. The connector server receives the authentication result of the user identity information sent by the target connector client and forwards the authentication result to the target terminal via the edge node server.

[0147] In the embodiments of the present application, the connector server receives the identity authentication request or the user identity information from the edge node server through the session connection between the connector server and the connector client, and forwards the identity authentication request or the user identity information to the identity authentication system via the connector client. The connector server receives the identity authentication page or the authentication result fed back by the identity authentication system and forwards the identity authentication page or the authentication result to the target terminal via the edge node server. The identity authentication system in the intranet is used to perform identity authentication on the user, which does not expose the identity authentication system in the intranet to the Internet, and the target application in the intranet can be deployed in the Internet based on the identity authentication function of the identity authentication system.

[0148] Some embodiments of the present application provide an identity authentication method, which is applied to an edge node server, and the method comprises the following steps: Figure 5 The method specifically comprises the following steps:

[0149] In step 401, the edge node server receives an identity authentication request sent by a target terminal to an identity authentication system corresponding to a target application, and the identity authentication request comprises identification information of the identity authentication system.

[0150] If the edge node server receives an access request for a target application sent by a target terminal, the access request containing an identification of the target application; if it is determined that the access request does not include an identity credential, the target terminal is redirected to an access address of an identity authentication system corresponding to the target application, so that the target terminal sends an identity authentication request to the access address of the identity authentication system.

[0151] If it is determined that the access request includes an identity credential, the application configuration information of the target application is obtained according to the identification of the target application; the access request is authenticated according to the access permission control policy included in the application configuration information; if the access request passes the access permission authentication, the address information of the target connector server corresponding to the target application is obtained; the access request is forwarded to the target connector server according to the address information of the target connector server.

[0152] Step 402: The edge node server determines the address information of the connector server corresponding to the identity authentication system according to the identification information of the identity authentication system.

[0153] According to the identification information of the identity authentication system, the authentication configuration information corresponding to the identity authentication system is obtained, and the authentication configuration information at least includes the identification information of the connector client associated with the identity authentication system. According to the identification information of the connector client associated with the identity authentication system, the connector configuration information corresponding to the connector client is obtained; the address information of the connector server corresponding to the identity authentication system is obtained from the connector configuration information.

[0154] Step 403: The edge node server forwards the identity authentication request to the connector server according to the address information of the connector server, so that the connector server forwards the identity authentication request to the target connector client according to the session connection between the corresponding target connector client.

[0155] The edge node server also receives the identity authentication page sent by the connector server, and the identity authentication page is fed back by the identity authentication system according to the identity authentication request; the edge node server sends the identity authentication page to the target terminal.

[0156] The edge node server also receives the user identity information sent by the target terminal, and the user identity information is input by the target terminal through the identity authentication page; the user identity information is forwarded to the connector server; the authentication result of the identity authentication system on the user identity information is received, and the authentication result is sent to the target terminal.

[0157] In the embodiments of the present application, the edge node server determines whether the identity credential is contained in the access request, and if not, the target terminal is redirected to the access address of the identity authentication system, so that the target terminal must pass the identity authentication of the identity authentication system corresponding to the target application in the intranet before accessing the target application. And the edge node server is used to authenticate the access permission, which eliminates the risk of malicious attacks. The identity authentication of the user is realized through the identity authentication system in the intranet, which does not expose the identity authentication system in the intranet to the Internet, and can also deploy the target application in the intranet to the Internet based on the identity authentication function of the identity authentication system.

[0158] Some embodiments of the present application provide an identity authentication method, which is applied to a management platform, referring to Figure 6 , the method specifically includes the following steps:

[0159] Step 501: The management platform generates application configuration information corresponding to the target application, and the application configuration information includes at least one of the identity of the target application, the back-to-source address, the identification information of the associated connector client, the identification information of the associated identity authentication system, the identity authentication strategy and the access permission control strategy. The identification information of the identity authentication system includes at least one of the domain name, IP address and port of the identity authentication system.

[0160] Step 502: The management platform generates authentication configuration information and domain name record of the identity authentication system corresponding to the target application, and the authentication configuration information at least includes the identification information of the connector client associated with the identity authentication system; the domain name record includes the mapping relationship between the address information of the identity authentication system and the IP address of the edge node server.

[0161] Step 503: The management platform sends the application configuration information of the target application and the authentication configuration information of the identity authentication system.

[0162] Step 504: The management platform sends the domain name record of the identity authentication system required by the DNS server.

[0163] The specific operation details of the management platform can refer to the operation of the management platform in any of the above embodiments, which will not be repeated here.

[0164] In the embodiments of the present application, the application configuration information of the target application and the authentication configuration information and domain name record of the identity authentication system are generated in the management platform, and the target application, the connector client and the identity authentication system are associated. The identity authentication of the user is realized through the identity authentication system in the intranet, which does not expose the identity authentication system in the intranet to the Internet, and can also deploy the target application in the intranet to the Internet based on the identity authentication function of the identity authentication system.

[0165] The embodiment of the present application provides an identity authentication system, referring to Figure 1 The system comprises an edge node server, a connector server, a management platform and a connector client.

[0166] The management platform is used for generating application configuration information of a target application, and generating authentication configuration information and domain name records of an identity authentication system corresponding to the target application; the application configuration information of the target application and the authentication configuration information of the identity authentication system are sent, and the domain name records of the identity authentication system required by a DNS server are sent.

[0167] The edge node server is used for receiving an access request for the target application sent by a target terminal, the access request comprising an identity of the target application; if it is determined that the access request does not comprise an identity credential, the target terminal is redirected to an access address of the identity authentication system corresponding to the target application; and the edge node server is also used for receiving an identity authentication request for the identity authentication system corresponding to the target application sent by the target terminal; and according to identity authentication system identity information comprised in the identity authentication request, the identity authentication request is sent to the corresponding connector server.

[0168] The connector server is used for receiving the identity authentication request sent by the edge node server; according to a session connection established in advance with the connector client, the identity authentication request is forwarded to the corresponding connector client, and an identity authentication page forwarded by the connector client is sent to the edge node server.

[0169] The connector client is used for receiving the identity authentication request sent by the connector server, forwarding the identity authentication request to the corresponding identity authentication system, and sending an identity authentication page fed back by the identity authentication system to the connector server.

[0170] In an exemplary embodiment, the session connection is an outbound connection of the connector client to the connector server.

[0171] The identity authentication system provided by the above-mentioned embodiment of the present application and the identity authentication method provided by the embodiment of the present application have the same beneficial effects as the method adopted, run or implemented by the application program stored therein.

[0172] The embodiment of the present application also provides an identity authentication device, which is used for executing the operation of the connector client in the identity authentication method provided by any one of the above-mentioned embodiments. The connector client is associated with at least one identity authentication system corresponding to a target application, and a session connection is established between the connector client and at least one connector server, and the session connection is an outbound connection from the connector client to the at least one connector server. Referring to Figure 7 The device comprises:

[0173] The first sending module 601 is configured to send, based on the session connection, an identity authentication request to the identity authentication system, if the identity authentication request sent by the target terminal and forwarded by the connector server side is received.

[0174] The second sending module 602 is configured to send an identity authentication page fed back by the identity authentication system to the connector server side, the identity authentication page being used for inputting user identity information to complete identity authentication.

[0175] The apparatus further includes a receiving module configured to receive, based on the session connection, user identity information sent by the target terminal and forwarded by the connector server side.

[0176] The first sending module 601 is further configured to send the user identity information to the identity authentication system, the user identity information being input by the target terminal through the identity authentication page.

[0177] The receiving module is further configured to receive an authentication result of the user identity information fed back by the identity authentication system.

[0178] The second sending module 602 is further configured to send the authentication result to the connector server side, so that the connector server side feeds back the authentication result to the target terminal.

[0179] If the user identity information passes the identity authentication, the authentication result includes an identity credential passing the identity authentication.

[0180] The receiving module is further configured to receive, based on the session connection, an access request for the target application sent by the target terminal and forwarded by the connector server side, the access request including the identity credential; and send the access request to the target application.

[0181] The second sending module 602 is further configured to send the request response information received from the target application to the connector server side.

[0182] The identity authentication apparatus provided by the above-mentioned embodiments of the present application and the identity authentication method provided by the embodiments of the present application have the same beneficial effects as the method adopted, run or implemented by the application program stored therein.

[0183] The embodiments of the present application further provide an identity authentication apparatus, which is configured to perform the operation of the connector server side in the identity authentication method provided by any of the above-mentioned embodiments. The connector server side and at least one connector client establish a session connection, the session connection being an outbound connection from the connector client to the connector server side, and the connector client being associated with at least one identity authentication system corresponding to a target application. Referring to Figure 8 The apparatus includes:

[0184] The first receiving module 701 is configured to receive an identity authentication request for an identity authentication system corresponding to the target application, which is sent by a target terminal and forwarded by an edge node server.

[0185] The first determining module 702 is configured to determine a target connector client corresponding to the identity authentication system.

[0186] The third sending module 703 is configured to forward the identity authentication request to the target connector client according to a session connection corresponding to the target connector client.

[0187] The first receiving module 701 is further configured to receive an identity authentication page forwarded by the target connector client based on the session connection corresponding to the target connector client, the identity authentication page being fed back by the identity authentication system according to the identity authentication request, and the identity authentication page being used for inputting user identity information to complete identity authentication.

[0188] The third sending module 703 is further configured to forward the identity authentication page to the target terminal via the edge node server.

[0189] The first receiving module 701 is further configured to receive user identity information forwarded by the edge node server, the user identity information being obtained from the identity authentication page.

[0190] The third sending module 703 is further configured to send the user identity information to the target connector client according to the session connection corresponding to the target connector client.

[0191] The first receiving module 701 is further configured to receive an authentication result of the identity authentication system on the user identity information, which is forwarded by the target connector client.

[0192] The third sending module 703 is further configured to forward the authentication result to the target terminal via the edge node server.

[0193] The first receiving module 701 is further configured to receive an access request for the target application, which is forwarded by the edge node server.

[0194] The first determining module 702 is further configured to determine a target connector client corresponding to the target application, and the access request includes an identity credential generated according to the user identity information that passes the identity authentication.

[0195] The third sending module 703 is further configured to forward the access request to the target connector client according to the session connection corresponding to the target connector client, so that the target connector client forwards the access request to the target application.

[0196] The identity authentication apparatus provided by the above embodiments of the present application has the same beneficial effects as the method adopted, run or implemented by the application program stored therein.

[0197] The present application also provides an identity authentication apparatus, which is used to perform the operation of the edge node server in the identity authentication method provided by any of the above embodiments. Referring to Figure 9 , the apparatus comprises:

[0198] The second receiving module 801 is configured to receive an identity authentication request for an identity authentication system corresponding to a target application sent by a target terminal, the identity authentication request comprising identification information of the identity authentication system.

[0199] The second determining module 802 is configured to determine address information of a connector server corresponding to the identity authentication system according to the identification information of the identity authentication system.

[0200] The fourth sending module 803 is configured to forward the identity authentication request to the connector server according to the address information of the connector server, so that the connector server forwards the identity authentication request to a target connector client according to a session connection between the connector server and the target connector client.

[0201] The second receiving module 801 is further configured to receive an access request for the target application sent by the target terminal, the access request comprising identification of the target application.

[0202] The apparatus further comprises a redirection module configured to, if it is determined that the access request does not comprise an identity credential, redirect the target terminal to an access address of the identity authentication system corresponding to the target application, so that the target terminal sends the identity authentication request to the access address of the identity authentication system.

[0203] The apparatus further comprises an obtaining module configured to, if it is determined that the access request comprises the identity credential, obtain application configuration information of the target application according to the identification of the target application.

[0204] The access permission authentication module is configured to perform access permission authentication on the access request according to an access permission control policy included in the application configuration information.

[0205] The obtaining module is further configured to, if the access request passes the access permission authentication, obtain address information of a target connector server corresponding to the target application.

[0206] The fourth sending module 803 is further configured to forward the access request to the target connector server according to the address information of the target connector server.

[0207] The second determining module 802 is specifically configured to acquire authentication configuration information corresponding to the identity authentication system according to the identification information of the identity authentication system, the authentication configuration information at least including identification information of a connector client associated with the identity authentication system; acquire connector configuration information corresponding to the connector client according to the identification information of the connector client associated with the identity authentication system; and acquire address information of a connector server corresponding to the identity authentication system from the connector configuration information.

[0208] The second receiving module 801 is further configured to receive an identity authentication page sent by the connector server, the identity authentication page being fed back by the identity authentication system according to the identity authentication request.

[0209] The fourth sending module 803 is further configured to send the identity authentication page to the target terminal.

[0210] The second receiving module 801 is further configured to receive user identity information sent by the target terminal, the user identity information being input by the target terminal through the identity authentication page.

[0211] The fourth sending module 803 is further configured to forward the user identity information to the connector server.

[0212] The second receiving module 801 is further configured to receive an authentication result of identity authentication of the user identity information by the identity authentication system forwarded by the connector server.

[0213] The fourth sending module 803 is further configured to send the authentication result to the target terminal.

[0214] The identity authentication device provided by the above-mentioned embodiments of the present application has the same beneficial effects as the method adopted, run or implemented by the application program stored therein, based on the same inventive concept as the identity authentication method provided by the embodiments of the present application.

[0215] The embodiments of the present application further provide an identity authentication device, which is configured to execute the operation of the management platform in the identity authentication method provided by any of the above-mentioned embodiments. Referring to Figure 10 The device comprises:

[0216] The generating module 901 is configured to generate application configuration information corresponding to the target application, the application configuration information including at least one of an identifier of the target application, a back-to-source address, identifier information of an associated connector client, identifier information of an associated identity authentication system, an identity authentication policy, and an access permission control policy; the identifier information of the identity authentication system including at least one of a domain name, an IP address, and a port of the identity authentication system; generating authentication configuration information of the identity authentication system corresponding to the target application and domain name record, the authentication configuration information including at least the identifier information of the connector client associated with the identity authentication system; and the domain name record including a mapping relationship between the address information of the identity authentication system and the IP address of the edge node server.

[0217] The fifth sending module 902 is configured to send the application configuration information of the target application and the authentication configuration information of the identity authentication system, and send the domain name record of the identity authentication system required by the DNS server.

[0218] The identity authentication apparatus provided by the above-mentioned embodiments of the present application has the same beneficial effects as the method adopted, run or implemented by the application program stored therein, based on the same inventive concept as the identity authentication method provided by the embodiments of the present application.

[0219] The embodiments of the present application further provide an electronic device for executing the above-mentioned identity authentication method. Please refer to Figure 11 which shows a schematic diagram of an electronic device provided by some embodiments of the present application. As shown in Figure 11 The electronic device 10 includes a processor 1000, a memory 1001, a bus 1002 and a communication interface 1003, the processor 1000, the communication interface 1003 and the memory 1001 are connected through the bus 1002; the memory 1001 stores a computer program capable of running on the processor 1000, and the processor 1000 runs the computer program to execute the identity authentication method provided by any of the preceding embodiments of the present application.

[0220] The memory 1001 can include a high-speed random access memory (RAM: Random Access Memory) and can also include a non-volatile memory such as at least one disk memory. The communication connection between the system network element and at least one other network element is realized through at least one communication interface 1003 (which can be wired or wireless), and the Internet, a wide area network, a local network, a metropolitan area network, etc. can be used.

[0221] The bus 1002 can be an ISA bus, a PCI bus, an EISA bus, or the like. The bus can be divided into an address bus, a data bus, a control bus, and the like. The memory 1001 is configured to store programs, and the processor 1000 executes the programs after receiving execution instructions. The identity authentication method disclosed in any of the embodiments of the present application can be applied to the processor 1000 or implemented by the processor 1000.

[0222] The processor 1000 can be an integrated circuit chip with a processing capability of signals. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor 1000 or an instruction in the form of software. The processor 1000 described above can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), and the like; or can be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a ready programmable gate array (FPGA), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. Each method, step, and logic block diagram disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in combination with the embodiments of the present application can be directly embodied as a hardware code processor for execution, or a combination of hardware and software modules in the code processor for execution. The software module can be located in a random access memory, a flash memory, a read-only memory, a programmable read-only memory, an electrically erasable programmable memory, a register, or other mature storage media in the art. The storage medium is located in the memory 1001, and the processor 1000 reads information in the memory 1001 and combines hardware to complete the steps of the above method.

[0223] The electronic device provided by the embodiments of the present application and the identity authentication method provided by the embodiments of the present application have the same beneficial effects as the method they adopt, run, or implement.

[0224] The embodiments of the present application also provide a computer readable storage medium corresponding to the identity authentication method provided in the foregoing embodiments. Please refer to Figure 12 The computer readable storage medium shown in the figure is an optical disc 30, and a computer program (i.e., a program product) is stored on the optical disc 30. When the computer program is run by a processor, the identity authentication method provided in any of the foregoing embodiments is executed.

[0225] It is to be noted that examples of the computer-readable storage medium can also include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other optical, magnetic storage mediums, and the like, which are not listed one by one here.

[0226] The computer-readable storage medium provided by the above embodiments of the present application has the same beneficial effects as the method adopted, run or implemented by the application program stored therein, based on the same inventive concept as the identity authentication method provided by the embodiments of the present application.

[0227] It should be noted that:

[0228] In the specification provided herein, a large number of specific details are described. However, it can be understood that the embodiments of the present application can be practiced without these specific details. In some examples, well-known structures and techniques are not shown in detail in order not to obscure the understanding of the present specification.

[0229] Similarly, it should be appreciated that the individual features of the application described in the above description of example embodiments of the application are sometimes grouped together in a single embodiment, figure or description of related embodiments, for the purpose of streamlining the disclosure and aiding in the understanding of one or more of the individual aspects of the application. The disclosure of a combination of features in the above description should not be interpreted as reflecting a satisfying feature combination requiring the presence of every feature in the combination. The goal of the disclosure is to provide a novel and inventive combination of features. The features of the application are described in the claims, which are to be interpreted in their broadest reasonable manner, also in the versions of the claims that are to be interpreted in their broadest reasonable manner. The claims are thus to be interpreted as including any other features which come within the four corners of the claims. Each of the individual aspects of the application described above is to be considered a separate embodiment of the application, independently of the other aspects of the application. Thus, any combination of the individual aspects described above is to be considered a separate embodiment of the application.

[0230] Furthermore, those skilled in the art will recognize that references in the specification to "one embodiment", "an embodiment", "an example embodiment", mean that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the application. The appearances of the phrase "in one embodiment" in various places in the specification are not necessarily all referring to the same embodiment, nor are the various embodiments of the application mutually exclusive, unless the specification provides otherwise. Furthermore, the terms "a" or "an", as used herein, mean "one or more".

[0231] The above description is only the preferred embodiment of the present application, but the protection scope of the present application is not limited to this, and any person skilled in the art can easily think of changes or replacements within the technical scope disclosed by the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. An identity authentication method, characterized by, The application is applied to a connector client, the connector client is associated with an identity authentication system corresponding to at least one target application, a session connection is established between the connector client and at least one connector server, the session connection is an outbound connection from the connector client to the at least one connector server, the at least one target application and the corresponding identity authentication system are in an intranet, and the method comprises the following steps: Based on the session connection, if an identity authentication request for the identity authentication system corresponding to the target application sent by the target terminal is received through the connector server, the identity authentication request is sent to the identity authentication system; An identity authentication page fed back by the identity authentication system is sent to the connector server, and the identity authentication page is used for inputting user identity information; Based on the session connection, user identity information sent by the target terminal and forwarded by the connector server is received, and the user identity information is sent to the identity authentication system, wherein the user identity information is input by the target terminal through the identity authentication page; An authentication result of the user identity information fed back by the identity authentication system is received, and the authentication result is sent to the connector server, so that the connector server feeds back the authentication result to the target terminal.

2. The method of claim 1, wherein, If the user identity information passes the identity authentication, the authentication result comprises an identity credential passing the identity authentication; After the authentication result is sent to the connector server, the following steps are further included: Based on the session connection, an access request for the target application sent by the target terminal and forwarded by the connector server is received, and the access request comprises the identity credential; The access request is sent to the target application; Request response information received from the target application is sent to the connector server.

3. An identity authentication method characterized by, The application is applied to a connector server, a session connection is established between the connector server and at least one connector client, the session connection is an outbound connection from the connector client to the connector server, the connector client is associated with an identity authentication system corresponding to at least one target application, the at least one target application and the corresponding identity authentication system are in an intranet, and the method comprises the following steps: An identity authentication request for the identity authentication system corresponding to the target application sent by the target terminal is received through the edge node server; A target connector client corresponding to the identity authentication system is determined; According to the session connection corresponding to the target connector client, the identity authentication request is forwarded to the target connector client; Based on the session connection corresponding to the target connector client, an identity authentication page forwarded by the target connector client is received, the identity authentication page is fed back by the identity authentication system according to the identity authentication request, and the identity authentication page is used for inputting user identity information; The identity authentication page is forwarded to the target terminal through the edge node server; User identity information is received through the edge node server, and the user identity information is obtained through the identity authentication page; sending the user identity information to the target connector client according to a session connection corresponding to the target connector client; receiving an authentication result of the identity authentication system on the user identity information forwarded by the target connector client, and forwarding the authentication result to the target terminal via the edge node server.

4. The method of claim 3, wherein, The method further comprises: receiving an access request for the target application forwarded by the edge node server, determining a target connector client corresponding to the target application, the access request comprising an identity credential generated according to the user identity information authenticated by identity authentication; forwarding the access request to the target connector client according to a session connection corresponding to the target connector client, so that the target connector client forwards the access request to the target application.

5. An identity authentication method characterized by, The method is applied to an edge node server, comprising: receiving an identity authentication request for an identity authentication system corresponding to a target application sent by a target terminal, the identity authentication request comprising identification information of the identity authentication system, the target application and the identity authentication system corresponding thereto being in an intranet; determining address information of a connector server corresponding to the identity authentication system according to the identification information of the identity authentication system; forwarding the identity authentication request to the connector server according to the address information of the connector server, so that the connector server forwards the identity authentication request to a target connector client according to a session connection between the connector server and the target connector client; receiving an identity authentication page sent by the connector server, the identity authentication page being fed back by the identity authentication system according to the identity authentication request; sending the identity authentication page to the target terminal; receiving user identity information sent by the target terminal, the user identity information being input by the target terminal through the identity authentication page; forwarding the user identity information to the connector server; receiving an authentication result of identity authentication of the user identity information by the identity authentication system forwarded by the connector server, and sending the authentication result to the target terminal.

6. The method of claim 5, wherein, Before the receiving of the identity authentication request for the identity authentication system corresponding to the target application sent by the target terminal, the method further comprises: receiving an access request for the target application sent by the target terminal, the access request comprising identification of the target application; if it is determined that the access request does not comprise an identity credential, redirecting the target terminal to an access address of the identity authentication system corresponding to the target application, so that the target terminal sends an identity authentication request to the access address of the identity authentication system.

7. The method of claim 6, wherein, The method further comprises: if it is determined that the access request comprises an identity credential, acquiring application configuration information of the target application according to the identification of the target application; performing access right authentication on the access request according to an access right control policy comprised in the application configuration information; if the access request passes the access right authentication, acquiring address information of a target connector server corresponding to the target application; Forward the access request to the target connector server according to the address information of the target connector server.

8. The method of claim 5, wherein, The address information of the connector server corresponding to the identity authentication system is determined according to the identification information of the identity authentication system, and the address information of the connector server corresponding to the identity authentication system is determined according to the identification information of the identity authentication system. According to the identification information of the connector client associated with the identity authentication system, the authentication configuration information corresponding to the identity authentication system is obtained, and the authentication configuration information at least includes the identification information of the connector client associated with the identity authentication system. According to the identification information of the connector client associated with the identity authentication system, the authentication configuration information corresponding to the identity authentication system is obtained, and the authentication configuration information at least includes the identification information of the connector client associated with the identity authentication system. The address information of the connector server corresponding to the identity authentication system is obtained from the connector configuration information.

9. An identity authentication method characterized by, Applied to a management platform, comprising: Generating application configuration information corresponding to the target application, the application configuration information including at least one of the identification of the target application, the back source address, the identification information of the associated connector client, the identification information of the associated identity authentication system, the identity authentication strategy and the access permission control strategy; the identification information of the identity authentication system includes at least one of the domain name, IP address and port of the identity authentication system, and the target application and its associated identity authentication system are in the intranet; Generating the authentication configuration information and the domain name record of the identity authentication system corresponding to the target application, the authentication configuration information at least including the identification information of the connector client associated with the identity authentication system; the domain name record includes the mapping relationship between the address information of the identity authentication system and the IP address of the edge node server; Sending the application configuration information of the target application and the authentication configuration information of the identity authentication system to each edge node server, so that each edge node server executes the identity authentication method of any one of claims 5-8 to complete the identity authentication; The domain name record of the identity authentication system required by the DNS server is sent.

10. An identity authentication system characterized by comprising: Comprising: Management platform, edge node server, connector server and connector client, wherein: The management platform is used to generate the application configuration information of the target application, and generate the authentication configuration information and the domain name record of the identity authentication system corresponding to the target application; the application configuration information of the target application and the authentication configuration information of the identity authentication system are sent, and the domain name record of the identity authentication system required by the DNS server is sent, and the target application and its corresponding identity authentication system are in the intranet; The edge node server is used to receive the access request for the target application sent by the target terminal, and the access request contains the identification of the target application; if it is determined that the access request does not include identity credentials, the target terminal is redirected to the access address of the identity authentication system corresponding to the target application; and also used to receive the identity authentication request for the identity authentication system corresponding to the target application sent by the target terminal; and according to the identification information of the identity authentication system contained in the identity authentication request, the identity authentication request is sent to the corresponding connector server. The connector server is configured to receive the identity authentication request sent by the edge node server, forward the identity authentication request to the corresponding connector client according to a session connection established in advance with the connector client, and send an identity authentication page fed back by the connector client to the edge node server. The connector client is configured to receive the identity authentication request sent by the connector server, forward the identity authentication request to the corresponding identity authentication system, and send an identity authentication page fed back by the identity authentication system to the connector server. The connector server is further configured to receive user identity information forwarded by the edge node server, the user identity information being obtained by the identity authentication page, and send the user identity information to the connector client. The connector client is further configured to receive the user identity information forwarded by the connector server, and send the user identity information to the identity authentication system. The identity authentication system is configured to authenticate the user identity information to obtain an authentication result, and send the authentication result to the connector client. The connector client is further configured to receive the authentication result fed back by the identity authentication system, and send the authentication result to the connector server. The connector server is further configured to forward the authentication result to the target terminal via the edge node server.

11. An identity authentication apparatus characterized by comprising: The connector client is associated with an identity authentication system corresponding to at least one target application, and a session connection is established between the connector client and at least one connector server, the session connection being an outbound connection from the connector client to the at least one connector server, and the at least one target application and the identity authentication system corresponding thereto are both in an intranet, and the connector client comprises: A first sending module is configured to send an identity authentication request to the identity authentication system based on the session connection, if the identity authentication request sent by a target terminal to the identity authentication system corresponding to a target application is received by the connector server. A second sending module is configured to send an identity authentication page fed back by the identity authentication system to the connector server, the identity authentication page being used for inputting user identity information. A receiving module is configured to receive user identity information sent by a target terminal and forwarded by the connector server based on the session connection. The first sending module is further configured to send the user identity information to the identity authentication system, the user identity information being input by the target terminal through the identity authentication page. The receiving module is further configured to receive an authentication result of the user identity information fed back by the identity authentication system. The second sending module is further configured to send the authentication result to the connector server, so that the connector server feeds back the authentication result to the target terminal.

12. An identity authentication apparatus characterized by comprising: The application is applied to a connector server end, a session connection is established between the connector server end and at least one connector client end, the session connection is an outbound connection from the connector client end to the connector server end, the connector client end is associated with an identity authentication system corresponding to at least one target application, the at least one target application and the corresponding identity authentication system are in an intranet, and the application comprises: A first receiving module is configured to receive an identity authentication request for an identity authentication system corresponding to a target application, which is sent by a target terminal and forwarded by an edge node server; A first determining module is configured to determine a target connector client end corresponding to the identity authentication system; A third sending module is configured to forward the identity authentication request to the target connector client end according to a session connection corresponding to the target connector client end; The first receiving module is further configured to receive an identity authentication page forwarded by the target connector client end based on the session connection corresponding to the target connector client end, the identity authentication page being fed back by the identity authentication system according to the identity authentication request, and the identity authentication page being used for inputting user identity information; The third sending module is further configured to forward the identity authentication page to the target terminal via the edge node server; The first receiving module is further configured to receive user identity information forwarded by the edge node server, the user identity information being obtained by the identity authentication page; The third sending module is further configured to send the user identity information to the target connector client end according to the session connection corresponding to the target connector client end; The first receiving module is further configured to receive an authentication result of the identity authentication system on the user identity information, which is forwarded by the target connector client end; The third sending module is further configured to forward the authentication result to the target terminal via the edge node server.

13. An identity authentication apparatus characterized by comprising: The application is applied to an edge node server, and comprises: A second receiving module is configured to receive an identity authentication request for an identity authentication system corresponding to a target application, which is sent by a target terminal, and the identity authentication request comprises identification information of the identity authentication system; A second determining module is configured to determine address information of a connector server end corresponding to the identity authentication system according to the identification information of the identity authentication system; A fourth sending module is configured to forward the identity authentication request to the connector server end according to the address information of the connector server end, so that the connector server end forwards the identity authentication request to a target connector client end corresponding to the connector server end according to a session connection between the connector server end and the target connector client end; The second receiving module is further configured to receive an identity authentication page sent by the connector server end, the identity authentication page being fed back by the identity authentication system according to the identity authentication request; The fourth sending module is further configured to send the identity authentication page to the target terminal; The second receiving module is further configured to receive user identity information sent by the target terminal, the user identity information being input by the target terminal through the identity authentication page; The fourth sending module is further configured to forward the user identity information to the connector server; The second receiving module is further configured to receive an authentication result of identity authentication of the user identity information by the identity authentication system forwarded by the connector server; The fourth sending module is further configured to send the authentication result to the target terminal.

14. An identity authentication apparatus characterized by comprising: The application is applied to a management platform, comprising: A generating module is configured to generate application configuration information corresponding to a target application, the application configuration information comprising at least one of an identifier of the target application, a back-to-source address, identifier information of an associated connector client, identifier information of an associated identity authentication system, an identity authentication strategy and an access permission control strategy; the identifier information of the identity authentication system comprising at least one of a domain name, an IP address and a port of the identity authentication system; the target application and the associated identity authentication system being both in an internal network; generating authentication configuration information and domain name records of the identity authentication system corresponding to the target application, the authentication configuration information comprising at least the identifier information of the connector client associated with the identity authentication system; the domain name records comprising a mapping relationship between address information of the identity authentication system and an IP address of an edge node server; A fifth sending module is configured to send the application configuration information of the target application and the authentication configuration information of the identity authentication system to each edge node server, so that each edge node server performs the identity authentication method of any one of claims 5-8 to complete identity authentication; and send the domain name records of the identity authentication system required by a DNS server.

15. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein, The processor runs the computer program to implement the method of any one of claims 1-9.

16. A computer readable storage medium having stored thereon a computer program, characterized in that, The program is executed by the processor to implement the method of any one of claims 1-9.

Images