A gateway-based permission authentication method

Abstract

The application particularly relates to a gateway-based permission authentication method. After receiving a request of a client, the gateway-based permission authentication method immediately performs a preliminary security check and legality verification, and initiatively interacts with a background authentication service to submit verification request information; the authentication service performs deep comparison and verification on the verification request, and feeds back a deep verification result to the gateway; and the gateway decides whether to grant the client corresponding access permission according to the received deep verification result. The gateway-based permission authentication method effectively reduces the complexity and maintenance cost caused by independent permission verification of each module, greatly simplifies a permission management architecture, improves the robustness and consistency of the system, significantly enhances the security protection capability of the system, reduces security risks such as data leakage and malicious intrusion caused by permission vulnerabilities, and provides a solid technical foundation for constructing a safe, stable and efficient network application environment.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a gateway-based access authentication method. Background Technology

[0002] With the deep penetration and widespread application of internet technology, the flow and exchange of information and data on the network have become increasingly frequent. However, at the same time, information security issues are showing an increasingly serious trend, attracting widespread attention globally. Personal information security and data security require special attention and emphasis in today's era of widespread internet use.

[0003] Especially in enterprises and various organizations, the presence of large amounts of critical business data and sensitive information makes information security protection a crucial task. How to effectively ensure that these valuable information resources can only be accessed by legitimately authorized users, and prevent unauthorized intrusion and misuse, has become an urgent problem to be solved.

[0004] While traditional authentication mechanisms offer some protection for information resources, they also reveal several significant shortcomings. First, their security performance is often unsatisfactory, making them vulnerable to various new attack methods and posing a risk of information leakage. Second, these authentication methods are relatively complex and cumbersome to manage, unable to flexibly adapt to constantly changing user needs and organizational structures, thus impacting work efficiency and user experience. Therefore, seeking more advanced, intelligent, and efficient solutions to the security and management challenges of traditional authentication is particularly urgent.

[0005] To address the aforementioned issues, this invention proposes a gateway-based authentication method. Summary of the Invention

[0006] To overcome the shortcomings of existing technologies, this invention provides a simple and efficient gateway-based access control method.

[0007] This invention is achieved through the following technical solution:

[0008] A gateway-based authentication method includes the following steps:

[0009] Step S1: The client initiates a request and directs it to the system gateway; upon receiving the request, the gateway immediately performs a preliminary security check and legitimacy verification.

[0010] Step S2: After completing the initial security check and legitimacy verification, the gateway actively interacts with the backend authentication service and submits verification request information.

[0011] The authentication service performs in-depth comparison and verification of the verification request based on strict authentication logic and user permission database, and feeds back the in-depth verification results to the gateway;

[0012] Step S3: Based on the received deep verification result, the gateway decides whether to grant the client the corresponding access permissions.

[0013] If the verification passes, the request is allowed to proceed to the target service.

[0014] Conversely, if the verification fails, the access attempt will be rejected to ensure that illegal or unauthorized requests cannot penetrate into the system.

[0015] In step S1, when a client application attempts to access a protected resource, the client first constructs and encapsulates a request message, including but not limited to the method for initiating the request, the URL of the target resource, the query parameters carried, and the necessary information such as the request body content; in addition, when security verification is involved, it also includes authentication credentials.

[0016] In step S1, the gateway performs preliminary security checks and legitimacy verification, including the following steps:

[0017] Step S1.1, Request Header Integrity Verification: The gateway checks the header fields of the request header to ensure the integrity and accuracy of the request's format and semantics;

[0018] Step S1.2, Security Policy Review: The gateway compares the request with a preset security policy, which includes verifying the source of the request to ensure that it comes from an authorized client or network; in addition, the gateway also verifies the validity of the token to confirm whether the requester has the appropriate permissions to access the requested resource.

[0019] Step S1.3, Authentication Information Confirmation: The gateway checks whether the request contains the necessary authentication information, including but not limited to passwords, certificates and other authentication credentials, to ensure that only authorized users or entities can access protected resources through the gateway.

[0020] In step S1, when the gateway performs permission verification, it is compatible with different permission verification methods, including but not limited to route-based authentication, role-based authentication, user-based authentication, group-based authentication, department-based authentication, API-based authentication, and OAuth-based authentication.

[0021] To ensure the secure transmission of sensitive information, in step S2, the gateway uses a standard authentication protocol to encrypt or sign the client's identity credentials and forwards the verification request containing the encrypted client identity credentials and detailed information about the requested access to the resource to the authentication service.

[0022] In step S2, the gateway uses OAuth2 or JWT authentication protocols to ensure that the client's identity and the legitimacy of the request are accurately verified.

[0023] In step S2, the authentication service performs deep verification, including the following steps:

[0024] Step S2.1, Decrypt the token: The authentication service uses the corresponding key or algorithm to decrypt the incoming token to obtain the client identity information or authorization information contained therein;

[0025] Step S2.2, Signature Verification: If a digital signature is used, the authentication service will verify the validity of the signature to ensure that the request has not been tampered with;

[0026] Step S2.3, User Credential Comparison: The authentication service compares the decrypted information with the user credentials stored in the database to confirm whether the client's identity is legitimate;

[0027] Step S2.4, Multi-factor authentication: Perform multi-factor authentication according to the requirements of the security policy, including but not limited to verification codes and biometric information;

[0028] Step S2.5, Additional Security Steps: To increase security, additional security steps are implemented, including risk assessment, real-time monitoring, and early warning.

[0029] In step S2, when the authentication service sends the deep verification result back to the gateway, if the verification is successful, the feedback message contains a new or extended access token, which is an important credential used by the client to prove its identity and obtain access rights in subsequent requests.

[0030] In step S3, when deep verification is successful, the gateway issues or refreshes the access token, which serves as the credential for subsequent interactions between the client and the server.

[0031] Meanwhile, to ensure precise control and management of permissions, the gateway imposes fine-grained restrictions on client access based on the permission information in the verification results, ensuring that clients can only access resources that match their permissions, which helps protect the security and integrity of the system.

[0032] In addition, the gateway also records relevant access information to track and analyze client access behavior and detect potential security threats or abnormal activities.

[0033] In step S3, in order to ensure both the security and efficiency of the system, a regular communication mechanism is established between the gateway and the authentication service to achieve real-time updates and synchronization of the access token status, including but not limited to extending the validity period of the token, revoking invalid tokens, and adjusting the scope of token permissions.

[0034] A gateway-based authentication device is characterized by comprising a memory and a processor; the memory is used to store a computer program, and the processor is used to execute the computer program to implement the above-described method steps.

[0035] A readable storage medium, characterized in that: a computer program is stored on the readable storage medium, and the computer program, when executed by a processor, implements the above-described method steps.

[0036] The beneficial effects of this invention are: the gateway-based permission authentication method effectively reduces the complexity and maintenance costs caused by each distributed system module independently performing permission verification, greatly simplifies the overall permission management architecture of the system, and improves the robustness and consistency of the system;

[0037] Furthermore, since all external access must first pass through the gateway, the system's security capabilities are significantly enhanced, reducing security risks such as data leaks and malicious intrusions caused by access vulnerabilities. This provides a solid technical foundation for building a secure, stable, and efficient network application environment. Attached Figure Description

[0038] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0039] Appendix Figure 1 This is a schematic diagram of the gateway-based authorization authentication method of the present invention.

[0040] Appendix Figure 2 This is a schematic diagram of the gateway-based authorization system architecture of the present invention.

[0041] Appendix Figure 3 This is a schematic diagram illustrating the compatibility of different permission verification rules in this invention. Detailed Implementation

[0042] To enable those skilled in the art to better understand the technical solutions of this invention, the technical solutions in the embodiments of this invention will be clearly and completely described below in conjunction with the embodiments of this invention. Obviously, the described embodiments are merely some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this invention.

[0043] As attached Figure 1 As shown, this gateway-based authentication method includes the following steps:

[0044] Step S1: The client initiates a request and directs the request to the system gateway; upon receiving the request, the gateway immediately performs a series of preliminary security checks and legitimacy verifications.

[0045] Step S2: After completing the initial security check and legitimacy verification, the gateway actively interacts with the backend authentication service and submits detailed verification request information.

[0046] The authentication service performs in-depth comparison and verification of the verification request based on strict authentication logic and user permission database, and feeds back the in-depth verification results to the gateway;

[0047] Step S3: Based on the received deep verification result, the gateway dynamically determines whether to grant the client the corresponding access permissions.

[0048] If the verification passes, the request is allowed to proceed to the target service.

[0049] Conversely, if the verification fails, the access attempt will be rejected to ensure that illegal or unauthorized requests cannot penetrate into the system.

[0050] In step S1, when a client application attempts to access a protected resource, the client first constructs and encapsulates a detailed request message, including but not limited to the method of initiating the request (such as GET, POST, etc.), the URL of the target resource's Uniform Resource Locator, the query parameters carried, and the necessary information including the request body content; in addition, when security verification is involved, it also includes authentication credentials, such as access tokens or signed identity information.

[0051] In a network architecture, a gateway that acts as an intermediary will conduct a comprehensive review of the legitimacy of a client's request after receiving it.

[0052] In step S1, the gateway performs preliminary security checks and legitimacy verification, including the following steps:

[0053] Step S1.1, Request Header Information Integrity Verification: The gateway carefully checks all information in the request header, including common header fields such as User-Agent, Accept, and Content-Type, to ensure the integrity and accuracy of the request's format and semantics.

[0054] Step S1.2, Security Policy Review: The gateway compares the request with the preset security policy, which includes verifying the source of the request to ensure that it comes from an authorized client or network; in addition, the gateway also verifies the validity of the token to confirm whether the requester has the appropriate permissions to access the requested resource.

[0055] Step S1.3, Authentication Information Confirmation: The gateway checks whether the request contains the necessary authentication information, including but not limited to passwords, certificates and other authentication credentials, to ensure that only authorized users or entities can access protected resources through the gateway.

[0056] Through these rigorous verification steps, the gateway can identify and block potential unauthorized requests at an early stage, providing an important security defense to protect the system from unauthorized access and attacks.

[0057] In step S1, when the gateway performs permission verification, it is compatible with different permission verification methods, including but not limited to route-based authentication, role-based authentication, user-based authentication, group-based authentication, department-based authentication, API-based authentication, and OAuth-based authentication.

[0058] If the gateway itself cannot complete the verification process directly, it will act as a proxy. In order to ensure the secure transmission of sensitive information, in step S2, the gateway uses a standard authentication protocol to encrypt or sign the client's identity credentials to prevent unauthorized third parties from obtaining or tampering with this important information, and forwards the verification request containing the encrypted client identity credentials and the detailed information of the requested access to the resource to a dedicated authentication service.

[0059] In step S2, the gateway uses the OAuth2 or JWT authentication protocol;

[0060] OAuth2 is a widely used authorization framework that provides a series of processes and mechanisms for clients to obtain access to protected resources. With OAuth2, clients can gain authorization to access specific resources without exposing their user credentials.

[0061] JWT (JSON Web Token) is a simple, open standard used to securely transmit claim information between parties. JWTs can contain client identity information, authorization information, etc., and can be digitally signed to ensure their integrity and authenticity.

[0062] By using these standard authentication protocols, a reliable trust relationship can be established between the gateway and the authentication service, ensuring that the client's identity and the legitimacy of its requests are accurately verified. At the same time, these protocols also provide good scalability and interoperability, making the integration between different systems and services smoother.

[0063] Server-side deep verification is a crucial step in ensuring system security. When the authentication service receives a verification request from the gateway, it performs deep verification using a series of stringent encryption algorithms and authorization rules.

[0064] In step S2, the authentication service performs deep verification, including the following steps:

[0065] Step S2.1, Decrypt the token: The authentication service uses the corresponding key or algorithm to decrypt the incoming token to obtain the client identity information or authorization information contained therein;

[0066] The methods used include, but are not limited to: md5, sha1, sha256, or AES symmetric encryption using a key, or RSA asymmetric encryption using a public and private key. Encryption is performed during the token issuance phase; the key is decrypted and verified during the verification phase. Base64 encoding and decoding are also supported, or BCrypt encryption is used to internally convert 8 to 56 characters into a 448-bit key; and other national cryptographic algorithms.

[0067] Step S2.2, Signature Verification: If a digital signature is used, the authentication service will verify the validity of the signature to ensure that the request has not been tampered with;

[0068] Step S2.3, User Credential Comparison: The authentication service compares the decrypted information with the user credentials stored in the database to confirm whether the client's identity is legitimate;

[0069] Step S2.4, Multi-factor authentication: Perform multi-factor authentication according to the requirements of the security policy, including but not limited to requiring the client to provide additional verification codes, biometric information or other forms of authentication;

[0070] Step S2.5, Additional Security Steps: To increase security, additional security steps are implemented, including risk assessment, real-time monitoring, and early warning.

[0071] Through these deep verification steps, the authentication service can accurately determine the identity and authorization status of clients, ensuring that only legitimate clients can access protected resources. This rigorous verification process helps protect the system from unauthorized access and potential security threats.

[0072] After a series of complex and rigorous verification processes, the authentication service generates a feedback message based on the verification results. This feedback message explicitly indicates whether the client's authentication request was successful.

[0073] In step S2, when the authentication service sends the deep verification result back to the gateway, if the verification is successful, the feedback message contains a new or extended access token. This access token is an important credential used by the client to prove its identity and obtain access rights in subsequent requests. In addition, the feedback message may also contain other relevant metadata, such as the client's permission information and session validity period.

[0074] Through this feedback mechanism, the client can promptly understand the authentication status of its request and take appropriate action based on the information in the feedback message. If authentication is successful, the client can use the provided access token to continue subsequent operations; if authentication fails, the client can take appropriate measures, such as re-initiating authentication or providing other required information, to restrict unauthorized users from further accessing the system or illegally obtaining data.

[0075] Once the gateway successfully receives the authentication result from the authentication service, it will make a crucial decision to determine whether to allow the client to continue accessing the specific resource. If the authentication result confirms the client's identity and permissions, the gateway will not only approve the client's access request but also take further action.

[0076] In step S3, when deep authentication is successful, the gateway performs a series of operations to authorize the client. This may include issuing or refreshing an access token, which serves as the credential for the client's subsequent interactions with the server. An access token is a special credential that authorizes the client to access specific resources or perform specific operations within a certain timeframe.

[0077] To ensure precise control and management of permissions, the gateway imposes fine-grained restrictions on client access based on the permission information in the verification results. This means that clients can only access resources that match their permissions and cannot access other restricted content beyond their authorized scope. This fine-grained permission control helps protect the security and integrity of the system.

[0078] In addition, the gateway also logs relevant access information for subsequent auditing and monitoring. These logs can be used to track and analyze client access behavior and detect potential security threats or abnormal activity.

[0079] Through this access control decision-making and authorization mechanism, the gateway can effectively manage and protect resources while ensuring that only authorized clients can make legitimate access. This helps to establish a secure and reliable system environment, protecting sensitive data and critical resources from unauthorized access and misuse.

[0080] In step S3, to ensure both system security and efficiency, a periodic communication mechanism is established between the gateway and the authentication service to achieve real-time updates and synchronization of the access token status. This process includes, but is not limited to, extending the token's validity period, revoking invalid tokens, and adjusting the token's permission scope.

[0081] Through this continuous session management and token maintenance, the system can maintain the persistence of user sessions, eliminating the need for frequent authentication over a period of time and thus improving the user experience. Simultaneously, timely revocation of invalid tokens effectively prevents unauthorized access attempts, strengthening the overall system's access control mechanism.

[0082] Specifically, the gateway periodically sends requests to the authentication service to check the validity and permissions of the access token. If the token is about to expire, the gateway can request the authentication service to extend its validity to ensure that the user's session is not unexpectedly interrupted. On the other hand, if it is discovered that the token has been compromised or that other security risks exist, the gateway can revoke the token in a timely manner to prevent malicious use.

[0083] Furthermore, the gateway and authentication service can work together to adjust the token's permission scope based on changes in business needs and security policies. This allows the system to flexibly adapt to different scenarios and access requirements, ensuring that only users with appropriate permissions can access the corresponding resources.

[0084] This continuous session management and token maintenance mechanism is a crucial component of building a secure and reliable system. It helps maintain system stability and security while improving user convenience and overall efficiency.

[0085] The gateway-based authentication device includes a memory and a processor; the memory is used to store a computer program, and the processor is used to execute the computer program to implement the above-described method steps.

[0086] The readable storage medium stores a computer program that, when executed by a processor, implements the above-described method steps.

[0087] The embodiments described above are merely one specific implementation of the present invention. Ordinary changes and substitutions made by those skilled in the art within the scope of the technical solution of the present invention should be included within the protection scope of the present invention.

Claims

1. A gateway-based access authentication method, characterized in that: Includes the following steps: Step S1: The client initiates a request and directs it to the system gateway; upon receiving the request, the gateway immediately performs a preliminary security check and legitimacy verification. In step S1, when a client application attempts to access a protected resource, the client first constructs and encapsulates a request message, including but not limited to the method for initiating the request, the URL of the target resource, the query parameters carried, and the necessary information including the request body content; in addition, when security verification is involved, it also includes authentication credentials. In step S1, the gateway performs preliminary security checks and legitimacy verification, including the following steps: Step S1.1, Request Header Integrity Verification: The gateway checks the header fields of the request header to ensure the integrity and accuracy of the request format; Step S1.2, Security Policy Review: The gateway compares the request with a preset security policy, which includes verifying the source of the request to ensure that it comes from an authorized client or network; in addition, the gateway also verifies the validity of the token to confirm whether the requester has the appropriate permissions to access the requested resource. Step S1.3, Authentication Information Confirmation: The gateway checks whether the request contains the necessary authentication information, including but not limited to passwords, certificates and other authentication credentials, to ensure that only authorized users or entities can access protected resources through the gateway; Step S2: After completing the initial security check and legitimacy verification, the gateway actively interacts with the backend authentication service and submits verification request information. The authentication service performs in-depth comparison and verification of the verification request based on the authentication logic and the user permission database, and feeds back the in-depth verification results to the gateway; To ensure the secure transmission of sensitive information, in step S2, the gateway uses a standard authentication protocol to encrypt or sign the client's identity credentials and forwards the verification request containing the encrypted client identity credentials and the detailed information of the requested access to the resource to the authentication service. In step S2, the authentication service performs deep verification, including the following steps: Step S2.1, Decrypt the token: The authentication service uses the corresponding key or algorithm to decrypt the incoming token to obtain the client identity information or authorization information contained therein; Step S2.2, Signature Verification: If a digital signature is used, the authentication service will verify the validity of the signature to ensure that the request has not been tampered with; Step S2.3, User Credential Comparison: The authentication service compares the decrypted information with the user credentials stored in the database to confirm whether the client's identity is legitimate; Step S2.4, Multi-factor authentication: Perform multi-factor authentication according to the requirements of the security policy, including but not limited to verification codes and biometric information; Step S2.5, Additional Security Steps: To enhance security, additional security steps are implemented, including risk assessment, real-time monitoring, and early warning. Step S3: Based on the received deep verification result, the gateway decides whether to grant the client the corresponding access permissions. If the verification passes, the request is allowed to proceed to the target service. Conversely, if the verification fails, the access attempt is rejected to ensure that illegal or unauthorized requests cannot penetrate into the system.

2. The gateway-based authentication method according to claim 1, characterized in that: In step S1, when the gateway performs permission verification, it is compatible with different permission verification methods, including but not limited to route-based authentication, role-based authentication, user-based authentication, group-based authentication, department-based authentication, API-based authentication, and OAuth-based authentication.

3. The gateway-based authentication method according to claim 1, characterized in that: In step S2, the gateway uses OAuth2 or JWT authentication protocols to ensure that the client's identity and the legitimacy of the request are accurately verified.

4. The gateway-based authentication method according to claim 1, characterized in that: In step S2, when the authentication service sends the deep verification result back to the gateway, if the verification is successful, the feedback message contains a new or extended access token, which is an important credential used by the client to prove its identity and obtain access rights in subsequent requests. In step S3, when deep verification is successful, the gateway issues or refreshes the access token, which serves as the credential for subsequent interactions between the client and the server. At the same time, the gateway restricts client access based on the permission information in the verification results, ensuring that the client can only access resources that match its permissions; In addition, the gateway also records relevant access information to track and analyze client access behavior and detect potential security threats or abnormal activities.

5. The gateway-based authentication method according to claim 4, characterized in that: In step S3, in order to ensure both the security and efficiency of the system, a regular communication mechanism is established between the gateway and the authentication service to achieve real-time updates and synchronization of the access token status, including but not limited to extending the validity period of the token, revoking invalid tokens, and adjusting the scope of token permissions.

6. A gateway-based access control device, characterized in that: It includes a memory and a processor; the memory is used to store a computer program, and the processor is used to execute the computer program to implement the method as described in any one of claims 1 to 5.

7. A readable storage medium, characterized in that: The readable storage medium stores a computer program that, when executed by a processor, implements the method as described in any one of claims 1 to 5.

Images