Authentication authorization method and device, electronic equipment, storage medium and product

Abstract

The application relates to the technical field of network security, and provides an authentication and authorization method and device, electronic equipment, a storage medium and a product, which comprise the following steps: in response to a resource access request, an encrypted authorization credential is sent to a user to be authorized; the encrypted authorization credential is generated through an encryption operation based on a permission access strategy of the user to be approved, a resource access path plaintext and a system public key; the permission access strategy is generated based on a permission attribute of the user to be approved; an encrypted authorization credential decryption result sent by the user to be authorized is received; the encrypted authorization credential decryption result is generated through a decryption operation based on the encrypted authorization credential and a user private key of the user to be authorized; the user private key is generated based on a system master private key and the permission attribute of the user to be authorized; and whether the user to be authorized is authorized by the user to be approved is judged based on the encrypted authorization credential decryption result. Through the above method, security risks can be avoided, and the security of authentication and authorization can be improved.

Description

Technical Field

[0001] This application relates to the field of network security technology, specifically to an authentication and authorization method, apparatus, electronic device, storage medium, and product. Background Technology

[0002] With the development of network technology, many enterprises have deployed OA (Office Automation System) systems to improve management efficiency. The security of the OA system directly affects the security of the enterprise's core data. Most existing OA systems are deployed in an intranet environment, with VPNs used to establish virtual LANs between headquarters and branch offices, and between branch offices themselves, for OA information approval. This approach relies on the assumption that the internal network will not be compromised and that employees will not maliciously attack the network or overstep their authority.

[0003] However, a growing number of security incidents demonstrate that with the development of hacking tools and the widespread adoption of OA systems, low-probability internal attacks are becoming increasingly likely. OA system authentication and authorization are the cornerstone of security supporting business approval processes; therefore, it is necessary to strengthen the security mechanisms of OA authentication and authorization to ensure the orderly operation of enterprise OA offices and prevent unauthorized access to internal data.

[0004] In the current OA system, the authentication and authorization methods for different users in the business approval process are as follows: User information for different users in the business approval process, such as username, password, and permission attributes, is stored in the database on the server side; after the user to be approved uploads the information to be approved, the approver first sends the username and password to the server. The server compares and verifies the received username and password with the information in the database. If the verification is successful, the user (approver) is authorized and authenticated, allowing the user to obtain access resources of the OA system and conduct information approval according to their own permission attributes.

[0005] However, existing username-password verification mechanisms are vulnerable to attacks such as weak password guessing and session hijacking in actual use, leading to the leakage of usernames and passwords. This can result in security risks such as unauthorized access and unauthorized authorization by OA system users. Therefore, existing authentication and authorization methods have low security and pose security risks. Summary of the Invention

[0006] This application provides an authentication and authorization method, apparatus, electronic device, storage medium, and product to address the technical problem that existing authentication and authorization methods have low security and pose security risks.

[0007] In a first aspect, embodiments of this application provide an authentication and authorization method, comprising: responding to a resource access request, sending an encrypted authorization credential to a user to be authorized; the encrypted authorization credential is generated by encryption operations based on the user's access control policy, plaintext resource access path, and system public key, wherein the access control policy is generated based on the user's access control attributes; receiving the decryption result of the encrypted authorization credential sent by the user to be authorized; the decryption result is generated by decryption operations based on the encrypted authorization credential and the user's private key, wherein the user's private key is generated based on the system master private key and the user's access control attributes; and determining, based on the decryption result, whether the user to be authorized has obtained authentication and authorization from the user to be authorized.

[0008] In one embodiment, the decryption result of the encrypted authorization credential is the access path; based on the decryption result of the encrypted authorization credential, it is determined whether the user to be authorized has obtained the authentication authorization of the user to be approved, including: verifying whether the access path is the same as the plaintext of the resource access path; if the access path is the same as the plaintext of the resource access path, it is determined that the user to be authorized has obtained the authentication authorization of the user to be approved; obtaining the access resource corresponding to the plaintext of the resource access path; and sending the access resource to the user to be authorized.

[0009] In one embodiment, the decryption result of the encrypted authorization credential is the access path; based on the decryption result of the encrypted authorization credential, it is determined whether the user to be authorized has obtained the authentication authorization of the user to be approved, including: verifying whether the access path is the same as the plaintext of the resource access path; if the access path is not the same as the plaintext of the resource access path, it is determined that the user to be authorized has not obtained the authentication authorization of the user to be approved; and refusing to send the access resource corresponding to the plaintext of the resource access path to the user to be authorized.

[0010] In one embodiment, before sending the encrypted authorization credential to the user to be authorized in response to a resource access request, the method further includes: sending an authorization credential upload message to the user to be approved; receiving the encrypted authorization credential, access control policy, public key certificate, and attribute certificate sent by the user to be approved; storing the encrypted authorization credential, access control policy, public key certificate, and attribute certificate in a database; and associating the encrypted authorization credential, access control policy, public key certificate, and attribute certificate with the user information of the user to be approved in the database.

[0011] In one embodiment, before sending encrypted authorization credentials to the user to be authorized in response to a resource access request, the method further includes: receiving a username, password, public key certificate, and attribute certificate sent by the user to be authorized; determining whether the user to be authorized is a legitimate user based on the username, password, public key certificate, and attribute certificate; and rejecting the user's resource access request if the user to be authorized is not a legitimate user.

[0012] In one embodiment, the accessed resource includes information pending approval, and the user to be authorized is the approver corresponding to the information pending approval. After sending the accessed resource to the user to be authorized, the method further includes: receiving the approval result of the information pending approval sent by the user to be authorized; if the approval result is approved, updating the approval result to the database; determining a new user to be authorized; and sending an approval notification message to the new user to be authorized, so that the new user to be authorized can generate a new resource access request based on the approval notification message.

[0013] Secondly, embodiments of this application provide an authentication and authorization device, comprising: a sending module, configured to send an encrypted authorization credential to a user to be authorized in response to a resource access request; the encrypted authorization credential is generated by encryption operations based on the user's access control policy, plaintext resource access path, and system public key, and the access control policy is generated based on the user's access control attributes; a receiving module, configured to receive the decryption result of the encrypted authorization credential sent by the user to be authorized; the decryption result is generated by decryption operations based on the encrypted authorization credential and the user's private key, and the user's private key is generated based on the system master private key and the user's access control attributes; and a judging module, configured to judge whether the user to be authorized has obtained authentication and authorization from the user to be authorized based on the decryption result of the encrypted authorization credential.

[0014] Thirdly, embodiments of this application provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement any of the authentication and authorization methods described above.

[0015] Fourthly, embodiments of this application provide a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the authentication and authorization method as described above.

[0016] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements any of the authentication and authorization methods described above.

[0017] The authentication and authorization method, apparatus, electronic device, storage medium, and product provided in this application, in response to a resource access request, send an encrypted authorization credential to the user to be authorized. The encrypted authorization credential is generated through encryption operations based on the user's access control policy, the plaintext resource access path, and the system public key. The access control policy is generated based on the user's access control attributes. The system receives the decryption result of the encrypted authorization credential sent by the user to be authorized. The decryption result is generated through decryption operations based on the encrypted authorization credential and the user's private key. The user's private key is generated based on the system master private key and the user's access control attributes. Based on the decryption result, the system determines whether the user to be authorized has obtained authentication authorization from the user to be approved. Through this method, since the encrypted authorization credential is generated through encryption operations, it can only be decrypted when the user to be authorized possesses the correct user private key. Therefore, even if attacked by weak password guessing or session hijacking, the attacker will be unable to decrypt the credential correctly due to lack of the correct user private key, thus failing to obtain authentication authorization. This avoids security risks such as unauthorized access and illegal authorization by OA system users, improving the security of authentication and authorization. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is one of the flowcharts illustrating the authentication and authorization method provided in the embodiments of this application;

[0020] Figure 2 This is an example diagram of the access control policy provided in the embodiments of this application;

[0021] Figure 3 This is a second schematic flowchart of the authentication and authorization method provided in the embodiments of this application;

[0022] Figure 4 This is a schematic diagram of the authentication and authorization device provided in the embodiments of this application;

[0023] Figure 5 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0025] Please see Figure 1 , Figure 1 This is one of the flowcharts illustrating the authentication and authorization method provided in this application embodiment. In this embodiment, the authentication and authorization method is applied to the server side and is suitable for scenarios where users access the OA system through a browser. The authentication and authorization method specifically includes steps S110 to S130, each step as follows:

[0026] S110: In response to a resource access request, send an encrypted authorization credential to the user to be authorized; the encrypted authorization credential is generated by encryption operations based on the user's access permission policy, the plaintext of the resource access path, and the system public key, and the access permission policy is generated based on the user's access permission attributes.

[0027] In scenarios where users access the OA system through a browser, the server can act as middleware, providing user authentication and authorization services. Furthermore, the server can be integrated into a web application (browser) built with the JAVA language to complete the OA functions.

[0028] Specifically, after the user awaiting approval uploads the information to the server, they also need to upload an encrypted authorization certificate. The encrypted authorization certificate is generated by encrypting the user's access control policy, the plaintext of the resource access path, and the system public key. The access control policy is generated based on the user's access control attributes.

[0029] Approving personnel need to obtain authentication and authorization before they can process the information to be approved. Therefore, after the user to be approved uploads the information to be approved to the server, the approving personnel, as the authorized users, will send a resource access request to the server to request access to the OA system and process the information to be approved.

[0030] Furthermore, in response to a resource access request, the server sends encrypted authorization credentials to the user to be authorized.

[0031] S120: Receive the decryption result of the encrypted authorization credential sent by the user to be authorized; the decryption result of the encrypted authorization credential is generated based on the encrypted authorization credential and the user's private key, and the user's private key is generated based on the system master private key and the permission attributes of the user to be authorized.

[0032] Once the authorized user (i.e. the approver) receives the encrypted authorization credential sent by the server, they can decrypt the encrypted authorization credential using their own user private key.

[0033] Specifically, a user private key for the user to be authorized is generated based on the system master private key and the permission attributes of the user to be authorized, and the generated user private key is used to decrypt the encrypted authorization certificate to obtain the decryption result of the encrypted authorization certificate.

[0034] Furthermore, the user to be authorized sends the decryption result of the encrypted authorization credential to the server. After receiving the decryption result of the encrypted authorization credential sent by the user to be authorized, the server can determine whether the user to be authorized has obtained the authentication authorization of the user to be approved, that is, whether the user to be authorized has the right to access and approve the information uploaded by the user to be approved.

[0035] S130: Based on the decryption result of the encrypted authorization certificate, determine whether the user to be authorized has obtained the authentication authorization of the user to be approved.

[0036] It should be noted that, in this embodiment, the authentication and authorization process is implemented based on a fine-grained permission attribute authentication and authorization cryptographic algorithm.

[0037] The principle of the fine-grained permission attribute authentication authorization password algorithm is as follows:

[0038] (1) The algorithm generates and outputs the system public key PK and the system master private key MK based on the implicit security parameter (usually a random number).

[0039] (2) Encrypt(PK, M, A) → CT: Users can generate and output ciphertext CT after encrypting plaintext M based on the system public key PK, plaintext M and access structure (i.e. access policy) A based on permission attributes. Ciphertext CT can only be decrypted correctly if the permission attribute S of the user to be authorized satisfies access policy A. Access policy A is generated based on the user's permission attributes. Ciphertext CT can be used as an encryption authorization credential.

[0040] (3)KeyGen(MK,PK,S)→SK: The user to be authorized generates and outputs the user's private key SK based on the system master private key MK and the user's permission attribute S.

[0041] (4) Decrypt(PK, CT, SK) → M: The user to be authorized can decrypt the ciphertext CT based on the system public key PK and the user private key SK. If S satisfies A (i.e. the permission attribute S of the user to be authorized satisfies the permission access policy A), then the user to be authorized can correctly decrypt the ciphertext and output the plaintext M.

[0042] By introducing the permission attributes of the user to be approved into the encryption operation of the authorization certificate, and the permission attributes of the user to be authorized into the decryption operation of the encrypted authorization certificate, permission judgment can be performed during the encryption and decryption operations to determine whether the user to be authorized has the access rights.

[0043] Based on the above principles, it can be seen that ciphertext can only be correctly decrypted if the permission attributes of the user to be authorized meet the access policy. If the permission attributes of the user to be authorized do not meet the access policy, the correct plaintext cannot be decrypted. Therefore, the decryption result can be used to determine whether the user to be authorized has obtained the user's authentication authorization.

[0044] Specifically, after receiving the decryption result of the encrypted authorization credential sent by the user to be authorized, the server can determine whether the user to be authorized has obtained the authentication authorization of the user to be approved based on the decryption result.

[0045] If the user to be authorized can correctly decrypt the plaintext of the resource access path, then the user to be authorized has been confirmed to have obtained the authentication authorization of the user to be approved.

[0046] If the user awaiting authorization is unable to correctly decrypt the plaintext of the resource access path, it is determined that the user awaiting authorization has not obtained the authentication authorization from the user awaiting approval.

[0047] This application's embodiments no longer rely on a simple username-password verification mechanism. Instead, they incorporate permission attributes into the password algorithm, enhancing the security of user privacy information and preventing attackers from effectively guessing session information during the authentication and authorization process.

[0048] The authentication and authorization method provided in this application, in response to a resource access request, sends an encrypted authorization credential to the user to be authorized. The encrypted authorization credential is generated through encryption operations based on the user's access control policy, the plaintext resource access path, and the system public key. The access control policy is generated based on the user's permission attributes. The method then receives the decryption result of the encrypted authorization credential sent by the user to be authorized. This decryption result is generated through decryption operations based on the encrypted authorization credential and the user's private key. The user's private key is generated based on the system master private key and the user's permission attributes. Based on the decryption result, the method determines whether the user to be authorized has obtained authentication authorization from the user to be approved. Through this method, since the encrypted authorization credential is generated through encryption operations, it can only be decrypted when the user to be authorized possesses the correct user private key. Therefore, even if attacked by weak password guessing or session hijacking, the attacker will be unable to decrypt the credential correctly due to lack of the correct user private key, thus failing to obtain authentication authorization. This avoids security risks such as unauthorized access and illegal authorization by OA system users, improving the security of authentication and authorization.

[0049] In some embodiments, the decryption result of the encryption authorization credential is the access path.

[0050] Specifically, the encrypted authorization credential is generated by encrypting the user's access policy, the plaintext of the resource access path, and the system public key. The user to be authorized can decrypt the encrypted authorization credential using their private key to obtain an access path.

[0051] Understandably, if the permission attributes of the user to be authorized meet the access policy, the decrypted access path will be the same as the plaintext of the resource access path; if the permission attributes of the user to be authorized do not meet the access policy, the decrypted access path will be different from the plaintext of the resource access path.

[0052] Based on the decryption result of the encrypted authorization credential, determine whether the user to be authorized has obtained the authentication authorization of the user to be approved, including: verifying whether the access path and the plaintext of the resource access path are the same; if the access path and the plaintext of the resource access path are the same, determine that the user to be authorized has obtained the authentication authorization of the user to be approved; obtain the access resource corresponding to the plaintext of the resource access path; and send the access resource to the user to be authorized.

[0053] Specifically, after the server receives the access path obtained by the user to be authorized through decryption, it can perform a redirect address verification to verify whether the access path is the same as the plaintext of the resource access path.

[0054] If the access path obtained by the authorized user through decryption and the plaintext of the resource access path can both redirect to the same webpage, it means that the access path and the plaintext of the resource access path are the same.

[0055] If the access path obtained by the authorized user through decryption and the plaintext of the resource access path cannot redirect to the same webpage, it means that the access path and the plaintext of the resource access path are different.

[0056] Furthermore, if the access path is the same as the resource access path in plaintext, then it is determined that the user to be authorized has obtained the authentication authorization of the user to be approved.

[0057] Furthermore, the server will perform relevant resource access operations, obtain the access resource corresponding to the plaintext of the resource access path, send the access resource to the browser of the user to be authorized, display the access resource through the browser, and allow the user to process the approval information on the browser.

[0058] In some embodiments, the decryption result of the encryption authorization credential is the access path.

[0059] Based on the decryption result of the encrypted authorization credential, determine whether the user to be authorized has obtained the authentication authorization of the user to be approved, including: verifying whether the access path and the plaintext of the resource access path are the same; if the access path and the plaintext of the resource access path are not the same, determine that the user to be authorized has not obtained the authentication authorization of the user to be approved; refuse to send the access resource corresponding to the plaintext of the resource access path to the user to be authorized.

[0060] Specifically, if the access path is different from the plaintext of the resource access path, it is determined that the user to be authorized has not obtained the authentication authorization of the user to be approved; the access resource corresponding to the plaintext of the resource access path is refused to be sent to the user to be authorized.

[0061] Optionally, if the user to be authorized has not obtained the authentication authorization of the user to be approved, the user can be redirected to other web pages, such as the main interface of the OA system or the error message prompt interface.

[0062] In some embodiments, before sending the encrypted authorization credential to the user to be authorized in response to a resource access request, the method further includes: sending an authorization credential upload message to the user to be approved; receiving the encrypted authorization credential, access control policy, public key certificate, and attribute certificate sent by the user to be approved; storing the encrypted authorization credential, access control policy, public key certificate, and attribute certificate in a database; and associating the encrypted authorization credential, access control policy, public key certificate, and attribute certificate with the user information of the user to be approved in the database.

[0063] Understandably, before sending encrypted authorization credentials to the user to be authorized in response to a resource access request, the user to be approved needs to upload the encrypted authorization credentials to the server.

[0064] This embodiment applies to scenarios where users access the OA system through a browser. Users awaiting approval can upload encrypted authorization credentials through the browser. The specific process is as follows:

[0065] (1) Initialize the browser, obtain the public key certificate, and generate the encrypted authorization certificate on the browser.

[0066] In specific commercial deployments, public key certificates (system public keys) can be issued by a third-party CA (Certificate Authority), or uniformly issued by the company's internal CA server. In simpler networks, they can also be generated by user clients. The specific solution will be based on a certain trade-off between economy and security.

[0067] It should be noted that a public key certificate consists of a public part and a private part. The private and public parts of the public key certificate will be distributed to the corresponding users before the system is deployed; the public part can be distributed to each user later in the system deployment process.

[0068] The browser initialization process mainly involves performing some calculations on the JavaScript code downloaded from the Web (World Wide Web) during the webpage loading phase, including operations such as user-specified local public key certificates and attribute certificates.

[0069] Browsers require attribute certificates (which record permission attributes) to assist in the authentication and authorization phases, and to present the authentication process to the server. In addition, during the authorization process, users can also transmit the authorization attribute certificate generated by the browser directly to the server in BASE64 encoding over the network, and then forward it to other authorized users through the server.

[0070] This application's embodiments no longer rely on a simple username-password verification mechanism. Instead, they incorporate public key certificates and attribute certificates, enhancing the security of user privacy information and preventing attackers from effectively guessing session information during the authentication process.

[0071] (2) Initialize the OA service and upload the encrypted authorization certificate to the server.

[0072] Specifically, after the user awaiting approval initializes the OA service in their browser, the administrator can configure the authorization credential upload message on the server side and send the authorization credential upload message to the user awaiting approval, so as to complete the binding of relevant authorization credential information with user information on the server side.

[0073] After receiving the authorization credential upload message, the user awaiting approval sends the encrypted authorization credential, access control policy, public key certificate, and attribute certificate to the server. Upon receiving these documents, the server stores them in the database and associates them with the user's information in the database, thus binding the authorization credential information with the user information.

[0074] Specifically, after receiving the encrypted authorization credentials, access policy, public key certificate, and attribute certificate sent by the user to be approved, the server can update the received information to the database based on the Realm security domain mechanism, providing a verification mechanism for subsequent fine-grained authentication and authorization.

[0075] Optionally, the information received by the server (such as username, password, role, permissions, permission attributes, etc.) can be encapsulated in the main class. During the user login process, the corresponding inspection module can be called to complete the extraction and verification of user binding information, and construct the identity authentication process and authorization process.

[0076] Optionally, the access control policies are stored in a tree structure on the server side, thereby completing the deployment of the access control policy tree on the server side.

[0077] Optionally, the access control policy is generated by encrypting the master key of the attribute certificate of the user to be approved, which prevents the server administrator from tampering with the authorization structure and prevents the administrator from obtaining relevant information through collusion attacks.

[0078] Specifically, in this embodiment, the process by which the user to be approved generates the encrypted authorization credential is as follows:

[0079] (1) Generate and output the system public key PK and the system master private key MK based on bilinear operation.

[0080] The principle of bilinear mapping operations is as follows: Define a bilinear mapping pair e: G1×G1→G2, where G1 and G2 are cyclic groups, and for R, S∈G1, Satisfying property e(R) a ,S b )=e(R,S) ab .

[0081] (2) Users awaiting approval can generate and output ciphertext based on the system public key PK, access policy, and plaintext resource access path. The access policy is generated based on the user's access attributes.

[0082] In web applications, user access permission information is stored in the user session structure on the server side. To prevent session impersonation, a password mechanism is needed to prevent this from happening. Access control is achieved by combining Shiro filters and the access structure based on permission attributes in Shiro dynamic sessions.

[0083] In this embodiment, the fine-grained permission attributes of the user to be approved can be defined as: P = {P1, P2, ..., P3} n}, where P represents the attribute set.

[0084] P has the following property: set gather

[0085] It has monotonicity, for example, let... If B∈A, Then C∈A.

[0086] Access policies (i.e., access structures based on permission attributes) can be generated based on the fine-grained permission attributes of users to be approved, and these access policies are stored in a tree structure.

[0087] Please see Figure 2 , Figure 2 This is an example diagram of the access control policy provided in the embodiments of this application. For example... Figure 2As shown, in an OA document approval scenario, the activity initiator (the user to be approved) formulates an access control policy according to the role and permission attributes required by the approval process.

[0088] Assuming the user awaiting approval is the person who uploaded the financial statements, and the approval process requires that the user approving the uploaded financial statements must have the attributes of a department manager or general manager, and also be in charge of finance, then the access control policy tree would look like this: Figure 2 As shown.

[0089] Optionally, the Lagrange coefficients are defined as follows: in S belongs to Let U be the set of members of a set of all attributes. For each attribute i∈U, from A random, uniformly distributed number t is selected from the data. i Finally in Uniform selection of y. The system public key PK is denoted as... The system master private key MK is denoted as MK = t1,...,t |U| ,y. Encrypted information (i.e., plaintext resource access path) m∈G2, the attribute set corresponding to the ciphertext is γ, and a random value is selected. Generate ciphertext

[0090] It should be noted that a key corresponding to the polynomial coefficients can be generated during the attribute encryption process. The decryption process for authorized users can be understood as calculating the polynomial q starting from the root node r of the access control policy tree. r (0) = y, and the remaining internal nodes of the access control policy tree need to satisfy the polynomial q. x (0)=q parent(x) (inde(x)). The permission attributes recorded in the permission access policy tree can be extracted from the leaf nodes, for i=att (x) The set of secret values ​​is the decryption key.

[0091] Specifically, in this embodiment, the process of the authorized user decrypting the encrypted authorization credential is as follows:

[0092] When an authorized user performs resource access and business process status approval operations, they can decrypt the encrypted authorization credential in the browser. The decryption process is recursive and can be defined as follows:

[0093]

[0094] The above process is the decryption process for leaf nodes. For non-leaf nodes, let z be the number of nodes in the access control policy tree x. Then, F... z =DecrypNode zThe decryption process for all leaf nodes can be represented as follows:

[0095]

[0096] When the permission attributes of the user to be authorized meet the access policy, the function at the root of the tree can be called to calculate e(g,g). ys =Y s Further calculations Decryption yields the plaintext resource access path M.

[0097] In some embodiments, before sending encrypted authorization credentials to the user to be authorized in response to a resource access request, the method further includes: receiving a username, password, public key certificate, and attribute certificate sent by the user to be authorized; determining whether the user to be authorized is a legitimate user based on the username, password, public key certificate, and attribute certificate; and rejecting the user's resource access request if the user to be authorized is not a legitimate user.

[0098] Understandably, before sending encrypted authorization credentials to the user to be authorized in response to a resource access request, it is also necessary to verify the user's identity to determine whether they are a legitimate user of the OA system.

[0099] Specifically, it receives the username, password, public key certificate, and attribute certificate sent by the user to be authorized.

[0100] Furthermore, based on the username, password, public key certificate, and attribute certificate, a query is performed in the database to verify whether the user to be authorized is a legitimate user.

[0101] If the username, password, public key certificate, and attribute certificate of the user to be authorized do not exist in the database, then the user to be authorized is determined to be an illegitimate user, and the resource access request of the user to be authorized is rejected.

[0102] Existing Shiro technology provides a username-password mechanism by default in the browser to verify user identity. The authentication and authorization method provided in this application improves the security and reliability of identity authentication by combining username, password, public key certificate and attribute certificate on the basis of the existing username-password mechanism.

[0103] In some embodiments, the accessed resources include information pending approval, and the user to be authorized is the approver corresponding to the information pending approval.

[0104] After sending the access resource to the user to be authorized, the process also includes: receiving the approval result of the pending approval information sent by the user to be authorized; if the approval result is approved, updating the approval result to the database; determining a new user to be authorized; and sending an approval notification message to the new user to be authorized, so that the new user to be authorized can generate a new resource access request based on the approval notification message.

[0105] Specifically, after the access resources are sent to the user to be authorized, the user can view the specific information of the business process and approve the information to be approved. The approval result includes two types: approval and rejection.

[0106] Furthermore, the user to be authorized sends the approval result of the information to be approved to the server.

[0107] If the approval result is rejection, the server will update the approval result to the database and terminate the next step of the current process.

[0108] If the approval result is "approved", the server will update the approval result to the database.

[0109] Furthermore, the server can determine the new user to be authorized, i.e. the next approver, based on the pre-set business approval process; and send an approval notification message to the new user to be authorized through the registered processing function, so that the new user to be authorized can generate a new resource access request based on the approval notification message, until the business process is terminated.

[0110] This application also provides a specific example of an authentication and authorization method. Please refer to [link / reference]. Figure 3 , Figure 3 This is the second flowchart of the authentication and authorization method provided in the embodiments of this application.

[0111] Specifically, prior to authentication and authorization, an OA approval system application is quickly built using the Flowable engine. The construction process of the OA approval system application is as follows:

[0112] S101: Under the system initialization configuration conditions, construct the user public key certificate in the relevant software and hardware environment of the standard-compliant Public Key Infrastructure (PKI).

[0113] Public key certificates can be configured on both the user's browser and the server side.

[0114] This paper utilizes the existing Shiro framework to build a basic identity security information authentication environment based on public key user identity and credentials for user login verification and online session maintenance. In the database structure, five relation tables are designed to provide data storage support for public key authentication: user information, user role, permission information, user role relationship, and role permission relationship.

[0115] S102: Define a secure data source based on the Realm mechanism, relying on the security manager to drive the JVM to verify user identity information.

[0116] By integrating the Realm interface to implement specific operation classes, an attribute permission verification mechanism is constructed. The authorization operation is completed during the attribute permission encryption process, and the authentication operation is completed during the attribute permission decryption process. The corresponding operations are implemented in two security management classes.

[0117] S103: Integrates the Web startup engine and registers Realm in conjunction with the specific engine.

[0118] A filter is set for resource access path redirection after the engine starts, and the access request for web resources is determined based on the requirements given by the authorization and authentication security domain.

[0119] Optionally, all web page resources can be aggregated and categorized, which can be further divided into authentication filters and authorization filters.

[0120] Optionally, authentication filters can be further categorized into types such as anonymous, online, user, and browser subject.

[0121] Optionally, the authorization filter can be further divided into types such as permission filtering, role filtering, secure socket, REST, and port filtering.

[0122] S104: Security parameter configuration, which sets the security algorithm and parameter specifications used by the security domain.

[0123] The type of encryption algorithm and password length are determined based on the operational efficiency and security of the OA system.

[0124] Optionally, the encryption algorithm includes six types: symmetric encryption, public key encryption, attribute access control encryption, hash algorithm, and pseudo-random security algorithm.

[0125] S105: Use injection technology to build business approval processes.

[0126] Specifically, by designing user approval events to identify the initiator of each event, adding status settings and conditional judgments for the approval event within the business process, and combining this with policy adjudication, basic service support is provided for the business approval process. Simultaneously, the permission attributes that need to be granted during the user-initiated approval process are designed.

[0127] After the above preparations are completed, the authentication and authorization algorithm of this application embodiment can be used for verification.

[0128] like Figure 3 As shown, users awaiting approval must first initialize the client (browser) and the OA service.

[0129] Furthermore, the user awaiting approval generates an encrypted authorization credential on the client and sends the encrypted authorization credential, access control policy, public key certificate, and attribute certificate to the server.

[0130] Furthermore, the server uses the Realm security domain mechanism to store the received encrypted authorization credentials, access control policies, public key certificates, and attribute certificates in the database. It then associates these credentials with the user information of the user awaiting approval in the database, thus binding the authorization credentials with the user information.

[0131] Furthermore, the user to be authorized sends a resource access request to the server; in response to the resource access request, the server sends an encrypted authorization credential to the user to be authorized; the user to be authorized performs a decryption operation on the received encrypted authorization credential, obtains the decryption result, and sends the decryption result to the server; the server receives the decryption result sent by the user to be authorized, and determines whether the user to be authorized has obtained the authentication authorization of the user to be approved based on the decryption result.

[0132] The decryption result of the encrypted authorization credential is the access path.

[0133] Specifically, if the access path is the same as the plaintext of the resource access path, it is determined that the user to be authorized has obtained the authentication authorization of the user to be approved; the access resource corresponding to the plaintext of the resource access path is obtained; the access resource is sent to the browser of the user to be authorized, and the user to be authorized can display the access resource through the browser, allowing the user to process the approval information to be approved on the browser.

[0134] Specifically, after the access resources are sent to the user to be authorized, the user can view the specific information of the business process and approve the information to be approved. The approval result includes two types: approval and rejection.

[0135] Furthermore, if the approval result is approved, the server updates the approval result to the database. The server can determine the new user to be authorized, i.e. the next approver, based on the pre-set business approval process. The server sends an approval notification message to the new user to be authorized through the registered processing function, so that the new user to be authorized can generate a new resource access request based on the approval notification message and continue to perform authentication and authorization until the business process jumps to termination.

[0136] This application also provides an authentication and authorization device. Please refer to [link to relevant documentation]. Figure 4 , Figure 4 This is a schematic diagram of the authentication and authorization device provided in this application embodiment. In this embodiment, the authentication and authorization device includes a sending module 410, a receiving module 420, and a judging module 430.

[0137] The sending module 410 is used to send an encrypted authorization credential to the user to be authorized in response to a resource access request. The encrypted authorization credential is generated by encryption operations based on the user's access permission policy, the plaintext of the resource access path, and the system public key. The access permission policy is generated based on the user's permission attributes.

[0138] The receiving module 420 is used to receive the decryption result of the encrypted authorization credential sent by the user to be authorized; the decryption result is generated based on the encrypted authorization credential and the user's private key, and the user's private key is generated based on the system master private key and the permission attributes of the user to be authorized.

[0139] The judgment module 430 is used to determine whether the user to be authorized has obtained the authentication authorization of the user to be approved based on the decryption result of the encrypted authorization certificate.

[0140] In some embodiments, the decryption result of the encryption authorization credential is the access path.

[0141] The judgment module 430 is used to verify whether the access path and the plaintext of the resource access path are the same; if the access path and the plaintext of the resource access path are the same, it determines that the user to be authorized has obtained the authentication authorization of the user to be approved; obtains the access resource corresponding to the plaintext of the resource access path; and sends the access resource to the user to be authorized.

[0142] In some embodiments, the decryption result of the encryption authorization credential is the access path.

[0143] The judgment module 430 is used to verify whether the access path and the plaintext of the resource access path are the same; if the access path and the plaintext of the resource access path are not the same, it is determined that the user to be authorized has not obtained the authentication authorization of the user to be approved; and the access resource corresponding to the plaintext of the resource access path is refused to be sent to the user to be authorized.

[0144] In some embodiments, the sending module 410 is used to send an authorization credential upload message to the user to be approved.

[0145] The receiving module 420 is used to receive the encrypted authorization certificate, access control policy, public key certificate and attribute certificate sent by the user to be approved; store the encrypted authorization certificate, access control policy, public key certificate and attribute certificate in the database; and associate the encrypted authorization certificate, access control policy, public key certificate and attribute certificate with the user information of the user to be approved in the database.

[0146] In some embodiments, the receiving module 420 is configured to receive the username, password, public key certificate, and attribute certificate sent by the user to be authorized; determine whether the user to be authorized is a legitimate user based on the username, password, public key certificate, and attribute certificate; and reject the resource access request of the user to be authorized if the user to be authorized is not a legitimate user.

[0147] In some embodiments, the accessed resources include information pending approval, and the user to be authorized is the approver corresponding to the information pending approval.

[0148] The receiving module 420 is used to receive the approval result of the information to be approved sent by the user to be authorized; if the approval result is approved, the approval result is updated to the database; a new user to be authorized is identified; and an approval notification message is sent to the new user to be authorized so that the new user to be authorized can generate a new resource access request based on the approval notification message.

[0149] This application also provides an electronic device. Figure 5 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application, such as... Figure 5 As shown, the electronic device may include a processor 510, a communications interface 520, a memory 530, and a communication bus 540, wherein the processor 510, the communications interface 520, and the memory 530 communicate with each other through the communication bus 540. The processor 510 can call logical instructions in the memory 530 to execute authentication and authorization methods.

[0150] Furthermore, the logical instructions in the aforementioned memory 530 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0151] This application also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, is implemented to perform the authentication and authorization methods provided by the methods described above.

[0152] This application also provides a computer program product, including a computer program that, when executed by a processor, implements any of the authentication and authorization methods described above.

[0153] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0154] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0155] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. An authentication and authorization method, characterized in that, include: In response to a resource access request, send encrypted authorization credentials to the user to be authorized; The encrypted authorization credential is generated by encryption operations based on the user's access control policy, plaintext resource access path, and system public key. The access control policy is generated based on the user's access attributes. Receive the decryption result of the encrypted authorization credential sent by the user to be authorized; the decryption result of the encrypted authorization credential is generated based on the encrypted authorization credential and the user's private key, and the user's private key is generated based on the system master private key and the user's permission attributes; Based on the decryption result of the encrypted authorization credential, it is determined whether the user to be authorized has obtained the authentication authorization of the user to be approved; Before sending encrypted authorization credentials to the user to be authorized in response to a resource access request, the method further includes: Receive the username, password, public key certificate, and attribute certificate sent by the user to be authorized; the attribute certificate is used to record permission attributes. Based on the username, the password, the public key certificate, and the attribute certificate, determine whether the user to be authorized is a legitimate user; If the user to be authorized is not a legitimate user, then the user's resource access request is rejected.

2. The authentication and authorization method according to claim 1, characterized in that, The decryption result of the encrypted authorization credential is the access path; The step of determining whether the user to be authorized has obtained the authentication authorization of the user to be approved based on the decryption result of the encrypted authorization credential includes: Verify whether the access path is the same as the plaintext of the resource access path; If the access path is the same as the resource access path in plaintext, then it is determined that the user to be authorized has obtained the authentication authorization of the user to be approved. Obtain the access resource corresponding to the plaintext of the resource access path; The access resource is sent to the user to be authorized.

3. The authentication and authorization method according to claim 1, characterized in that, The decryption result of the encrypted authorization credential is the access path; The step of determining whether the user to be authorized has obtained the authentication authorization of the user to be approved based on the decryption result of the encrypted authorization credential includes: Verify whether the access path is the same as the plaintext of the resource access path; If the access path is not the same as the resource access path in plaintext, then it is determined that the user to be authorized has not obtained the authentication authorization of the user to be approved. The system refuses to send the resource access path in plaintext to the unauthorized user.

4. The authentication and authorization method according to claim 1, characterized in that, Before sending encrypted authorization credentials to the user to be authorized in response to a resource access request, the method further includes: Send an authorization credential upload message to the user awaiting approval; Receive the encrypted authorization credential, the access control policy, the public key certificate, and the attribute certificate sent by the user to be approved; Store the encrypted authorization credential, the access control policy, the public key certificate, and the attribute certificate in the database; The encrypted authorization credential, the access control policy, the public key certificate, and the attribute certificate are associated with the user information of the user to be approved in the database.

5. The authentication and authorization method according to claim 2, characterized in that, The accessed resources include information pending approval, and the user to be authorized is the approver corresponding to the information pending approval. After sending the access resource to the user to be authorized, the method further includes: Receive the approval result of the pending approval information sent by the user to be authorized; If the approval result is "approved", then the approval result will be updated in the database; Identify new users to be authorized; An approval notification message is sent to the new user to be authorized, so that the new user can generate a new resource access request based on the approval notification message.

6. An authentication and authorization device, characterized in that, include: The sending module is used to send encrypted authorization credentials to the user to be authorized in response to a resource access request; The encrypted authorization credential is generated by encryption operations based on the user's access control policy, plaintext resource access path, and system public key. The access control policy is generated based on the user's access attributes. The receiving module is used to receive the decryption result of the encrypted authorization credential sent by the user to be authorized; the decryption result is generated based on the encrypted authorization credential and the user's private key, and the user's private key is generated based on the system master private key and the user's permission attributes. The judgment module is used to determine, based on the decryption result of the encrypted authorization credential, whether the user to be authorized has obtained the authentication authorization of the user to be approved; The receiving module is used to receive the username, password, public key certificate, and attribute certificate sent by the user to be authorized; The attribute certificate is used to record permission attributes; Based on the username, the password, the public key certificate, and the attribute certificate, determine whether the user to be authorized is a legitimate user; If the user to be authorized is not a legitimate user, then the user's resource access request is rejected.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the authentication and authorization method as described in any one of claims 1 to 5.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the authentication and authorization method as described in any one of claims 1 to 5.

9. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the authentication and authorization method as described in any one of claims 1 to 5.

Images