Authentication method for re-authenticating multiple application systems having first authentication processes

Abstract

The present disclosure describes an authentication method for re-authenticating multiple application systems with a first authentication process, comprising: setting an authentication policy for at least one application system; a proxy client obtaining the authentication policy and monitoring a use process of the multiple application systems based on the authentication policy to identify an operation function of each application system, before a user enters an operation identifier corresponding to the operation function, the proxy client suspends the current operation and starts an authentication unit to receive identity authentication information input by the user based on an authentication mode corresponding to the operation identifier and authenticate the identity authentication information, if the authentication is passed and the user is confirmed to have an operation right of the operation function through the authentication policy, the user is authorized to continue operating the operation function. Thus, the security of multiple application systems can be improved without modifying the application code of the application systems and the method has universality.

Description

[0001] This application is a divisional application of the patent application filed on September 14, 2021, with application number 2021110767185, entitled "Security Authentication Method and Security Authentication Device for Multiple Application Systems". Technical Field

[0002] This disclosure relates to the field of emerging software and new information technology services, and in particular to an authentication method for re-authenticating multiple application systems with a first authentication process. Background Technology

[0003] With the rapid development of information technology and the Internet, more and more enterprises are gradually realizing enterprise informatization. Various application systems are deployed within these enterprises to support their daily operations. These application systems (such as customer management systems, human resources systems, or financial systems) have become indispensable and powerful assistants in daily office work.

[0004] For security reasons, various application systems typically employ authentication methods to authorize users to access their functions. However, due to differences in development processes and teams, authentication methods and security levels often vary. Some systems have overly simplistic user authentication, while others have excessively long validity periods for successful authentication, making it easy for unauthorized individuals to impersonate users and perform unauthorized actions. In particular, different enterprises often have customized authentication requirements to support their internal business security needs. Currently, secondary development is generally used to modify the application code to meet these personalized authentication requirements. However, some application systems do not provide open secondary development interfaces, or secondary development is difficult, for example, due to a lack of design documents or application code, and the cost and time required for modifying the application code are high. Summary of the Invention

[0005] This disclosure is made in view of the above-mentioned situation, and its purpose is to provide a security authentication method and security authentication device for multiple application systems that can improve the security of multiple application systems without modifying the application code of the application system and has universality.

[0006] Therefore, the first aspect of this disclosure provides a security authentication method for multiple application systems, which is a security authentication method for re-authenticating the operation functions of multiple application systems having a first authentication process. The first authentication process is an authentication process already present in the application system at the time of its release. The re-authentication is performed by setting a second authentication process for the application system. The application to which the first authentication process belongs and the application to which the second authentication process belongs are independent of each other. The second authentication process includes: setting an authentication policy for at least one of the application systems. The authentication policy includes an application identifier for uniquely identifying an application system, an operation identifier for identifying the operation function, an authentication method for accessing the operation function, and operation user information with operation permissions for the operation function. The operation user information includes a user identifier for associating with identity authentication information, and the operation identifier includes location information for locating the page where the operation function is located and feature information of the operation function. Furthermore, the method is implemented on the terminal device of the user accessing the application system. A proxy client is configured to acquire and save the authentication policy. Based on the authentication policy, the proxy client monitors the usage of various application systems on the terminal device to identify the operation identifier. Before a user enters the operation function corresponding to the operation identifier, the proxy client pauses the current operation and starts an authentication unit to receive and authenticate the user's input identity authentication information based on the authentication method corresponding to the operation identifier. If the authentication is successful and the authentication policy confirms that the user has the operation permission for the operation function, the user is authorized to continue operating the operation function; otherwise, the operation function is terminated. In identifying the operation identifier, the proxy client acquires the page content of the current page of the application system. Using the location information and the page content, it determines whether the current page is the page containing the operation function. If so, it checks whether the page content of the page containing the operation function contains content matching the characteristic information. If so, it indicates that the operation identifier has been identified. In this way, without modifying the application code of various application systems, an additional authentication process can be added to the critical operation functions of the application system. This improves the security of various application systems and provides versatility.

[0007] In addition, in the security authentication method disclosed in the first aspect, optionally, the positioning information includes the page title in the page content of the application system, and the feature information includes the name of the operation function in the page content of the application system; for a BS structure application system, the application identifier is set according to the access URL of the application system, and for a CS structure application system, the process name of the application system is used as the application identifier.

[0008] Furthermore, in the security authentication method disclosed in the first aspect, the feature information may optionally include location information of the operation function; for B / S architecture application systems, the feature information may also include request parameters in the access URL. In this case, when the same operation function name appears on the same page, the operation function controlled by the authentication policy can be further determined through the location information. Additionally, it is possible to identify operation functions with finer granularity.

[0009] Furthermore, in the security authentication method disclosed in the first aspect, optionally, the process of the authentication unit authenticating the identity authentication information is recorded to generate an authentication record, and the authentication record is monitored and analyzed. The authentication record includes agent client information, the application identifier, the operation identifier, the authentication method, the identity authentication information input by the user, the authentication result, and the user identifier. This enables monitoring of the authentication process.

[0010] Furthermore, in the security authentication method disclosed in the first aspect, the authentication method may optionally include at least one of fingerprint authentication, digital certificate authentication, username and password authentication, and dynamic password card authentication. This allows for the support of multiple authentication methods with different security levels.

[0011] Furthermore, in the security authentication method disclosed in the first aspect, users may optionally be grouped to obtain group information, and the authentication policy of the application system may be set based on the group information. In this case, unified settings can be applied to users with the same job responsibilities, thereby improving efficiency.

[0012] Furthermore, in the security authentication method disclosed in the first aspect, optionally, for a browser-based (BS) application system, the proxy client uses a browser hook mechanism to obtain page content; for a client-server (CS) application system, the proxy client obtains page content through the operating system's kernel program and event triggering mechanism. Thus, it is possible to obtain page content.

[0013] Furthermore, in the security authentication method according to the first aspect of this disclosure, optionally, the proxy client has a policy receiving module and a self-updating module, wherein the policy receiving module is configured to obtain the authentication policy, and the self-updating module is configured to automatically obtain the latest version of the proxy client when the version of the proxy client changes. This enables the acquisition of the authentication policy. Additionally, it reduces the risk of missing identification operation functions.

[0014] Additionally, in the security authentication method disclosed in the first aspect, optionally, the proxy client is equipped with a guardian module, which is configured to detect whether the proxy client is started; if not, it starts the proxy client. This prevents the proxy client from being uninstalled or terminated.

[0015] The second aspect of this disclosure provides a security authentication device for multiple application systems. This device is for re-authenticating the operational functions of multiple application systems that have a first authentication process. The first authentication process is an authentication process already present in the application system at the time of its release. The security authentication device is used to set a second authentication process for the application system to perform the re-authentication. The application to which the first authentication process belongs and the application to which the second authentication process belongs are independent of each other. The security authentication device includes a policy management module and a proxy client. The policy management module is configured to set authentication policies for at least one of the application systems. The authentication policy includes an application identifier for uniquely identifying an application system, an operation identifier for identifying the operational function, an authentication method for accessing the operational function, and operation user information with operation permissions for the operational function. The operation user information includes a user identifier for associating with identity authentication information, and the operation identifier includes location information for locating the page where the operational function is located and feature information of the operational function. The proxy client also includes a policy management module and a proxy client. A proxy client is installed on the terminal device of the user accessing the application system and configured to obtain and save the authentication policy. Based on the authentication policy, the client monitors the usage of various application systems on the terminal device to identify the operation identifier. Before the user enters the operation function corresponding to the operation identifier, the proxy client pauses the current operation and starts the authentication unit to receive the user's input authentication information based on the authentication method corresponding to the operation identifier and authenticates the authentication information. If the authentication is successful and the authentication policy confirms that the user has the operation permission for the operation function, the user is authorized to continue operating the operation function; otherwise, the operation function is terminated. In identifying the operation identifier, the proxy client obtains the page content of the current page of the application system. It determines whether the current page is the page containing the operation function using the location information and the page content. If so, it checks whether the page content of the page containing the operation function contains content matching the characteristic information. If so, it indicates that the operation identifier has been identified. In this way, without modifying the application code of various application systems, an additional authentication process can be added to the critical operation functions of the application system. Therefore, the security of various application systems can be improved, and the system is universally applicable.

[0016] According to this disclosure, a security authentication method and security authentication device for multiple application systems can be provided that improves the security of multiple application systems without modifying the application code of the application system and has universality. Attached Figure Description

[0017] This disclosure will now be explained in further detail by way of example only with reference to the accompanying drawings, in which:

[0018] Figure 1 This is a schematic diagram illustrating application scenarios of the security authentication methods for various application systems involved in the examples of this disclosure.

[0019] Figure 2 This is a flowchart illustrating the security authentication methods of various application systems involved in the examples of this disclosure.

[0020] Figure 3 This is a block diagram illustrating the proxy client involved in the examples of this disclosure.

[0021] Figure 4 This is a schematic diagram illustrating the proxy client initiating the authentication unit as described in this disclosure example.

[0022] Figure 5 This is a flowchart illustrating the authentication of operational functions by the proxy client involved in the example disclosed herein.

[0023] Figure 6 This is a block diagram illustrating a security authentication device for various application systems covered by the examples in this disclosure. Detailed Implementation

[0024] The preferred embodiments of this disclosure are described in detail below with reference to the accompanying drawings. In the following description, the same reference numerals are used for the same components, and repeated descriptions are omitted. Furthermore, the drawings are merely schematic diagrams, and the proportions of the components or the shapes of the components may differ from actual figures. It should be noted that the terms "comprising" and "having," and any variations thereof, in this disclosure, do not necessarily limit the process, method, system, product, or apparatus to the explicitly listed steps or units, but may include or have other steps or units not explicitly listed or inherent to these processes, methods, products, or apparatuses. All methods described in this disclosure may be performed in any suitable order unless otherwise indicated herein or clearly contradicted by the context.

[0025] The security authentication methods and devices for various application systems disclosed herein can improve the security of various application systems without modifying the application code and are universally applicable. The security authentication methods for various application systems disclosed herein may sometimes be referred to simply as security authentication methods, authentication methods, or system authentication methods, etc. The security authentication devices for various application systems disclosed herein can be used to implement the security authentication methods. The following describes some of the concepts involved in this disclosure.

[0026] An application system is an information system built by various enterprises and organizations to solve a specific problem or a class of problems. Application systems are implemented through computer programming, designing corresponding application code. Application systems allow interaction with users. Depending on business needs, an application system may have one or more application programs. These applications work together to achieve the business requirements.

[0027] In addition, application systems can be various business systems within an enterprise. For example, application systems can include, but are not limited to, customer management systems, human resources systems, financial systems, and OA systems. Furthermore, application systems can be configured using either a client / server (CS) architecture or a browser / server (BS) architecture.

[0028] Application code can be referred to as the source code of an application system. Compilation tools can be used to compile application code into applications. During the compilation process, the application code in a high-level language is translated into binary code that a computer can understand and run. Therefore, the compiled application is often difficult to modify. Although some applications support decompilation, the source code obtained after decompilation is often incomplete and poorly formatted. In such cases, modifying the authentication method based on the decompiled source code is essentially impractical and extremely difficult.

[0029] The following detailed description, in conjunction with the accompanying drawings, describes the security authentication methods for various application systems covered in this disclosure. Furthermore, the application scenarios described in the examples of this disclosure are for the purpose of more clearly illustrating the technical solutions of this disclosure and do not constitute a limitation on the technical solutions provided in this disclosure. Figure 1 This is a schematic diagram illustrating application scenarios of the security authentication methods of various application systems 30 involved in the examples of this disclosure.

[0030] like Figure 1As shown, a proxy client 20 can be configured on a terminal device to monitor the usage of various application systems 30 to identify key operations (i.e., key operational functions) of each application system 30. If a key operation is identified, an authentication unit 40 can be initiated to authenticate the key operation. If the authentication is successful, the key operation can continue. Furthermore, the key operation and its authentication method can be configured through an authentication policy (described later).

[0031] In addition, in some examples, the terminal device may include, but is not limited to, a laptop, tablet, mobile phone, desktop computer, or virtual computer (a virtual computer may refer to a virtual machine that is simulated by software, has full hardware system functions, and runs in a completely isolated environment).

[0032] In addition, in some examples, each application system 30 may have a first authentication process. In some examples, the first authentication process may be an authentication process that the application system 30 already has when it is released (that is, changing the first authentication process requires modifying the source code of the application system 30). In some examples, the first authentication process may include one or more of the following: whether the authenticated user is logged in, whether the authenticated user has operation permissions for the corresponding page, whether the authenticated user has operation permissions for the corresponding operation functions on the corresponding page, and whether the authenticated user has operation permissions for the corresponding data. However, this disclosure does not impose any particular limitation on the first authentication process; the first authentication process may be any authentication process that the application system 30 already has when it is released and is used to ensure security.

[0033] The security authentication method disclosed herein can re-authenticate the operational functions of various application systems 30 that have a first authentication process. In some examples, re-authentication can be performed by setting a second authentication process for the application system 30. That is, the second authentication process may not be part of the existing authentication process of the application system 30 itself. In some examples, the second authentication process may be set according to the security requirements of the enterprise's internal business. Thus, personalized authentication requirements can be supported.

[0034] In some examples, the application to which the first authentication process belongs (which may be referred to as the first application) and the application to which the second authentication process belongs (which may be referred to as the second application) can be independent of each other. That is, there may be no interaction between the first application and the second application within the application itself. Furthermore, the first application can be an application within application system 30. In this case, without modifying the source code of application system 30 (i.e., the source code of the first application), re-authentication can be performed by setting up the second authentication process on application system 30, thus adapting to personalized authentication needs. This improves the security and versatility of application system 30.

[0035] Furthermore, the security authentication method disclosed herein is also applicable to authenticating the operation pages of various application systems 30. That is, it authenticates whether a user has the necessary permissions to operate on the corresponding page. In other words, it allows for additional authentication to determine whether a user has the necessary permissions to operate on the corresponding page.

[0036] Furthermore, the security authentication method disclosed herein is also applicable to application systems 30 that lack a first authentication process. That is, a second authentication process can be set up for application systems 30 that lack a first authentication process. This conveniently improves the security of application systems 30 that lack a first authentication process.

[0037] The security authentication method disclosed herein will now be described in detail with reference to the accompanying drawings. As described above, the security authentication method can re-authenticate the operational functions of various application systems 30 that have undergone a first authentication process. Furthermore, the following explanation will use a financial system as an example of application system 30. Figure 2 This is a flowchart illustrating the security authentication methods of various application systems 30 involved in the examples of this disclosure.

[0038] like Figure 2 As shown, in some examples, the security authentication method may include setting an authentication policy for at least one application system 30 (step S110).

[0039] In some examples, in step S110, the authentication policy can be used to indicate that a specific authentication method is used to authenticate a specific operational function (also known as a critical operation) of the application system 30. However, the examples in this disclosure are not limited to this. In other examples, the authentication policy can also be used to indicate that a specific authentication method is used to authenticate the application system 30 or a page of the application system 30.

[0040] In some examples, the operational function can be one or more operations performed in application system 30 to achieve a specific business function. As an example, for a financial system, the operational function could be, for instance, bookkeeping, voucher processing, reconciliation, closing, downloading reports, exporting reports, or browsing reports.

[0041] In some examples, the authentication policy may include an application identifier, an operation identifier, an authentication method, and operation user information. This clearly describes the authentication method for the operation function corresponding to the operation identifier and the user with the permissions for that operation function.

[0042] Additionally, the application identifier can be used to uniquely identify an application system 30 (i.e., the application identifier can be used to define which application systems 30 require re-authentication). In some examples, the name of the application system 30 can be used as the application identifier. In some examples, the name of the application system 30 can be obtained from the page content of the application system 30.

[0043] In some examples, the application identifier can be set according to the structure of application system 30. For a B / S architecture application system 30, the application identifier can be set according to the access URL (hereinafter referred to as url) of application system 30. The url can consist of a host portion, port number, page name, and request parameters. The application identifier can be any part of the url that can distinguish an application system 30. For example, the application identifier can include the host portion of the url (e.g., the host portion can be a domain name or IP address). Another example is that the application identifier can also include the port number in the url. In this case, it is possible to identify application systems 30 under multiple port numbers in a single host portion. For a C / S architecture application system 30, the process name of application system 30 can be used as the application identifier.

[0044] Additionally, operation identifiers can be used to identify operation functions (i.e., operation identifiers can be used to define which operation functions require authentication). In some examples, operation identifiers may include location information for locating the page where the operation function is located and characteristic information of the operation function.

[0045] In some examples, location information may include the page title or any key string that can distinguish the page from the page content of application system 30. Thus, the page containing the operational function can be identified through the location information. For application system 30 with a B / S architecture, the page content can also be the page's source code (e.g., HTML source code), and the page title can be the page name in the URL or the text content of the title tag in the page's source code.

[0046] In some examples, the feature information of an operation function may include the name of the operation function in the page content (e.g., button name) or any key string that can distinguish the operation function (e.g., button number). Thus, the operation function can be identified through feature information. For the B / S architecture application system 30, the name of the operation function can be the value of the id attribute of the tag corresponding to the operation function in the page's source code.

[0047] In some examples, the feature information of an operation function may also include its location information. For example, the location information may include the coordinates of the operation function on the page or the index of the operation function's name or key string within the page content. In this case, when the same operation function name appears on the same page, the location information can be used to further identify the operation function controlled by the authentication policy. In some examples, for a B / S architecture application system 30, the feature information of the operation function may also include request parameters in the access URL. This allows for the identification of operation functions with finer granularity.

[0048] Additionally, the authentication method can be the authentication method used when accessing an operation function (i.e., which authentication method the user needs to complete when accessing the operation function). In some examples, the authentication method may include at least one of fingerprint authentication, digital certificate authentication, username and password authentication, and dynamic password card authentication. This allows for support of multiple authentication methods with different security levels. In some examples, the corresponding authentication method can be set according to the security level requirements of the application system 30 or its operation function. In some examples, multiple authentication methods can be set for a single operation function. In this case, the authentication method with higher priority can be selected to authenticate the operation function based on the environment of the terminal device where the agent client 20 is located, thus improving the compatibility of authentication methods. For example, if the terminal device has an environment with fingerprint input and fingerprint authentication has high priority, fingerprint authentication can be initiated when accessing the operation function.

[0049] Additionally, the user information can be user information for those with the necessary permissions to perform the operation. In some examples, the user information may include a user identifier. A user identifier can be used to uniquely identify a user. The user identifier can be associated with authentication information. Authentication information can be pre-set. For example, for fingerprint authentication, authentication information may include pre-recorded fingerprint information. In some examples, authentication information may correspond to authentication methods. Specifically, one authentication method can correspond to one authentication information, and multiple authentication methods can correspond to multiple authentication information.

[0050] In some examples, authentication policies can be edited, deleted, and queried. In some examples, when authentication policies change, they can be synchronized to agent client 20 (described later) via a full update (i.e., updating all authentication policies) or an incremental update (i.e., updating the changed authentication policies).

[0051] In some examples, before setting an authentication policy for at least one application system 30, the page content of the application system 30 can be collected, and the location information and feature information corresponding to the relevant operation function can be selected based on the page content of the application system 30 to set the authentication policy. For example, all or part of the page content of the application system 30 can be captured, and key information in the page content can be selected as the location information or feature information of the operation function. This allows for convenient setting of the authentication policy for the application system 30.

[0052] In some examples, users can be grouped to obtain group information, and the authentication policy of application system 30 can be set based on this group information. In this case, users with the same job responsibilities can be configured uniformly, thereby improving efficiency.

[0053] like Figure 2As shown, in some examples, the security authentication method may include obtaining an authentication policy through a proxy client 20 and monitoring the usage of various application systems 30 based on the authentication policy to identify the operational functions of each application system 30 (step S120).

[0054] In some examples, in step S120, the authentication policy can be obtained through the proxy client 20 (i.e., the proxy client 20 can obtain the authentication policy). In some examples, the proxy client 20 can be set on the terminal device of the user accessing the application system 30. In some examples, the proxy client 20 can obtain the authentication policy via wireless or wired communication. For example, the proxy client 20 can actively pull the authentication policy from the server storing the authentication policy or receive the authentication policy issued by the server via wireless or wired communication. In some examples, the proxy client 20 can save the authentication policy after obtaining it. In some examples, the proxy client 20 can store the obtained authentication policy locally. In some examples, the proxy client 20 can periodically synchronize the authentication policy to keep the local authentication policy up-to-date.

[0055] Figure 3 This is a block diagram illustrating the proxy client 20 involved in the example of this disclosure.

[0056] In some examples, such as Figure 3 As shown, the proxy client 20 may have a policy receiving module 21 and a self-updating module 22. In some examples, the policy receiving module 21 may be configured to obtain the authentication policy. Thus, the authentication policy can be obtained. In some examples, the self-updating module 22 may be configured to automatically obtain the latest version of the proxy client 20 when the version of the proxy client 20 changes. In this case, the version of the proxy client 20 can be kept up-to-date. This reduces the risk of missing identification operation functions.

[0057] In some examples, the proxy client 20 may have a daemon module (not shown). In some examples, the daemon module may be configured to protect the proxy client 20 to keep it running. In some examples, the daemon module may be configured to detect whether the proxy client 20 is running, and if not, start it. This prevents the proxy client 20 from being uninstalled or terminated. In some examples, the proxy client 20 may be a standalone process, protected by the operating system kernel.

[0058] In some examples, proxy client 20 can send heartbeat messages periodically. In this case, it is possible to determine whether proxy client 20 is online based on the heartbeat information. This allows for timely identification of any abnormal situations involving proxy client 20.

[0059] In some examples, in step S120, the agent client 20 can monitor the usage of multiple application systems 30 based on authentication policies to identify the operational functions of each application system 30.

[0060] In some examples, multiple application systems 30 can be accessed through terminal devices. In this case, the proxy client 20 can monitor the usage of multiple application systems 30 on the terminal device based on authentication policies to identify operation identifiers and thus identify operation functions.

[0061] In some examples, the proxy client 20 can obtain the page content of the current page of the application system 30 by identifying the operation identifier. In some examples, the application system 30 to which the current page belongs can be determined by comparing the access URL of the application system 30 or the process name of the frontend with the application identifier in the authentication policy, thereby identifying the application system 30 currently running in the frontend.

[0062] In some examples, the location information in the authentication policy and the content of the current page can be used to determine whether the current page is the page containing the operation function. In other examples, if the current page is the page containing the operation function, it can be determined whether the page content of the page containing the operation function contains content with characteristic information matching the operation function. If so, it indicates that the operation identifier has been identified.

[0063] Specifically, if the page content contains the page title or key string from the location information, it can be determined that the current page is the page containing the operation function. Then, it continues to check if the page content contains the name or key string of the operation function from the feature information. If so, it indicates that the operation identifier has been identified. In some examples, the location information from the feature information can be combined to determine if the page content of the page containing the operation function contains content matching the feature information of the operation function.

[0064] In some examples, for a B / S architecture application system 30, the proxy client 20 can use a browser hook mechanism to obtain the accessed URL and / or page content. For example, a browser plugin can be created to intercept the page and obtain the accessed URL and / or page content. In some examples, the proxy client 20 can identify the operation function based on the web page request; for example, the web page request may include, but is not limited to, GET requests, POST requests, AJAX requests, and page redirect requests.

[0065] In some examples, for a client-server (CS) application system 30, the proxy client 20 can obtain page content through the operating system's kernel program and event triggering mechanism. This allows it to acquire page content. In some examples, the proxy client 20 can act as a dynamic link library of the operating system's kernel program via code injection. In this case, it can gain operating system-level control. This allows it to obtain operating system-level event triggering. In some examples, it can obtain process information (e.g., process name) through the operating system's kernel program.

[0066] However, the examples disclosed herein are not limited to this. In other examples, the page content can be obtained by intercepting the current page of the application system 30 currently accessed by the terminal device and performing OCR recognition.

[0067] like Figure 2 As shown, in some examples, the security authentication method may include authenticating operational functions based on an authentication policy (step S130).

[0068] In some examples, in step S130, before the user performs an operation on the function corresponding to the operation identifier, the proxy client 20 can authenticate the user's identity information to authenticate the operation function. In some examples, the user's identity information can be authenticated based on the authentication method corresponding to the operation identifier. In some examples, before the user performs an operation on the function corresponding to the operation identifier, the proxy client 20 can pause the current operation (i.e., pause the operation of the function) and then authenticate the user's identity information.

[0069] Figure 4 This is a schematic diagram illustrating the proxy client 20 initiating the authentication unit 40 as described in this disclosure example.

[0070] In some examples, the proxy client 20 can authenticate the user's identity information by initiating the authentication unit 40. In some examples, the authentication unit 40 can receive and authenticate the user's input identity information based on the authentication method corresponding to the operation identifier. As an example, such as Figure 4 As shown, before the user performs an operation on the operation function corresponding to the operation identifier, the authentication unit 40 can be activated to authenticate the operation function of the application system 30.

[0071] In some examples, the authentication process (i.e., the process by which authentication unit 40 authenticates the user's identity information) can be recorded to generate authentication records, which can then be monitored and analyzed. This allows for monitoring of the authentication process. In some examples, the authentication record may include proxy client information (e.g., the unique identifier, IP address, or MAC address of proxy client 20), application identifier, operation identifier, authentication method, user-input identity information, authentication result (e.g., authentication result may include authentication success and authentication failure), and user identifier. If authentication fails, the user identifier can be null. In some examples, the authentication record may also include the authentication start time and authentication end time.

[0072] The following is in conjunction with the appendix Figure 5 This section describes a detailed example of how the proxy client 20 authenticates operational functions. Figure 5 This is a flowchart illustrating the authentication of operational functions by the proxy client 20 as described in this disclosure example.

[0073] like Figure 5 As shown, in some examples, the process of the proxy client 20 authenticating the operation function may include, before the user performs the operation function corresponding to the operation identifier, the proxy client 20 suspends the current operation (step S131), starts the authentication unit 40 to authenticate the user's identity authentication information (step S132), determines whether the authentication is successful (step S133), confirms whether the user has the operation permission for the operation function (step S134), and authorizes the user to continue the current operation (step S135).

[0074] In some examples, in step S131, a window may pop up to prevent the user from continuing the operation and to pause the current operation. For example, for a BS-structured application system 30, a mask layer may pop up over the current page of the application system 30. As another example, for a CS-structured application system 30, a modal dialog box may pop up to prevent operation, and other operations of the application system 30 can only continue after the dialog box finishes working.

[0075] In some examples, in step S132, the authentication unit 40 can be set in a window that prevents the user from continuing operation. In some examples, the authentication unit 40 can receive and authenticate the user's input authentication information. In some examples, the authentication unit 40 can receive and authenticate the user's input authentication information based on the authentication method corresponding to the operation identifier. Specifically, the cognitive strategy sets authentication methods corresponding to each operation function. When the authentication unit 40 is started, the display content of the authentication unit 40 can be initialized according to the authentication method corresponding to the operation identifier. For example, for fingerprint authentication, the authentication unit 40 can display an interface guiding the user to input their fingerprint. After the user inputs the authentication information, the authentication information can be authenticated according to the authentication method corresponding to the operation identifier. Specifically, the user's input authentication information can be compared with pre-set authentication information to authenticate the authentication information. For example, for fingerprint authentication, the user's input fingerprint information can be compared with pre-recorded user fingerprint information.

[0076] In some examples, in step S133, authentication can be determined by comparing the user-input authentication information with pre-set authentication information. In some examples, if authentication is successful, the process can proceed to step S134 to confirm whether the user has the necessary permissions to perform the operation.

[0077] In some examples, in step S134, the user's permission to perform the operation can be confirmed by determining whether the user information in the authentication policy corresponding to the operation function includes the user's information. Specifically, it can be determined whether the user identifier in the authentication policy corresponding to the operation function includes the target user identifier; if so, it indicates that the user has the permission to perform the operation function. In some examples, after successful authentication, the target user identifier can be obtained through the user's input authentication information. In some examples, if the user is confirmed to have the permission to perform the operation function, step S135 can be taken to authorize the user to continue the current operation (i.e., continue performing the operation function); otherwise, the current operation is terminated (i.e., the operation function is terminated). In some examples, if the number of authentication failures exceeds a preset number, authentication can be stopped. In this case, the risk of malicious authentication by unauthorized users can be reduced. Therefore, the security of the authentication process can be improved.

[0078] In some examples, in step S135, the pop-up window that prevents the user from continuing the operation can be canceled to authorize the user to continue the current operation.

[0079] The following, combined with Figure 6This disclosure describes in detail the security authentication device 1 of the various application systems 30. The security authentication device 1 of the various application systems 30 involved in this disclosure may sometimes be simply referred to as security authentication device 1, security authentication system, authentication device, or authentication system, etc. The security authentication device 1 is used to implement the security authentication method described above. Unless otherwise specified, the description of the security authentication method also applies to the security authentication device 1. Figure 6 This is a block diagram illustrating the security authentication device 1 of the various application systems 30 involved in the examples of this disclosure.

[0080] In some examples, the security authentication device 1 can re-authenticate the operational functions of various application systems 30 that have a first authentication process. In some examples, the security authentication device 1 can be used to set a second authentication process for application systems 30 for re-authentication. In some examples, the first authentication process can be an authentication process that the application system 30 already had at the time of its release. In some examples, the application to which the first authentication process belongs is independent of the application to which the second authentication process belongs.

[0081] In some examples, such as Figure 6 As shown, the security authentication device 1 may include a policy management module 10 and a proxy client 20. The policy management module 10 may be configured to set authentication policies for at least one application system 30, and the proxy client 20 may be configured to authenticate operational functions based on the authentication policies.

[0082] In some examples, the policy management module 10 can be configured to set authentication policies for at least one application system 30. In some examples, the authentication policy may include an application identifier, an operation identifier, an authentication method for accessing an operation function, and operation user information. Additionally, the application identifier can be used to uniquely identify an application system 30. Additionally, the operation identifier can be used to identify the operation function. Additionally, the operation user information can be user information with operation permissions for the operation function. In some examples, the operation user information may include a user identifier used to associate authentication information. In some examples, the operation identifier may include location information for locating the page where the operation function is located and characteristic information of the operation function. See the relevant description of step S110 for details.

[0083] In some examples, the proxy client 20 can be configured to authenticate operation functions based on an authentication policy. In some examples, the proxy client 20 can be located on the terminal device of the user accessing the application system 30. In some examples, the proxy client 20 can be configured to obtain and save the authentication policy set by the policy management module 10. In some examples, the proxy client 20 can monitor the usage of various application systems 30 on the terminal device based on the authentication policy to identify operation identifiers. In some examples, before the user enters the operation function corresponding to the operation identifier, the proxy client 20 can pause the current operation and start the authentication unit 40. In some examples, the authentication unit 40 can receive and authenticate the user's input identity authentication information based on the authentication method corresponding to the operation identifier. In some examples, if authentication is successful and the authentication policy confirms that the user has the operation permission for the operation function, the user can be authorized to continue operating the operation function; otherwise, operation of the operation function will be terminated. In some examples, the proxy client 20, in identifying the operation identifier, can obtain the page content of the current page of the application system 30. By using location information and page content, it determines whether the current page is the page containing the operation function. If so, it can determine whether the page content of the page containing the operation function contains content matching the characteristic information. If so, it indicates that the operation identifier has been identified. For details, please refer to the relevant description of the proxy client 20 in the security authentication method.

[0084] The disclosed security authentication method and security authentication device 1, without modifying the application code of multiple application systems 30, sets authentication policies for multiple application systems 30, and sets up a proxy client 20 on the terminal device of the user accessing the application system 30. The proxy client 20 monitors the usage process of multiple application systems 30 to identify operation functions, and authenticates the operation functions based on the set authentication policies. In this way, without modifying the application code of multiple application systems 30, an additional authentication process can be added to the critical operation functions in the application system 30. Therefore, the security of multiple application systems 30 can be improved and it has universality.

[0085] While the present invention has been specifically described above in conjunction with the accompanying drawings and embodiments, it is to be understood that the above description does not limit the invention in any way. Those skilled in the art can make modifications and variations to the present invention as needed without departing from the essential spirit and scope of the invention, and all such modifications and variations fall within the scope of the present invention.

Claims

1. A method for re-authenticating multiple application systems with a first authentication process, wherein the first authentication process is an authentication process that the application system already had at the time of its release and requires modification of the application system's source code upon change, and the application system is an internal business system of an enterprise, characterized in that, The re-authentication is performed by setting a second authentication process for the application system that does not modify the application system's source code and is not inherent to the application system itself. This second authentication process includes: setting an authentication policy for at least one application system; the authentication policy includes an application identifier for uniquely identifying an application system, an operation identifier for identifying an operation function, an authentication method for accessing the operation function, and operation user information with operation permissions for the operation function; and setting a proxy client on the terminal device of the user accessing the application system. The proxy client obtains the authentication policy and monitors the usage process of multiple application systems based on the authentication policy to identify the operation functions of each application system. When a user accesses the operation function corresponding to the operation identifier... Before the operation is complete, the proxy client pauses its current operation and initiates an authentication unit to receive and authenticate the user's input identity authentication information based on the authentication method corresponding to the operation identifier. If the authentication is successful and the authentication policy confirms that the user has the operation permission for the operation function, the user is authorized to continue operating the operation function; otherwise, the operation function is terminated. The first application to which the first authentication process belongs is an application within the application system and is independent of the second application to which the second authentication process belongs. There is no interaction between the first and second applications within the application. The application is compiled from existing code. The second authentication process is set according to the security requirements of the enterprise's internal business. The operation identifier includes location information for locating the page where the operation function is located and feature information of the operation function. The location information includes the page title in the page content of the application system, and the feature information includes the name of the operation function in the page content of the application system. For a B / S architecture application system, the application identifier is set according to the access URL of the application system; for a C / S architecture application system, the process name of the application system is used as the application identifier. The proxy client, in identifying the operation identifier, obtains the page content of the current page of the application system. It then determines whether the current page is the page containing the operation function using the location information and the page content. If so, it checks whether the page content of the page containing the operation function contains content matching the feature information. If so, it indicates that the operation identifier has been identified. For B / S architecture application systems, the proxy client uses a browser hook mechanism to obtain page content. For C / S architecture application systems, the proxy client obtains page content through the operating system's kernel program and event triggering mechanism.

2. The authentication method according to claim 1, characterized in that, Before setting an authentication policy for at least one application system, the page content of the application system is collected, and the location information and feature information corresponding to the corresponding operation function are selected based on the page content of the application system to set the authentication policy.

3. The authentication method according to claim 1, characterized in that, The first authentication process includes one or more of the following: whether the authenticated user is logged in, whether the authenticated user has the operation permission for the corresponding page, whether the authenticated user has the operation permission for the corresponding operation function of the corresponding page, and whether the authenticated user has the operation permission for the corresponding data.

4. The authentication method according to claim 1, characterized in that, The proxy client obtains the authentication policy via wireless or wired communication.

5. The authentication method according to claim 1, characterized in that, The authentication is determined by comparing the user's input authentication information with the pre-set authentication information.

6. The authentication method according to claim 1, characterized in that, The system determines whether a user has permission to perform an operation by checking whether the user identifier in the authentication policy corresponding to the operation function includes the target user identifier.

7. The authentication method according to claim 1, characterized in that, When the authentication policy changes, it is synchronized to the proxy client through a full update or incremental update.

8. The authentication method according to claim 1, characterized in that, A pop-up window is displayed to prevent the user from continuing the operation and to pause the current operation. The authentication unit is set in the window.

Images