Iam platform management method, electronic device, and storage medium

Abstract

The application provides an IAM platform management method, an electronic device and a storage medium. A mapping relationship between a main login account of an IAM client and M slave login accounts of M business systems is set in an IAM platform, where M is an integer greater than or equal to 1. The IAM platform receives a login behavior of the IAM client logging in the IAM platform through the main login account, judges whether the login behavior is abnormal, and if the login behavior is abnormal, determines whether there is a logged-in business system in the M business systems, and if there is a logged-in business system, logs out the logged-in business system. When the user's main login account is leaked or a non-user logs in the IAM platform, the login state of the logged-in business system is released in time, and the security of the business system information is protected.

Description

Technical Field

[0001] This application relates to the field of communication networks, and more particularly to an IAM platform management method, electronic device, and storage medium. Background Technology

[0002] Identity and Access Management (IAM) plays an increasingly important role in modern network security architecture. An IAM platform centrally manages user identities across various business systems, mapping multiple accounts of the same user across different application systems to a unique user account within the IAM platform. By normalizing user accounts and providing unified authentication and access control, secure login across different business systems is achieved.

[0003] There is existing research on the binding and login of the IAM platform with various business systems. However, when the IAM platform detects abnormal login behavior, how to simultaneously deactivate the login status of each business system is a key issue in protecting user account security and the information security of related business systems. Summary of the Invention

[0004] This application provides an IAM platform management method, electronic device, and storage medium to enable the IAM platform to simultaneously deactivate the login status of each business system when it detects abnormal login behavior.

[0005] Firstly, this application provides an IAM platform management method, wherein the IAM platform establishes a mapping relationship between the main login account of the IAM client and M secondary login accounts of business systems, where M is an integer greater than or equal to 1; the method includes:

[0006] Receive login behavior from the IAM client using the main login account to log in to the IAM platform;

[0007] Determine whether the login behavior is abnormal;

[0008] If the login behavior is abnormal, determine whether there is a logged-in business system among the M business systems;

[0009] If a business system is already logged in, then that business system will be taken offline.

[0010] In some embodiments, after taking offline the logged-in business system, the method further includes locking the login permissions of the main login account of the IAM client.

[0011] In some embodiments, the method further includes sending a notification message to the IAM client, the notification message being used to notify the IAM client that the login permissions of the main login account have been locked.

[0012] In some embodiments, the method further includes:

[0013] Receive the request to unlock the IAM client login permission;

[0014] Send a main login account authentication request to the IAM client;

[0015] Receive the main login account authentication information sent by the IAM client;

[0016] After successful authentication based on the primary login account authentication information, the login privileges of the primary login account are unlocked.

[0017] In some embodiments, before receiving the login behavior of the IAM client logging into the IAM platform through the main login account, the method further includes:

[0018] Upon first receiving a login request from the IAM client to log in to the IAM platform using the main login account, the system accessible to the IAM client is obtained based on the main login account.

[0019] Send the business systems accessible to the IAM client to the IAM client;

[0020] In response to the IAM client's login request for M accessible business systems, the login request includes: logging in to the accessible business system from the login account;

[0021] After successfully logging into the M business systems based on the login request, the mapping relationship between the primary login account of the IAM client and the secondary login accounts of the M business systems is bound.

[0022] In some embodiments, after determining whether the login behavior is abnormal, the step further includes:

[0023] If the login behavior is normal, then obtain the access request from the IAM client for the target business system, where the target business system is any one of the M business systems;

[0024] Obtain the login security level of the target business system;

[0025] If the login security level is higher than the preset level, a secondary authentication request for the target business system is sent to the IAM client.

[0026] Receive secondary authentication information for the target business system sent by the IAM client;

[0027] After successful authentication based on the secondary authentication information, log in to the target business system using the secondary login account of the target business system.

[0028] In some embodiments, after obtaining the login security level of the target business system, the method further includes: if the login security level is lower than or equal to the preset level, then using the secondary login account of the target business system to log in to the target business system.

[0029] In some embodiments, before obtaining the login security level of the target business system, the method further includes: receiving a setting request from the IAM client for the login security level of the target business system, and setting the login security level of the target business system according to the setting request.

[0030] Secondly, this application provides an electronic device, including: a processor, and a memory and a communication interface communicatively connected to the processor; the processor communicates through the communication interface.

[0031] The memory stores computer-executed instructions;

[0032] The processor executes computer execution instructions stored in the memory to implement the method as described in any one of the IAM platform management methods above.

[0033] Thirdly, this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of the IAM platform management methods above.

[0034] The IAM platform management method, electronic device, and storage medium provided in this application establish a mapping relationship between the main login account of the IAM client and the secondary login accounts of M business systems within the IAM platform, where M is an integer greater than or equal to 1. The IAM platform receives login behavior from the IAM client using the main login account, determines whether the login behavior is abnormal, and if so, checks if any of the M business systems are logged in. If so, the logged-in business system is taken offline. This ensures that if the user's main login account is leaked or a non-user logs into the IAM platform, the login status of the logged-in business system is promptly deactivated to protect the security of business system information. Attached Figure Description

[0035] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0036] Figure 1This is a schematic diagram illustrating the existing method of IAM platform logging into different business systems using a primary login account;

[0037] Figure 2 A schematic diagram of an IAM platform management method provided in an embodiment of this application;

[0038] Figure 3 This is a schematic diagram of another IAM platform management method provided in the embodiments of this application;

[0039] Figure 4 This is a schematic diagram of a method for unlocking login permissions of a main login account provided in an embodiment of this application;

[0040] Figure 5 This is a schematic diagram of the structure of an IAM platform device provided in an embodiment of this application;

[0041] Figure 6 This is a schematic diagram of the structure of an electronic device 600 provided in an embodiment of this application.

[0042] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0043] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0044] The IAM platform plays an increasingly important role in modern network security architecture as an account management platform. By uniformly managing user identities across various business systems, the IAM platform maps multiple accounts of the same user across different application systems to a unique user account within the platform. Through user account normalization and the provision of unified identity authentication and authorized access control, it achieves a unified security baseline for login across different application systems.

[0045] Figure 1 This is a schematic diagram illustrating how an IAM platform in existing technology logs into different business systems using a primary login account. For example... Figure 1As shown, when a user logs into the IAM platform on a terminal device using a primary login account, the third-party business system sends the account information of the business system bound to this primary login account to the IAM platform. The IAM platform then sends login confirmation to the terminal device. After the user confirms the login, they can log into the business system. For example, the primary login account can be the user's mobile phone number or other identifiable authentication account.

[0046] Therefore, the IAM platform allows users to log in to various business systems using a primary login account. However, if the user's primary login account is leaked, or if someone other than the user logs into the IAM platform, the already logged-in business systems may experience further information leaks.

[0047] Therefore, when suspicious login behavior is detected, how the IAM platform manages various business systems to prevent the leakage of user information is crucial to protecting user information security.

[0048] This application effectively protects user information security by taking offline all business systems associated with the main login account when suspicious login behavior is detected on the IAM platform, and locking the access permissions to log in to business systems through the IAM platform.

[0049] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems will be described in detail below with reference to specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will be described below with reference to the accompanying drawings.

[0050] Figure 2 This is a schematic diagram illustrating an IAM platform management method provided in an embodiment of this application. Figure 2 As shown, the method may include the following steps:

[0051] S201. The IAM platform receives login requests from IAM clients who log in to the IAM platform using their main login account.

[0052] Users open the IAM client on their terminal device and log in to the IAM platform using their main login account.

[0053] For example, the primary login account can be a user's mobile phone number. As a natural electronic identity identifier for mobile internet users, the mobile phone number of a telecom operator has the widest user penetration and the strongest real-name authentication. Using the mobile phone number as the primary login account to identify different user identities in the IAM platform allows for the convenient and quick establishment of a unified IAM account system and fully utilizes the telecom operator's mobile phone number authentication system. Besides the user's mobile phone number, the primary login account can also be other accounts that can identify a user's electronic identity, such as the user's email address, etc., without specific requirements here.

[0054] For example, a user can log in to the IAM platform using their primary login account. This can be achieved by entering their registered primary login account and corresponding password in the IAM client. Alternatively, the user can log in by entering their mobile phone number or email address and receiving a verification code sent by the IAM platform to that phone or email address. Another option is to log in by scanning a login QR code provided by the IAM client. Or, the user can log in using facial recognition linked to their primary login account. The IAM client provides one or more of these login methods to enable users to log in to the IAM platform through the IAM client.

[0055] For example, when the IAM platform receives a user's login request, it obtains the login behavior, which may include the information the user entered when logging in to the IAM client, such as the main login account, password, verification code, facial information, etc. It may also include the geographical location information of the IAM client at the time of login and / or login time information, etc.

[0056] The IAM platform verifies the user's primary login account information and login behavior. If the entered login information is correct and the login behavior is normal, the verification is successful, and the user can log in to the IAM platform through the IAM client, ensuring the secure use of the IAM platform.

[0057] S202. The IAM platform determines whether the login behavior is abnormal. If the login behavior is abnormal, it determines whether there is a logged-in business system among the M business systems.

[0058] For example, abnormal login behavior could be caused by incorrect primary login username, password, or verification code entered by the user in the IAM client, or by incorrect facial recognition information. The IAM platform can also limit the number of times or the time allotted for a user to enter login information. If a user fails to enter the correct login information within the specified number of attempts and / or within the specified time, the IAM platform will authenticate the login behavior as abnormal.

[0059] For example, login anomalies could also occur due to incorrect geolocation information or incorrect login time when the user logs in via the IAM client. For instance, after a user successfully logs into the IAM platform, login permissions can be set based on geolocation and / or time information. This defines the acceptable location and time range for login, allowing the user to log in only within these specified geographical and / or time ranges. Alternatively, the IAM platform can save the geolocation and / or time information for each successful login and analyze or process this information to set appropriate login permissions based on the specified geolocation and / or time. For example, if the user's successful logins are all in regions A, B, and C, then regions A, B, and C are set as acceptable login locations. Or, if each successful login occurs on a weekday, then weekdays are considered acceptable login times. If the login is outside the acceptable location and / or time range, the IAM platform authentication login behavior is considered abnormal.

[0060] The IAM platform determines whether the login behavior is abnormal. If it is not abnormal, the user can access the IAM platform through the IAM client. After logging into the IAM platform, the user can access various business systems through the IAM platform.

[0061] S203. If there are already logged-in business systems, then take those logged-in business systems offline.

[0062] When abnormal login behavior is detected, it indicates that the user's account information has been leaked. The IAM platform can then implement single sign-on for each business system while also deactivating the login status of those systems. For example, the IAM platform checks the interface status of each business system to determine if it is logged in. If so, the IAM platform sends a logout notification to the business system. The business system then changes its login status interface to a logout callback interface according to the communication protocol. The IAM platform then uses these callback interfaces to force the business system offline.

[0063] Figure 3 This is a schematic diagram of another IAM platform management method provided in an embodiment of this application. For example... Figure 3 As shown, in some embodiments, after the IAM platform takes a logged-in business system offline, it also includes:

[0064] S301, the IAM platform locks the login permissions of the main login account of the IAM client.

[0065] Once the IAM platform locks the login permissions of the main login account for the IAM client, users can no longer log in to the IAM platform using only the main login account.

[0066] S302. The IAM platform sends a notification message to the IAM client, which informs the client that the login permissions of the main login account have been locked.

[0067] It should be noted that the IAM platform can send notification messages to the IAM client at any time after the IAM platform has locked the login permissions of the IAM client's main login account.

[0068] Figure 4 This is a schematic diagram illustrating a method for unlocking login permissions for a primary login account provided in an embodiment of this application. For example... Figure 4 As shown, after the IAM platform locks the login permissions of the main login account for the IAM client, if a user needs to log in to the IAM platform again, they must first unlock the main login account's login permissions. The methods for unlocking the main login account's login permissions may include the following steps:

[0069] S401, the IAM platform receives requests to unlock IAM client login permissions.

[0070] For example, after the IAM platform locks the login permissions of the main login account on the IAM client, if a user opens the IAM client and clicks to unlock the main login account's login permissions on the IAM client's login page, the IAM client will send an unlock request to the IAM platform. Alternatively, the IAM client can generate a link for the main login account's login permission unlock request, and the user can click the link to send an unlock request to the IAM platform. Specific requirements are not detailed here.

[0071] S402, the IAM platform sends a primary login account authentication request to the IAM client.

[0072] After receiving the request to unlock login permissions from the IAM client, the IAM platform sends a primary login account authentication request to the IAM client.

[0073] For example, the authentication request could be set up during a user's first login to unlock login permissions after an abnormal login, specifying the authentication policy for the primary login account. This could involve the user saving authentication questions or methods related to the primary login account on the IAM platform as the unlock authentication policy. The unlock authentication policy can be one or a combination of multiple policies; specific requirements are not specified here. Another example is when a user clicks "Unlock Primary Login Account Login Permissions" on the IAM client login page. The IAM client generates an authentication method to unlock the primary login account login permissions. This authentication method may include a combination of the primary login account and the aforementioned unlock authentication policy. After the user completes the relevant unlock authentication input, the IAM client sends the primary login account authentication information to the IAM platform.

[0074] S403, the IAM platform receives the main login account authentication information sent by the IAM client.

[0075] The IAM platform verifies the primary login account authentication information sent by the IAM client.

[0076] S404. After successful authentication based on the main login account authentication information, the IAM platform unlocks the login permissions of the main login account.

[0077] After authenticating with their main login account information, users can log in to the IAM platform again and perform single sign-on to various business systems on the IAM client page.

[0078] When the IAM platform first receives a login request from an IAM client using its primary login account, it retrieves the business systems accessible to the client based on that primary login account. The IAM platform then sends a list of these accessible business systems to the client. In response to the client's login request for one of the M accessible business systems, the platform assigns a secondary login account to each system. After successfully logging into any of the M business systems, the platform establishes a mapping between the primary login account and the secondary login accounts for the M business systems.

[0079] For example, the IAM platform, based on the primary login account, synchronizes the secondary login accounts of M business systems bound to the primary login account to the IAM platform via API or offline import. The IAM platform generates an intermediate master-slave account operating system from the primary login account and the secondary login accounts of each business system, and pushes this intermediate master-slave account operating system to the IAM client. After logging into the IAM platform for the first time, users can see and operate this intermediate master-slave account operating system on the IAM client page. For example, each business system is presented as an icon on the IAM client page. When a user clicks on a business system icon, the IAM platform and the business system interact with the single sign-on authentication protocol, and the IAM client page prompts the user whether they agree to single sign-on for this business system. After the user agrees, the IAM platform generates an available master-slave account operating system, from which point the user can log in to the corresponding business system from the IAM client page and obtain the corresponding access permissions.

[0080] The above method enables the binding of the IAM platform with various business systems. Users can log in to other business systems simply by logging into the IAM platform, achieving unified management of all business systems. Furthermore, user confirmation is required before the IAM platform can bind with any business system, ensuring the security of business system usage.

[0081] In some embodiments, after a user logs into the IAM platform, the IAM platform obtains the access request from the IAM client for a target business system, which can be any one of M business systems. Simultaneously, the IAM platform obtains the login security level of the target business system. If the login security level is higher than a preset level, a secondary authentication request for the target business system is sent to the IAM client. The platform receives the secondary authentication information for the target business system from the IAM client. After successful authentication based on the secondary authentication information, the user logs into the target business system using the secondary login account.

[0082] In some embodiments, the IAM platform can set secondary authentication policies after single sign-on for different business systems based on their login security levels.

[0083] For example, the IAM platform receives a login security level setting request from the IAM client for a target business system. Based on the setting request, the IAM platform sets the login security level for the target business system. For instance, after a user logs into the IAM platform for the first time, the IAM client page sorts or categorizes the login security of various business systems, sets a preset login security level for each system, and configures corresponding two-factor authentication policies. When a user logs into a business system with a single sign-on security level higher than the preset level on the IAM client, the IAM platform sends a two-factor authentication request to the IAM client. After completing the two-factor authentication, the user can log in to the target business system.

[0084] For example, the IAM platform sorts or categorizes business systems based on their login security, generates preset login security levels for each system, and generates corresponding two-factor authentication policies. When a user attempts to log in to a business system through the IAM client with a single sign-on security level higher than the preset level, the IAM platform sends a two-factor authentication request to the IAM client. After completing the two-factor authentication, the user can log in to the target business system. The security level of a business system can be set as needed, and specific requirements are not specified here.

[0085] In some embodiments, if the login security level is lower than or equal to a preset level, the target business system is logged in using the secondary login account of the target business system. When the security level of the business system is lower than or equal to the preset level, there is no need to set up secondary authentication; users can directly log in to the business system via single sign-on or through the secondary login account of the business system.

[0086] In some embodiments, the secondary authentication policy can also be an authentication policy set separately by the user on the IAM platform. For example, after a user logs in to the target business system via single sign-on on the IAM client, they can then log in to the target business system through facial recognition, password, or verification code authentication. The secondary authentication policy can be set as needed, and specific requirements are not specified here.

[0087] By setting up secondary authentication based on the login security level of the business system, the data security of business systems with high login security levels is further protected, preventing the data of business systems from being threatened after the main login account of the IAM platform is leaked.

[0088] In some embodiments, after a user unlocks login permissions for their primary login account and attempts to log in to various business systems again, the IAM platform can set a three-factor authentication policy for single sign-on based on the login security level of different business systems. This three-factor authentication policy may or may not be consistent with the aforementioned two-factor authentication policy; specific requirements are not specified here.

[0089] Once the IAM platform locks the login permissions of the main login account on the IAM client, users can apply for unlocking and complete the relevant authentication through the IAM client to log in to the IAM platform again, and then log in to various business systems through the IAM platform to achieve unified management of the business systems.

[0090] The above describes the steps of the IAM platform management method according to the embodiments of this application. In practical applications, the IAM platform or users can determine which specific steps to implement and the order of implementation as needed.

[0091] The above are embodiments of the method of this application. The IAM platform device, electronic device, and computer-readable storage medium provided in the embodiments of this application will be described below.

[0092] Figure 5 This is a schematic diagram of the structure of an IAM platform device provided in an embodiment of this application. Figure 5 As shown, the IAM platform device includes a processing module 51 and a receiving module 52. Optionally, the IP controller may also include a transmitting module 53.

[0093] The processing module 51 is used to determine whether the login behavior of the IAM client logging into the IAM platform through the main login account is abnormal; if the login behavior is abnormal, it determines whether there is a logged-in business system among the M business systems; if there is a logged-in business system, it takes the logged-in business system offline.

[0094] The receiving module 52 is used to receive login behavior of the IAM client logging into the IAM platform through the main login account.

[0095] One possible implementation is that the processing module 51 is specifically used to: lock the login permissions of the main login account of the IAM client after the logged-in business system is taken offline; and unlock the login permissions of the main login account after successful authentication based on the main login account authentication information.

[0096] For example, upon first receiving a login request from an IAM client to log in to the IAM platform using the main login account, the system retrieves the business systems accessible to the IAM client based on the main login account; sends the list of business systems accessible to the IAM client to the IAM client; responds to the IAM client's login request for the M accessible business systems, the login request including the secondary login account for logging into the accessible business systems; and after successfully logging into the M business systems based on the login request, binds the mapping relationship between the main login account of the IAM client and the secondary login accounts of the M business systems.

[0097] For example, if the login behavior is normal, the system obtains the IAM client's access request for the target business system, which can be any one of M business systems; it obtains the login security level of the target business system; if the login security level is higher than a preset level, it sends a secondary authentication request for the target business system to the IAM client; it receives the secondary authentication information for the target business system sent by the IAM client; and after successful authentication based on the secondary authentication information, it logs into the target business system using the secondary login account of the target business system. If the login security level is lower than or equal to the preset level, it logs into the target business system using the secondary login account of the target business system.

[0098] For example, before obtaining the login security level of the target business system, the receiving module 52 receives a setting request from the IAM client for the login security level of the target business system; and sets the login security level of the target business system according to the setting request.

[0099] In one possible implementation, the receiving module 52 is specifically configured to: receive an unlocking request for login permissions from the IAM client; receive primary login account authentication information sent by the IAM client; receive an access request from the IAM client for a target business system, where the target business system is any one of M business systems; receive secondary authentication information for the target business system sent by the IAM client; and receive a request from the IAM client to set the login security level for the target business system.

[0100] In one possible implementation, the sending module 53 is specifically used to: send a notification message to the IAM client, the notification message being used to notify the IAM client that the login permission of the main login account has been locked; send a main login account authentication request to the IAM client; send the IAM client a list of business systems accessible to the IAM client; and if the login security level is higher than a preset level, send a secondary authentication request for the target business system to the IAM client.

[0101] The IAM platform device provided in this application can perform the actions of the IAM platform management method in the above method embodiments. Its implementation principle and technical effect are similar, and will not be described again here.

[0102] Figure 6 This is a schematic diagram of the structure of an electronic device 600 provided in an embodiment of this application. Figure 6 As shown, the electronic device 600 may include at least one processor 601, a memory 602, and a communication interface 603.

[0103] Memory 602 is used to store programs. Specifically, the program may include program code, which includes computer operation instructions. Memory 602 may include high-speed RAM, and may also include non-volatile memory, such as at least one disk storage device.

[0104] The processor 601 executes computer execution instructions stored in the memory 602 to implement the IAM platform management method described in the foregoing method embodiments. The electronic device may be, for example, a user's mobile phone, tablet computer, etc.

[0105] The processor 601 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of this application.

[0106] The electronic device 600 can communicate and interact with external devices through the communication interface 603. External devices can be carrier network base stations, etc.

[0107] In practical implementation, if the communication interface 603, memory 602, and processor 601 are implemented independently, they can be interconnected via a bus to complete communication. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc., but this does not imply that there is only one bus or one type of bus.

[0108] Optionally, in a specific implementation, if the communication interface 603, memory 602, and processor 601 are integrated on a single chip, then the communication interface 603, memory 602, and processor 601 can communicate through an internal interface.

[0109] This application also provides a computer-readable storage medium, which may include various media capable of storing program code, such as a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk. The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement any of the methods described above for IAM platform management.

[0110] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.

[0111] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A method for managing an IAM platform, characterized in that, The IAM platform establishes a mapping relationship between the primary login account of the IAM client and M secondary login accounts of business systems, where M is an integer greater than or equal to 1; the method includes: Receive login behavior from the IAM client using the main login account to log in to the IAM platform; Determine whether the login behavior is abnormal; If the login behavior is abnormal, determine whether there is a logged-in business system among the M business systems; If the logged-in business system exists, then the logged-in business system shall be taken offline. After determining whether the login behavior is abnormal, the method further includes: If the login behavior is normal, then obtain the access request from the IAM client for the target business system, where the target business system is any one of the M business systems; Obtain the login security level of the target business system; If the login security level is higher than the preset level, a secondary authentication request for the target business system is sent to the IAM client; the secondary authentication information for the target business system sent by the IAM client is received; after successful authentication based on the secondary authentication information, the user logs into the target business system using the login account of the target business system. If the login security level is lower than or equal to the preset level, then the target business system is logged in using the secondary login account of the target business system.

2. The method according to claim 1, characterized in that, After taking offline the logged-in business systems, the following is also included: Lock the login permissions of the main login account of the IAM client.

3. The method according to claim 2, characterized in that, The method further includes: A notification message is sent to the IAM client, which informs the IAM client that the login permissions of the main login account have been locked.

4. The method according to claim 2, characterized in that, The method further includes: Receive the request to unlock the IAM client login permission; Send a main login account authentication request to the IAM client; Receive the main login account authentication information sent by the IAM client; After successful authentication based on the primary login account authentication information, the login privileges of the primary login account are unlocked.

5. The method according to any one of claims 1-4, characterized in that, Before receiving the login behavior of the IAM client logging into the IAM platform through the main login account, the method further includes: Upon first receiving a login request from the IAM client to log in to the IAM platform using the main login account, the system accessible to the IAM client is obtained based on the main login account. Send the business systems accessible to the IAM client to the IAM client; In response to the IAM client's login request for M accessible business systems, the login request includes: logging in to the accessible business system from the login account; After successfully logging into the M business systems based on the login request, the mapping relationship between the primary login account of the IAM client and the secondary login accounts of the M business systems is bound.

6. The method according to claim 1, characterized in that, Before obtaining the login security level of the target business system, the process also includes: Receive the IAM client's request to set the login security level for the target business system; Based on the setting request, set the login security level of the target business system.

7. An electronic device, characterized in that, include: A processor, and a memory and a communication interface communicatively connected to the processor; The processor communicates through the communication interface; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1-6.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-6.

Images