A method, apparatus, equipment, and storage medium for integrating a commercial system with an enterprise authentication system.

Abstract

This application relates to a method, apparatus, device, and storage medium for integrating a commercial system with an enterprise authentication system, applied in the field of information system technology. The method includes: the commercial system generating a user authentication request and encrypting the user authentication request using a first encryption algorithm; a trusted intermediate system performing a conversion operation on the user authentication request message; the enterprise authentication system performing user authentication processing on the converted user authentication request message; the trusted intermediate system performing a conversion operation on the user authentication result message; and the commercial system receiving the user authentication result message returned by the trusted intermediate system. The technical advantages of this application are: improved system availability, mitigation of single point of failure issues caused by SSO, and reduction of the complexity of system integration.

Description

Technical Field

[0001] This application relates to the technical field of information systems, and in particular to a method, apparatus, device and storage medium for integrating a commercial system with an enterprise authentication system. Background Technology

[0002] With the advancement of information technology construction, large groups have a large number of member companies. Each member company has built a large number of application systems to adapt to its business characteristics. Under the background of unified planning and implementation of information technology construction by the group headquarters, the authentication systems built by enterprises usually have a wide range of authentication methods. The systems built by enterprises often include mainstream commercial systems on the market, but the user authentication functions of commercial systems themselves usually only support a very limited number of types, which cannot meet the extensive authentication methods already available within large groups.

[0003] Existing technologies typically use Single Sign-On (SSO) to integrate commercial systems with a wide range of existing authentication methods within an enterprise. Users can access multiple systems with a single login. By deploying a central authentication service within a large group, users can log in using their existing wide range of authentication methods (such as AD-based authentication, table-based authentication, etc.) and then seamlessly access commercial systems through the SSO mechanism.

[0004] Because SSO relies on a central authentication service, if that service fails or becomes unavailable, all systems that depend on it may be unable to authenticate, increasing the probability of a single point of failure. Implementing an SSO solution may require modifications or configurations to existing systems to accommodate SSO requirements. Furthermore, for systems without built-in SSO support, additional development work is needed to integrate with SSO, increasing system dependency and the complexity of system integration. Summary of the Invention

[0005] To alleviate single point of failure issues and reduce the complexity of system integration, this application provides a method, apparatus, device, and storage medium for integrating commercial systems with enterprise authentication systems.

[0006] Firstly, this application provides a method for integrating a commercial system with an enterprise authentication system, employing the following technical solution: The method includes:

[0007] The commercial system generates a user authentication request, encrypts the user authentication request using a first encryption algorithm, and sends the encrypted user authentication request to the trusted intermediate system.

[0008] When the trusted middleware receives a user authentication request message from the commercial system, it performs a conversion operation on the user authentication request message and sends the converted user authentication request message to the enterprise authentication system.

[0009] When the enterprise authentication system receives the user authentication request message converted by the trusted intermediate system, it performs user authentication processing on the converted user authentication request message and sends the user authentication result message obtained after the user authentication processing to the trusted intermediate system.

[0010] When the trusted intermediate system receives the user authentication result message from the enterprise authentication system, it performs a conversion operation on the user authentication result message and sends the converted user authentication result message to the commercial system.

[0011] The commercial system receives the user authentication result message returned by the trusted intermediate system.

[0012] The above technical solution introduces a trusted middleware system as a bridge between the commercial system and the enterprise authentication system. This middleware system handles the conversion between user authentication request messages and authentication result messages, ensuring normal communication between the two systems. Even if the enterprise authentication system fails, the commercial system can still continue to communicate with the trusted middleware system to obtain authentication results, improving system availability and mitigating the single point of failure issue caused by SSO. By delegating the conversion of user authentication request messages and authentication result messages to the trusted middleware system, the commercial system only needs to integrate with the trusted middleware system, rather than directly with the enterprise authentication system. This reduces the coupling between the two systems and decreases inter-system dependencies. Furthermore, the trusted middleware system, acting as an intermediate layer, handles the conversion of authentication requests and results, simplifying the integration process between the commercial system and the enterprise authentication system and reducing the complexity of system integration.

[0013] In a specific feasible implementation, the development elements of the trusted middleware system include the message format of the commercial system in user authentication scenarios, wherein the user authentication scenarios include user authentication requests, successful user authentication, and failed user authentication.

[0014] Through the above technical solutions, commercial systems have specific message formats in user authentication scenarios. The trusted middleware system can accurately parse and process user authentication requests, successful authentication, and failed authentication messages based on these specific message formats. This standardized message format improves the system's interoperability and scalability. The clear definition of user authentication scenarios by commercial systems allows the trusted middleware system to clearly understand and handle different authentication scenarios, performing corresponding conversion operations based on the scenario. For example, when the trusted middleware system receives a user authentication request, it knows it needs to send the request to the enterprise authentication system for processing and forward the result to the commercial system after receiving the authentication result. This clearly defined user authentication scenario improves the system's understandability and manageability. Because commercial systems define message formats for user authentication scenarios, the trusted middleware system can be customized according to the specific needs of the commercial system. This allows the trusted middleware system to adapt to the requirements of different commercial systems, flexibly handling authentication requests and results of different formats. Commercial systems can customize and adjust message formats according to their own needs without changing the entire integration architecture. This flexibility and customizability improve the system's adaptability and scalability.

[0015] In one specific implementation scheme, the commercial system sending a user authentication request message to the trusted intermediate system includes:

[0016] The commercial system sends user authentication request messages to the trusted intermediate system by configuring a virtual address, and the virtual address includes the entry point for the trusted intermediate system to receive and process the user authentication request.

[0017] By configuring virtual addresses, commercial systems can send authentication request messages to trusted intermediate systems without directly exposing the actual physical address. This virtual address configuration provides a secure and flexible way for commercial systems to communicate with trusted intermediate systems and send authentication requests. Using virtual addresses, commercial systems can isolate and protect the actual physical address, hiding its internal implementation details and infrastructure, thus improving system security. Furthermore, if the physical address of the trusted intermediate system needs to be changed or the system architecture adjusted, the commercial system only needs to update the configured virtual address, without modifying the actual physical address, reducing the complexity of system maintenance and management. By configuring virtual addresses, commercial systems can flexibly configure and manage them according to actual needs. Different virtual addresses can be configured for different environments or scenarios to communicate with different trusted intermediate systems. This flexible configuration and management allows commercial systems to adapt to different deployment and integration requirements, improving system flexibility and customizability.

[0018] In one specific implementation, the conversion operation of the user authentication request message includes:

[0019] The trusted intermediate system extracts authentication request information from the user authentication request message, the authentication request information including user account and user password;

[0020] The trusted intermediate system constructs an authentication request specification message based on the user account and the user password. The format of the specification request message is the same as the format of the authentication request reference message preset by the enterprise authentication system.

[0021] Through the above technical solution, the trusted intermediate system extracts authentication request information, including the user account and password, from the user authentication request message. By extracting the authentication request information, the trusted intermediate system can accurately understand the user's authentication needs and identity verification information. Based on the extracted user account and password, the trusted intermediate system constructs a standardized authentication request message. The trusted intermediate system can then convert the user's authentication request into a standardized format that meets the requirements of the enterprise authentication system, ensuring that the authentication request can be correctly parsed and processed by the enterprise authentication system. This format consistency and compatibility ensures the accuracy and reliability of the authentication request during transmission, allowing the enterprise authentication system to directly process the generated standardized request message without additional parsing or conversion operations, thus improving the system's efficiency and reliability.

[0022] In one specific implementation, sending the converted user authentication request message to the enterprise authentication system includes:

[0023] The trusted intermediate system sends the converted user authentication request message to the enterprise authentication system by configuring a real address. The real address includes the entry point for the enterprise authentication system to receive and process the converted user authentication request.

[0024] Through the above technical solution, the trusted intermediate system sends the converted user authentication request message to the enterprise authentication system by configuring the real address. This ensures that the message is accurately delivered to the target system, and the configuration of the real address provides a direct and reliable communication method. By configuring the real address, the trusted intermediate system can flexibly connect to the enterprise authentication system as needed. This flexibility and scalability enable commercial systems to adapt to different authentication requirements and diverse enterprise authentication systems, improving the system's adaptability and scalability.

[0025] In one specific implementation, the conversion operation of the user authentication result message includes:

[0026] The trusted intermediate system extracts authentication result information from the user authentication result message. The authentication result information includes authentication status, which includes authentication success and authentication failure.

[0027] If the authentication status is successful, the trusted intermediate system constructs an authentication success specification message based on the authentication result information. The format of the authentication success specification message is the same as the format of the authentication success reference message preset by the commercial system.

[0028] If the authentication status is authentication failure, the trusted intermediate system constructs an authentication failure specification message based on the authentication result information. The format of the authentication failure specification message is the same as the format of the authentication failure reference message preset by the commercial system.

[0029] Through the above technical solutions, the trusted intermediate system extracts authentication result information, enabling it to obtain the authentication result for subsequent processing and conversion operations. By constructing authentication success and failure specification messages, the trusted intermediate system can convert the authentication success or failure results into a standardized format that meets the requirements of commercial systems, ensuring that the authentication results can be correctly parsed and processed by commercial systems. By constructing authentication success and failure specification messages, the trusted intermediate system ensures that the generated messages are identical to the preset authentication success and failure reference message formats of commercial systems. This format consistency and compatibility ensures the accuracy and reliability of authentication results during transmission, allowing commercial systems to directly process the generated specification messages without additional parsing or conversion operations, thus improving system efficiency and reliability.

[0030] In one specific implementation scheme, after the trusted intermediate system receives the user authentication request message from the commercial system, it further includes:

[0031] The trusted intermediate system determines whether the first encryption algorithm is consistent with the second encryption algorithm preset by the enterprise authentication system;

[0032] If there is a discrepancy, the trusted intermediate system decrypts the user authentication request and encrypts the user authentication request using the second encryption algorithm.

[0033] Through the above technical solution, the commercial system uses a first encryption algorithm to encrypt user authentication requests. This encryption is based on the application of symmetric or asymmetric encryption algorithms. By encrypting sensitive data in the request, confidentiality and security are ensured during transmission. Even if the encrypted request is intercepted during transmission, it cannot be deciphered by unauthorized personnel. The trusted intermediate system is responsible for receiving the encrypted user authentication request and performing encryption algorithm consistency checks. This includes checking whether the first encryption algorithm used by the commercial system is consistent with the second encryption algorithm preset by the enterprise authentication system. This check can be performed by comparing parameters such as algorithm identifier, key length, and encryption mode to ensure that the commercial system and the enterprise authentication system use the same encryption algorithm, avoiding decryption errors or communication failures due to encryption algorithm mismatch. If the trusted intermediate system detects that the first encryption algorithm used by the commercial system is inconsistent with the second encryption algorithm preset by the enterprise authentication system, it will perform a decryption operation. By decrypting, the trusted intermediate system can obtain the original user authentication request and continue to encrypt the request using the second encryption algorithm preset by the enterprise authentication system, ensuring consistency with the encryption algorithm of the enterprise authentication system, thereby improving the security and reliability of data transmission.

[0034] Secondly, this application provides an integration device for a commercial system and an enterprise authentication system, employing the following technical solution: the device includes:

[0035] An authentication request generation module is used to generate a user authentication request in the commercial system, encrypt the user authentication request using a first encryption algorithm, and send the encrypted user authentication request to the trusted intermediate system.

[0036] The request message conversion module is used to perform a conversion operation on the user authentication request message when the trusted intermediate system receives the user authentication request message from the commercial system, and send the converted user authentication request message to the enterprise authentication system.

[0037] The authentication processing module is used to perform user authentication processing operations on the converted user authentication request message when the enterprise authentication system receives the user authentication request message converted by the trusted intermediate system, and send the user authentication result message obtained after user authentication processing to the trusted intermediate system.

[0038] The result message conversion module is used by the trusted intermediate system to perform a conversion operation on the user authentication result message when it receives the user authentication result message from the enterprise authentication system, and then send the converted user authentication result message to the commercial system.

[0039] The authentication result receiving module is used by the commercial system to receive the user authentication result message returned by the trusted intermediate system.

[0040] Thirdly, this application provides a computer device that adopts the following technical solution: it includes a memory and a processor, wherein the memory stores a computer program that can be loaded by the processor and executed as described above in any of the commercial system and enterprise authentication system integration methods.

[0041] Fourthly, this application provides a computer-readable storage medium that stores a computer program capable of being loaded by a processor and executing any of the above-mentioned commercial system and enterprise authentication system integration methods.

[0042] In summary, this application has the following beneficial technical effects:

[0043] This application's solution introduces a trusted middleware system as a bridge between the commercial system and the enterprise authentication system. This middleware system handles the conversion between user authentication request messages and authentication result messages, ensuring normal communication between the two systems. Even if the enterprise authentication system fails, the commercial system can still continue to communicate with the trusted middleware system to obtain authentication results, improving system availability and mitigating the single point of failure issue caused by SSO. By delegating the conversion of user authentication request messages and authentication result messages to the trusted middleware system, the commercial system only needs to integrate with the trusted middleware system, rather than directly with the enterprise authentication system. This reduces the coupling between the commercial system and the enterprise authentication system, decreasing inter-system dependencies. Furthermore, the trusted middleware system, acting as an intermediate layer, handles the conversion of authentication requests and results, simplifying the integration process between the commercial system and the enterprise authentication system and reducing the complexity of system integration. Attached Figure Description

[0044] Figure 1 This is a flowchart of the method for integrating a commercial system with an enterprise authentication system in an embodiment of this application.

[0045] Figure 2 This is a schematic diagram used in the embodiments of this application to illustrate the integrated interaction between the commercial system and the enterprise authentication system.

[0046] Figure 3 This is a structural block diagram of the device for integrating a commercial system and an enterprise authentication system in the embodiments of this application.

[0047] Figure 4 This is a schematic diagram used to illustrate a computer device in the embodiments of this application.

[0048] Reference numerals: 301, Authentication request generation module; 302, Request message conversion module; 303, Authentication processing module; 304, Result message conversion module; 305, Authentication result receiving module. Detailed Implementation

[0049] The following is in conjunction with the appendix Figure 1-4 This application will be described in further detail.

[0050] When enterprises undertake IT infrastructure development, the systems they build often include mainstream commercial systems on the market (including domestic and foreign vendors). These commercial systems are external systems provided by third parties, including Enterprise Resource Planning (ERP) systems, Customer Relationship Management (CRM) systems, Supply Chain Management systems, e-commerce platforms, etc. Enterprises select and integrate these commercial systems to support and manage their business processes. The user authentication functions of commercial systems typically only support a very limited range of types, such as Active Directory (AD)-based user authentication. In the context of unified planning and implementation of IT infrastructure development at the group headquarters, enterprise-built authentication systems usually have a wide range of authentication methods, such as AD-based user authentication, table-based user authentication, and integration with multiple trusted internal authentication systems. Since commercial systems are usually not open source, in the context of large groups undertaking unified IT infrastructure development, it is usually not possible to integrate them with existing internal user authentication systems by modifying the source code of commercial systems.

[0051] To address the aforementioned issues, this application discloses a method for integrating a commercial system with an enterprise authentication system. This method enables the integration of a commercial system with an enterprise's internal authentication system. When an enterprise accesses multiple commercial systems, in order to achieve centralized identity verification and access control, the enterprise integrates the commercial systems with the enterprise authentication system. By integrating the commercial systems, the enterprise authentication system's identity verification function can be used to verify the user's identity and control access to enterprise resources based on their permissions.

[0052] like Figure 1 As shown, the method includes the following steps:

[0053] S10, the commercial system generates a user authentication request, encrypts the user authentication request using the first encryption algorithm, and sends the encrypted user authentication request to the trusted intermediate system.

[0054] Specifically, when a user authenticates in a commercial system, the commercial system generates a user authentication request, which contains the user's authentication information. To ensure the security of this sensitive information during transmission, the commercial system typically uses a first encryption algorithm to encrypt the user authentication request. The first encryption algorithm is an encryption algorithm selected and implemented by the commercial system. Its purpose is to convert the user authentication request into ciphertext to prevent unauthorized access to sensitive information. This encryption algorithm is usually implemented using symmetric key encryption or asymmetric key encryption.

[0055] S20: When the trusted intermediate system receives a user authentication request message from the commercial system, it performs a conversion operation on the user authentication request message and sends the converted user authentication request message to the enterprise authentication system.

[0056] Specifically, a trusted middleware system acts as a trusted node between a commercial system and an enterprise authentication system. It is responsible for receiving and forwarding encrypted user authentication requests. Upon receiving a user authentication request message, the trusted middleware system performs a conversion operation on the message. This conversion process involves adjusting the message format, protocol, or encryption method to suit the requirements of the enterprise authentication system. The specific details of the conversion operation depend on the interface specifications and protocols between the commercial system and the enterprise authentication system. For example, if the commercial system uses the SOAP communication protocol while the enterprise authentication system uses the RESTful API communication protocol, the trusted middleware system can convert the commercial system's request message from the SOAP communication protocol to the RESTful API communication protocol so that it can be passed to the enterprise authentication system. Figure 2 As shown, through the transformation operation of a trusted middleware system, commercial systems can be seamlessly integrated with enterprise authentication systems, even if there are different data formats or communication protocols between them. The trusted middleware system acts as a bridge to ensure that user authentication requests generated by the commercial system can be correctly transmitted to the enterprise authentication system, thereby achieving a unified authentication and access control policy. This integration method simplifies communication and coordination between systems and improves overall security and efficiency.

[0057] S30: When the enterprise authentication system receives the user authentication request message converted by the trusted intermediate system, it performs user authentication processing on the converted user authentication request message and sends the user authentication result message obtained after the user authentication processing to the trusted intermediate system.

[0058] Specifically, the enterprise authentication system receives a transformed user authentication request message from a trusted intermediate system and performs user authentication processing on the received message. This process includes: the enterprise authentication system parses the message, extracting authentication information and other relevant data; the enterprise authentication system compares and verifies the provided authentication information, such as username and password, with its internal user database or authentication service; based on the user's authentication result, the enterprise authentication system determines whether the user has permission to access the requested resources and functions; after completing the user authentication processing, the enterprise authentication system generates a user authentication result message, which contains the user authentication result, such as success or failure status information, and other relevant authentication result data, such as access permissions and role information; the enterprise authentication system then sends the generated user authentication result message back to the trusted intermediate system.

[0059] S40: When the trusted intermediate system receives the user authentication result message from the enterprise authentication system, it performs a conversion operation on the user authentication result message and sends the converted user authentication result message to the commercial system.

[0060] Specifically, the trusted intermediate system receives the user authentication result message after user authentication processing from the enterprise authentication system and performs a transformation operation on the user authentication result message, including: the trusted intermediate system parses the user authentication result message and extracts the authentication result information and other relevant data; according to the requirements and interface specifications of the commercial system, the trusted intermediate system converts the user authentication result message into the data format and structure required by the commercial system, such as re-encapsulating data, remapping fields, or performing data format conversion; after completing the transformation operation, the trusted intermediate system generates a transformed user authentication result message that conforms to the requirements and interface specifications of the commercial system so that the commercial system can correctly parse and process it.

[0061] S50: Commercial systems receive user authentication result messages returned by trusted intermediate systems.

[0062] Specifically, commercial systems can obtain accurate information about user authentication status and access permissions based on user authentication result messages returned by trusted intermediate systems. Commercial systems can then take appropriate actions based on this information to ensure the security and legitimacy of user access, while providing the necessary services and functions.

[0063] It's important to note that trusted middleware systems can further enhance their availability and reliability by adding High Availability (HA) features to effectively mitigate single points of failure. For example, trusted middleware systems can employ redundant deployments, deploying multiple instances simultaneously on different physical or virtual servers. This allows other instances to take over service when one instance fails, ensuring continuous system availability. Trusted middleware systems can also introduce load balancers to distribute traffic evenly across different instances. Load balancers can monitor the health of instances and dynamically adjust traffic distribution based on preset algorithms, ensuring load balancing and efficient operation. When an instance fails, the trusted middleware system should have automatic failover capabilities, automatically detecting the failure and switching traffic to a backup instance. This can be achieved using heartbeat detection, monitoring, and fault detection mechanisms, as well as maintaining session state consistency during the failover process. If the trusted middleware system involves read and write operations, ensuring data consistency and integrity is crucial when implementing HA. This can be achieved using database replication, transaction logging, and data synchronization mechanisms to guarantee data synchronization between the backup and primary instances.

[0064] By integrating commercial and enterprise authentication systems, a trusted middleware system is introduced as a bridge between them. This middleware system handles the conversion of user authentication request and result messages, ensuring seamless integration and decoupling direct dependencies and interfaces, thus reducing system complexity. The trusted middleware system encrypts requests using either symmetric or asymmetric key encryption. Through appropriate encryption algorithms and key management strategies, it provides confidentiality and integrity for data transmission, preventing unauthorized access to sensitive information and enhancing security during transmission. Upon receiving a user authentication request message, the trusted middleware system performs message conversion operations. The system adapts itself to the format and protocol required by the enterprise authentication system. This conversion operation can include message format re-encapsulation, field remapping, and data format conversion. In this way, commercial systems and enterprise authentication systems can use different data formats and communication protocols without the need for complex integration and adaptation. This simplifies the integration process between commercial systems and enterprise authentication systems and reduces the complexity of system integration. The trusted middleware system mitigates single point of failure by adding high availability (HA) functionality. By using redundant deployment and load balancers, the system's availability and reliability can be increased, ensuring continuous availability. Automatic switching and fault detection mechanisms can help the system recover quickly in the event of a failure and maintain session state consistency, mitigating the single point of failure problem caused by SSO.

[0065] In one embodiment, to improve the adaptability and scalability of the system, the development elements of the trusted middleware system include the message format of the commercial system in user authentication scenarios, which include user authentication requests, successful user authentication, and failed user authentication.

[0066] For example, mainstream packet capture tools such as Wireshark and Fiddler can be used to intercept communication traffic between commercial systems and other systems. These tools can capture network packets and provide the ability to analyze and view packet content in a visual manner. By observing and analyzing these packets, the message formats of commercial systems in scenarios such as user authentication requests, successful user authentication, and failed user authentication can be obtained. The captured packets are analyzed to identify and extract the message formats used by commercial systems, including parsing the message structure, fields, and values. By analyzing messages in multiple user authentication scenarios, the commonalities and differences in message formats can be determined, so as to design a general message format that a trusted intermediate system can handle. Based on the analyzed message formats, a trusted intermediate system is developed to ensure that it can correctly parse and process messages from commercial systems in different user authentication scenarios. The trusted intermediate system needs to be able to convert and forward user authentication result messages and integrate seamlessly with commercial systems.

[0067] By using mainstream packet capture tools such as Wireshark and Fiddler, communication traffic between commercial systems and other systems can be captured. Analyzing these packets reveals the message format of the commercial system in user authentication scenarios. This analysis method based on actual communication traffic ensures that the trusted intermediate system accurately parses and processes the communication of the commercial system, giving it high adaptability and scalability. By observing and analyzing packets in multiple user authentication scenarios, more comprehensive and detailed message format information can be obtained, enabling the trusted intermediate system to handle various user authentication situations. Furthermore, analyzing the message formats in multiple user authentication scenarios allows for the identification of commonalities and... The system identifies differences and designs a universal message format that the trusted middleware system can handle. This allows the trusted middleware system to adapt to and convert different message formats, enabling seamless integration with commercial systems. By reducing the direct integration and adaptation work between commercial systems and the trusted middleware system, the complexity between systems is reduced, and the maintainability and scalability of the system are improved. The network packet analysis method can directly obtain the actual message format of commercial systems in user authentication scenarios, avoiding dependence on commercial system code and code review work. By analyzing the structure, fields, and values ​​in the data packets, the key elements of the message format can be accurately extracted and identified, thereby accelerating the development speed and accuracy of the trusted middleware system.

[0068] In one embodiment, in order for a commercial system to communicate with a trusted intermediate system and send authentication requests, the step of the commercial system sending a user authentication request message to the trusted intermediate system can be specifically performed as follows:

[0069] Commercial systems send user authentication request messages to trusted middleware systems by configuring virtual addresses. The virtual address serves as the entry point for trusted middleware systems to receive and process user authentication requests. It can be an IP address or a domain name, etc. Commercial systems use this virtual address to establish a connection with trusted middleware systems. Trusted middleware systems have been configured and are ready to receive and process user authentication request messages. That is, the network service of trusted middleware systems has been listening on the configured virtual address and is able to receive request messages from commercial systems.

[0070] By configuring virtual addresses, commercial systems can send user authentication request messages to trusted middleware systems. These virtual addresses can be IP addresses or domain names, allowing commercial systems to flexibly configure them as needed. By configuring virtual addresses, commercial systems can dynamically specify the receiving entry point of the trusted middleware system, adapting it to different environments and requirements, thus improving system flexibility and adaptability. By establishing a connection with the trusted middleware system using virtual addresses, commercial systems achieve conceptual decoupling. They do not need to directly concern themselves with the specific location and network details of the trusted middleware system; they only need to configure the virtual address. This decoupling reduces the direct dependency between the commercial system and the trusted middleware system, simplifying the integration process and reducing integration complexity. The trusted middleware system is already configured and ready to receive and process user authentication request messages; its network service is listening on the configured virtual address. This preparation and configuration gives the trusted middleware system scalability and fault tolerance. By configuring virtual addresses, the trusted middleware system can scale horizontally, adding multiple instances to handle more user authentication requests. Furthermore, if a trusted middleware instance fails or becomes unavailable, the commercial system can switch to another available instance by configuring virtual addresses, ensuring continuous system availability.

[0071] In one embodiment, in order for the authentication request to be correctly parsed and processed by the enterprise authentication system, the step of performing the transformation operation on the user authentication request message can be specifically performed as follows:

[0072] The trusted intermediate system extracts authentication request information from user authentication request messages. This information includes the user account and password, which are crucial data necessary for user authentication. Based on the user account and password, the trusted intermediate system constructs a standardized authentication request message. The format of this standardized message is identical to the format of the enterprise authentication system's default authentication request reference message, including specific message structure, field names, and field order. By maintaining consistency in message format, the trusted intermediate system ensures that the enterprise authentication system can correctly parse and process authentication requests.

[0073] The trusted intermediate system extracts authentication request information, such as user account and password, from user authentication request messages to ensure that necessary information is transmitted to the enterprise authentication system for authentication. This data extraction and processing process can be flexibly configured according to actual needs, enabling the trusted intermediate system to extract the required authentication request information based on different authentication requirements and the requirements of the authentication system. By constructing a standardized authentication request message based on the user account and password, the trusted intermediate system ensures that the converted message is identical to the enterprise authentication system's preset authentication request reference message format. This standardized message construction includes specific message structure, field names, field order, etc. Maintaining consistent message formats ensures that enterprise authentication systems can correctly parse and process authentication requests, mitigating authentication failures or errors caused by message format mismatches. By constructing standardized messages that conform to the preset authentication request reference message format of the enterprise authentication system, the trusted middleware system is compatible with different enterprise authentication systems. Whether integrating with existing authentication systems or replacing or upgrading them in the future, the trusted middleware system maintains compatibility with enterprise authentication systems. This compatibility and scalability enable the trusted middleware system to effectively perform authentication request conversion operations in different authentication environments, improving system efficiency and reliability.

[0074] In one embodiment, to ensure that the message can be accurately delivered to the target system, the step of sending the converted user authentication request message to the enterprise authentication system can be specifically performed as follows:

[0075] The trusted intermediary system sends the converted user authentication request message to the enterprise authentication system by configuring a real address. The real address includes the entry point for the enterprise authentication system to receive and process the converted user authentication request. It is the network identifier of the enterprise authentication system, including IP address or domain name, etc. The trusted intermediary system uses the real address to establish a connection with the enterprise authentication system. The enterprise authentication system has been configured and is ready to receive and process the converted user authentication request. That is, the network service of the enterprise authentication system has been listening on the configured real address and is able to receive request messages from the trusted intermediary system.

[0076] By configuring the real address, the trusted intermediate system can accurately send the converted user authentication request message to the enterprise authentication system. The real address serves as the network identifier for the enterprise authentication system, ensuring the accuracy of the message's destination address, mitigating the risk of messages being sent to the wrong location or system, and improving the accuracy of message transmission. Configuring the real address allows the trusted intermediate system to establish a connection with the enterprise authentication system as needed. The real address can be in the form of an IP address or domain name, allowing for flexible configuration based on specific circumstances. This flexibility and configurability enable the trusted intermediate system to adapt to different enterprise authentication systems and network environments, improving the system's adaptability and scalability. Configuring the real address and establishing a connection with the enterprise authentication system achieves integration and interoperability between the trusted intermediate system and the enterprise authentication system. Through this connection, the trusted intermediate system can communicate bidirectionally with the enterprise authentication system, sending converted user authentication request messages to the enterprise authentication system and receiving responses from it. This integration and interoperability enables data exchange and collaborative work between different systems, improving the overall efficiency and functionality of the systems.

[0077] In one embodiment, to ensure the accuracy and reliability of the authentication result during transmission, the step of performing the transformation operation on the user authentication result message can be specifically performed as follows:

[0078] The trusted intermediate system extracts authentication result information from the user authentication result message. This information includes the authentication status and other relevant details. The authentication status includes successful and failed authentication. If the authentication status is successful, the trusted intermediate system constructs a successful authentication specification message based on the authentication result information. The format of this message is the same as the pre-set successful authentication reference message in the commercial system, and it includes a successful authentication status identifier, success information, and other relevant data. If the authentication status is failed, the trusted intermediate system constructs a failed authentication specification message based on the authentication result information. The format of this message is the same as the pre-set failed authentication reference message in the commercial system, and it includes a failed authentication status identifier, failure information, and other relevant data.

[0079] The trusted intermediate system extracts authentication result information from user authentication result messages, including authentication status and other relevant authentication result details, ensuring that critical authentication result information is transmitted to the commercial system. This data extraction and processing process can be flexibly configured according to actual needs, enabling the trusted intermediate system to extract the required result information based on different authentication result scenarios. Based on the authentication result information, the trusted intermediate system constructs authentication success or failure specification messages, ensuring that the converted message format is identical to the commercial system's preset authentication success or failure reference message format. The authentication success specification message and the authentication failure specification message have specific message structures. Maintaining consistency in message format, including field names and order, ensures that commercial systems can accurately parse and process authentication results, improving the accuracy and reliability of authentication results during transmission. By constructing authentication success and failure specification messages, the trusted intermediate system includes authentication status identifiers, success or failure information, and other relevant data in the converted messages. This allows commercial systems to directly obtain authentication status and result details from the messages, facilitating subsequent processing and decision-making. Furthermore, the standardized message format enables commercial systems to uniformly process messages from different users' authentication results, improving system scalability and compatibility.

[0080] In one embodiment, to improve the security and reliability of data transmission, the steps taken by the trusted intermediate system after receiving a user authentication request message from a commercial system can be specifically as follows:

[0081] The trusted intermediate system determines whether the first encryption algorithm is consistent with the second encryption algorithm preset by the enterprise authentication system, ensuring that the same encryption algorithm is used during data transmission to guarantee data security and reliability. If they are inconsistent, the trusted intermediate system decrypts the user authentication request and encrypts it using the second encryption algorithm, ensuring that the same encryption algorithm is used during data transmission between the trusted intermediate system and the enterprise authentication system, thereby improving the security and reliability of data transmission.

[0082] The trusted intermediate system determines whether the first encryption algorithm is consistent with the second encryption algorithm preset by the enterprise authentication system. This consistency check ensures that the same encryption algorithm is used during data transmission between the trusted intermediate system and the enterprise authentication system. By comparing the consistency of encryption algorithms, the trusted intermediate system can reduce the use of incompatible or insecure encryption algorithms, improving the security and reliability of data transmission. If the first encryption algorithm is inconsistent with the second encryption algorithm preset by the enterprise authentication system, the trusted intermediate system needs to decrypt the user authentication request and encrypt it using the second encryption algorithm. This dynamic encryption algorithm switching ensures that the encryption algorithm used during data transmission is compatible with the enterprise authentication system, improving the security and reliability of data transmission. By ensuring the use of consistent encryption algorithms between the trusted intermediate system and the enterprise authentication system, the security and reliability of data transmission can be improved. Using the same encryption algorithm ensures that data is properly protected during transmission, preventing malicious tampering or theft. At the same time, using compatible encryption algorithms helps the correct parsing and processing of data between the two systems, improving the reliability of data transmission.

[0083] Figure 1 This is a flowchart illustrating a method for integrating a commercial system with an enterprise authentication system in one embodiment. It should be understood that, although... Figure 1 The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows; unless explicitly stated otherwise, there is no strict order requirement for the execution of these steps, and they can be executed in other orders; and Figure 1 At least some of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least some of the sub-steps or stages of other steps.

[0084] Based on the above method, this application also discloses an integration device for commercial systems and enterprise authentication systems.

[0085] Reference Figure 3 The device includes the following modules:

[0086] The authentication request generation module 301 is used by the commercial system to generate user authentication requests, encrypt the user authentication requests using a first encryption algorithm, and send the encrypted user authentication requests to a trusted intermediate system.

[0087] The request message conversion module 302 is used by the trusted intermediate system to perform conversion operations on the user authentication request message when it receives the user authentication request message from the commercial system, and to send the converted user authentication request message to the enterprise authentication system.

[0088] The authentication processing module 303 is used by the enterprise authentication system to perform user authentication processing operations on the converted user authentication request message when it receives the user authentication request message converted by the trusted intermediate system, and to send the user authentication result message obtained after the user authentication processing to the trusted intermediate system.

[0089] The result message conversion module 304 is used by the trusted intermediate system to perform a conversion operation on the user authentication result message when it receives the user authentication result message from the enterprise authentication system, and then send the converted user authentication result message to the commercial system.

[0090] The authentication result receiving module 305 is used by commercial systems to receive user authentication result messages returned by trusted intermediate systems.

[0091] In one embodiment, the authentication request generation module 301 is specifically used for the development elements of the trusted intermediate system, including the message format of the commercial system in the user authentication scenario. The user authentication scenario includes user authentication request, user authentication success, and user authentication failure.

[0092] In one embodiment, the authentication request generation module 301 is specifically used by the commercial system to send a user authentication request message to a trusted intermediate system by configuring a virtual address. The virtual address includes the entry point for the trusted intermediate system to receive and process user authentication requests.

[0093] In one embodiment, the request message conversion module 302 is specifically used by the trusted intermediate system to extract authentication request information from the user authentication request message, the authentication request information including the user account and user password; the trusted intermediate system constructs an authentication request specification message based on the user account and user password, the format of the specification request message being the same as the format of the authentication request reference message preset by the enterprise authentication system.

[0094] In one embodiment, the request message conversion module 302 is specifically used by the trusted intermediate system to send the converted user authentication request message to the enterprise authentication system by configuring a real address. The real address includes the entry point for the enterprise authentication system to receive and process the converted user authentication request.

[0095] In one embodiment, the result message conversion module 304 is specifically used by the trusted intermediate system to extract authentication result information from the user authentication result message. The authentication result information includes the authentication status, which includes authentication success and authentication failure. If the authentication status is authentication success, the trusted intermediate system constructs an authentication success specification message based on the authentication result information. The format of the authentication success specification message is the same as the format of the authentication success reference message preset by the commercial system. If the authentication status is authentication failure, the trusted intermediate system constructs an authentication failure specification message based on the authentication result information. The format of the authentication failure specification message is the same as the format of the authentication failure reference message preset by the commercial system.

[0096] In one embodiment, the request message conversion module 302 is specifically used by the trusted intermediate system to determine whether the first encryption algorithm is consistent with the second encryption algorithm preset by the enterprise authentication system; if they are inconsistent, the trusted intermediate system decrypts the user authentication request and encrypts the user authentication request using the second encryption algorithm.

[0097] The commercial system and enterprise authentication system integration device provided in this application embodiment can be applied to the commercial system and enterprise authentication system integration method provided in the above embodiment. For relevant details, please refer to the above method embodiment. The implementation principle and technical effect are similar, and will not be repeated here.

[0098] It should be noted that the commercial system and enterprise authentication system integration device provided in this embodiment is only illustrated by the above-mentioned division of functional modules / functional units when integrating the commercial system and enterprise authentication system. In practical applications, the above functions can be assigned to different functional modules / functional units as needed, that is, the internal structure of the commercial system and enterprise authentication system integration device can be divided into different functional modules / functional units to complete all or part of the functions described above. In addition, the implementation method of the commercial system and enterprise authentication system integration method provided in the above method embodiment and the implementation method of the commercial system and enterprise authentication system integration device provided in this embodiment belong to the same concept. The specific implementation process of the commercial system and enterprise authentication system integration device provided in this embodiment is detailed in the above method embodiment, and will not be repeated here.

[0099] This application also discloses a computer device.

[0100] Specifically, such as Figure 4As shown, the computer device can be a desktop computer, laptop computer, handheld computer, or cloud server, etc. The computer device may include, but is not limited to, a processor and memory. The processor and memory can be connected via a bus or other means. The processor can be a Central Processing Unit (CPU). The processor can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs) or other programmable logic devices, graphics processing units (GPUs), embedded neural network processing units (NPUs) or other dedicated deep learning coprocessors, discrete gate or transistor logic devices, discrete hardware components, or combinations of the above types of chips.

[0101] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer-executable programs, and modules, such as the program instructions / modules corresponding to the methods in the above embodiments of this application. The processor executes various functional applications and data processing by running the non-transitory software programs, instructions, and modules stored in the memory, thereby implementing the methods in the above embodiments. The memory may include a program storage area and a data storage area, wherein the program storage area may store the control unit and the application program required for at least one function; the data storage area may store data created by the processor, etc. Furthermore, the memory may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0102] This application also discloses a computer-readable storage medium.

[0103] Specifically, the computer-readable storage medium is used to store a computer program, which, when executed by a processor, implements the methods described in the above-described method embodiments. Those skilled in the art will understand that implementing all or part of the processes in the methods described in the above-described embodiments of this application can be accomplished by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments described above. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk drive (HDD), or solid-state drive (SSD), etc.; the storage medium can also include combinations of the above types of memory.

[0104] This specific embodiment is merely an explanation of the present invention and is not intended to limit the invention. After reading this specification, those skilled in the art can make modifications to this embodiment without contributing any inventive step, but such modifications are protected by patent law as long as they are within the scope of the claims of the present invention.

Claims

1. A method for integrating a commercial system with an enterprise authentication system, characterized in that, The method is applied to an integrated architecture of a commercial system and an enterprise authentication system, wherein the integrated architecture includes a commercial system, a trusted middleware system, and an enterprise authentication system, and the method includes: The commercial system generates a user authentication request, encrypts the user authentication request using a first encryption algorithm, and sends the encrypted user authentication request to the trusted intermediate system. When the trusted middleware receives a user authentication request message from the commercial system, it performs a conversion operation on the user authentication request message and sends the converted user authentication request message to the enterprise authentication system. When the enterprise authentication system receives the user authentication request message converted by the trusted intermediate system, it performs user authentication processing on the converted user authentication request message and sends the user authentication result message obtained after the user authentication processing to the trusted intermediate system. When the trusted intermediate system receives the user authentication result message from the enterprise authentication system, it performs a conversion operation on the user authentication result message and sends the converted user authentication result message to the commercial system. The commercial system receives the user authentication result message returned by the trusted intermediate system; The commercial system sends a user authentication request message to the trusted intermediate system, including: The commercial system sends user authentication request messages to the trusted intermediate system by configuring a virtual address, wherein the virtual address includes the entry point for the trusted intermediate system to receive and process the user authentication request; The process of performing the transformation operation on the user authentication request message includes: The trusted intermediate system extracts authentication request information from the user authentication request message, the authentication request information including the user account and user password; The trusted intermediate system constructs an authentication request specification message based on the user account and the user password. The format of the request specification message is the same as the format of the authentication request reference message preset by the enterprise authentication system.

2. The method according to claim 1, characterized in that, The development elements of the trusted middleware system include the message format of the commercial system in user authentication scenarios, which include user authentication requests, successful user authentication, and failed user authentication.

3. The method according to claim 1, characterized in that, Sending the converted user authentication request message to the enterprise authentication system includes: The trusted intermediate system sends the converted user authentication request message to the enterprise authentication system by configuring a real address. The real address includes the entry point for the enterprise authentication system to receive and process the converted user authentication request.

4. The method according to claim 1, characterized in that, The process of performing the conversion operation on the user authentication result message includes: The trusted intermediate system extracts authentication result information from the user authentication result message. The authentication result information includes authentication status, which includes authentication success and authentication failure. If the authentication status is successful, the trusted intermediate system constructs an authentication success specification message based on the authentication result information. The format of the authentication success specification message is the same as the format of the authentication success reference message preset by the commercial system. If the authentication status is authentication failure, the trusted intermediate system constructs an authentication failure specification message based on the authentication result information. The format of the authentication failure specification message is the same as the format of the authentication failure reference message preset by the commercial system.

5. The method according to claim 1, characterized in that, After receiving the user authentication request message from the commercial system, the trusted intermediate system further includes: The trusted intermediate system determines whether the first encryption algorithm is consistent with the second encryption algorithm preset by the enterprise authentication system; If there is a discrepancy, the trusted intermediate system decrypts the user authentication request and encrypts the user authentication request using the second encryption algorithm.

6. A device for integrating a commercial system with an enterprise authentication system, characterized in that, The device is applied to an integrated architecture of a commercial system and an enterprise authentication system, the integrated architecture of the commercial system and the enterprise authentication system including a commercial system, a trusted middleware system, and an enterprise authentication system, and the device includes: The authentication request generation module (301) is used by the commercial system to generate a user authentication request, encrypt the user authentication request using a first encryption algorithm, and send the encrypted user authentication request to the trusted intermediate system. Specifically, the commercial system sends a user authentication request message to the trusted intermediate system by configuring a virtual address, wherein the virtual address includes the entry point for the trusted intermediate system to receive and process the user authentication request. The request message conversion module (302) is used to perform a conversion operation on the user authentication request message when the trusted intermediate system receives the user authentication request message from the commercial system, and send the converted user authentication request message to the enterprise authentication system. Specifically, the trusted intermediate system extracts the authentication request information from the user authentication request message, the authentication request information including the user account and the user password; the trusted intermediate system constructs an authentication request specification message based on the user account and the user password, the format of the request specification message being the same as the format of the authentication request reference message preset by the enterprise authentication system. The authentication processing module (303) is used to perform user authentication processing operation on the converted user authentication request message when the enterprise authentication system receives the user authentication request message converted by the trusted intermediate system, and send the user authentication result message obtained after user authentication processing to the trusted intermediate system. The result message conversion module (304) is used by the trusted intermediate system to perform a conversion operation on the user authentication result message when it receives the user authentication result message from the enterprise authentication system, and to send the converted user authentication result message to the commercial system. The authentication result receiving module (305) is used by the commercial system to receive the user authentication result message returned by the trusted intermediate system.

7. A computer device, characterized in that, It includes a memory and a processor, wherein the memory stores a computer program that can be loaded by the processor and executed according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer program is stored that can be loaded by a processor and executed according to any one of claims 1 to 5.

Images