Authority proxy method and device based on dynamic identity switching, terminal and storage medium
Through the permission proxy method of dynamic identity switching, proxy tokens are generated and verified, which solves the problem of static user roles and permission allocation in the enterprise business system, and realizes flexible, secure and efficient permission management, improving system security and user experience .
Patent Information
- Application Number
- CN202411175335.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-08-26
- Publication Date
- 2024-12-13
AI Technical Summary
The user roles and permission allocation in the existing enterprise business system are static, which leads to cumbersome, time-consuming and security risks in temporary identity switching. Especially when the system administrator is busy, the risk of permission configuration errors and account password leakage is prone to risks.
The permission proxy method based on dynamic identity switching is adopted to generate and verify the proxy token to dynamically load and verify the permission information, ensuring that the agent operates within the scope of authorization, and providing flexible, secure and efficient permission management and proxy mechanisms.
It significantly improves the security and user experience of the system, simplifies permission management, reduces the probability of permission configuration errors, improves management efficiency and operation transparency, and is suitable for scenarios such as leave and business trips.
Smart Images
Figure CN119128844A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of information technology, and in particular to a permission proxy method, device, terminal and storage medium based on dynamic identity switching. Background Art
[0002] In existing enterprise business systems, user roles and permissions are usually statically assigned. When a user needs to temporarily take over someone else's work (such as when taking leave or on a business trip), the system administrator often needs to manually adjust permissions. However, the traditional manual adjustment process is cumbersome, time-consuming, and inefficient. It is also prone to permission configuration errors, leading to unauthorized operations and security risks.
[0003] In addition, when system administrators are busy dealing with other urgent tasks, they are usually unable to adjust permissions in a timely manner. At this time, in order to quickly respond to business needs, the principal may directly provide the account password to the agent. This practice greatly increases the risk of account password leakage.
[0004] Therefore, there is an urgent need for a technical solution that can dynamically adjust user identities and permissions while ensuring operational security and transparency. Summary of the invention
[0005] In order to solve the problem of cumbersome identity switching and poor security in existing enterprise business systems, the present application provides a permission proxy method, device, terminal and storage medium based on dynamic identity switching, which can conveniently, safely and efficiently perform dynamic identity switching and permission delegation, thereby improving user experience and management efficiency.
[0006] In the first aspect, the present application provides a permission proxy method based on dynamic identity switching, which adopts the following technical solution: A permission proxy method based on dynamic identity switching includes the following steps: Generate and store a proxy token according to the first operation, wherein the proxy token includes a proxy authority range, and the proxy authority range includes all allowed proxy operations, and encrypt the proxy token; selectively receiving an identity switching request, the identity switching request including the encrypted proxy token, performing a first validity verification on the encrypted proxy token, and when the first validity verification passes, executing an identity switching operation corresponding to the identity switching request; When the identity switching operation is completed, a second operation request is selectively received, and when a second operation corresponding to the second operation request is the same as any one of the proxy operations in the proxy authority range, the second operation is executed.
[0007] By adopting the above-mentioned technical means, permission information is dynamically loaded and verified to ensure that the agent operates within the scope of authorization, and the agent is allowed to switch to the identity of other client users to perform business operations within the scope of authorization through simple operations, thus realizing a flexible, secure and efficient permission management and agency mechanism, significantly improving the security of the system and user experience.
[0008] Preferably, before the proxy token is generated according to the first operation and stored, the following steps are also included: Receive a login request from a client, perform login verification on the login request, and when the login verification passes, call the corresponding login interface according to the login request, generate and record the current first timestamp, generate a common token according to the login interface and return the common token to the client, the common token includes current user information, user authority range and token mode, the user authority range includes all allowed functional operations, the token mode includes common mode and proxy mode, and the token mode of the common token is the common mode.
[0009] By adopting the above technical means, a common token is generated according to the login request, and a simple verification mechanism is set for the client user's login and operation through the common token, making the login process more secure and reliable.
[0010] Preferably, after generating a common token according to the login interface and returning the common token to the client, the method further includes the following steps: receiving an operation request sent by the client, the operation request including the common token returned to the client, generating and recording a second timestamp of receiving the operation request, and performing a second validity verification on the common token according to the first timestamp and the second timestamp; When the interval time between the first timestamp and the second timestamp does not exceed the preset token validity period, the second validity verification passes and the ordinary token is valid; otherwise, the second validity verification fails.
[0011] By adopting the above technical means, the verification process after login is described in detail, providing a strong guarantee for improving the security of this application method.
[0012] Preferably, the generating and storing of a proxy token according to the first operation, the proxy token including a proxy authority range, the proxy authority range including all permitted proxy operations, and encrypting the proxy token specifically comprises the following steps: When the common token is valid, the user identity of the current client is determined to be a normal user according to the common mode, and whether the function operation corresponding to the operation request is included in the user authority range, and if so, the function operation is deemed to be valid; When the functional operation is valid, selectively receiving proxy configuration information generated by the normal user according to the first operation, the proxy configuration information includes the current identity information of the normal user, the proxy authority range, the proxy ID and the authorization period; A proxy token is generated based on the proxy configuration information, the proxy token includes a proxy authority range, and the proxy authority range includes all permitted proxy operations. The proxy token is encrypted and stored in a distributed cache system, and delegation information is generated based on the proxy token and sent to the client.
[0013] By adopting the above-mentioned technical means and setting the proxy configuration information, the normal user, i.e. the principal, can decide the scope of authority to be opened for the agent, thereby reducing the probability of errors that may be caused by others acting on his behalf, improving the efficiency of delegation, and utilizing the high performance and distributed characteristics of the distributed cache system to manage proxy tokens.
[0014] Preferably, after the proxy token is encrypted and stored in the distributed cache system, the following steps are further included: If updated proxy configuration information is received, an updated proxy token is generated based on the updated proxy configuration information, the proxy token before the update becomes invalid, the dynamic token before the update is overwritten by the newly generated proxy token, and the newly generated proxy token is stored in the distributed cache system.
[0015] By adopting the above technical means, the proxy configuration information and proxy token are updated in real time, ensuring the timeliness and accuracy of the proxy information.
[0016] Preferably, the selectively receiving an identity switching request, the identity switching request including the encrypted proxy token, performing a first validity verification on the encrypted proxy token, and executing an identity switching operation corresponding to the identity switching request when the first validity verification passes, specifically comprises the following steps: selectively receiving an identity switching request sent by a client, the identity switching request being generated according to the delegation information, the identity switching request including the encrypted proxy token obtained from the delegation information, and performing a first validity verification on the encrypted proxy token; The first validity verification includes: decrypting the encrypted proxy token, obtaining the proxy ID from the decrypted proxy token, and generating a cache key according to the proxy ID; Obtain the most recently generated proxy token from the distributed cache system, compare the most recently generated proxy token with the proxy token obtained from the delegation information and obtain a comparison result; if the comparison results are consistent, the first validity verification passes, and execute the identity switching operation corresponding to the identity switching request.
[0017] By adopting the above-mentioned technical means, the system compares the current proxy token with the latest proxy token in the cache. If the two are consistent, it means that the proxy token carried in the identity switching request is valid; if they are inconsistent, it may mean that the proxy token has expired, been tampered with, or has been replaced with a new proxy token, thus avoiding unauthorized access by the agent and further ensuring the security and accuracy of the proxy process.
[0018] Preferably, when the identity switching operation is completed, selectively receiving a second operation request, and when the second operation corresponding to the second operation request is the same as any one of the proxy operations in the proxy authority range, executing the second operation specifically includes the following steps: When the identity switching operation is completed, the token mode is switched from the normal mode to the proxy mode, and the user identity of the client is now a proxy; When the token mode is the proxy mode, selectively receive a second operation request, read the proxy authority range in the proxy token, and determine whether the second operation corresponding to the second operation request is included in the proxy authority range. If so, the second operation is valid; when the second operation is valid, execute the second operation.
[0019] By adopting the above-mentioned technical means, the authority of the proxy operation is verified to ensure that the operation is within the authorized scope and the accuracy of the proxy operation is guaranteed.
[0020] In a second aspect, the present application provides a rights proxy device based on dynamic identity switching, which adopts the following technical solution: A permission proxy device based on dynamic identity switching includes the following modules: A proxy token generation module, used to generate and store a proxy token according to the first operation, wherein the proxy token includes a proxy authority range, the proxy authority range includes all allowed proxy operations, and the proxy token is encrypted; An identity switching module, configured to selectively receive an identity switching request, wherein the identity switching request includes the encrypted proxy token, perform a first validity verification on the encrypted proxy token, and when the first validity verification passes, execute an identity switching operation corresponding to the identity switching request; The proxy authority verification module is used to selectively receive a second operation request after the identity switching operation is completed, and execute the second operation when the second operation corresponding to the second operation request is the same as any one of the proxy operations in the proxy authority range.
[0021] By adopting the above-mentioned technical means, a permission proxy system based on dynamic identity switching has been built, which provides the necessary software technical support for the safe and efficient implementation of permission proxy. By dynamically generating, encrypting, storing and verifying tokens, it provides the system with a safe and efficient proxy access control mechanism.
[0022] In a third aspect, the present application provides a smart terminal, which adopts the following technical solution: A smart terminal includes a memory and a processor, wherein the memory stores at least one instruction, at least one program, code set or instruction set, and the at least one instruction, at least one program, code set or instruction set is loaded and executed by the processor to implement the permission proxy method based on dynamic identity switching as described above.
[0023] In a fourth aspect, the present application provides a computer-readable storage medium, which adopts the following technical solution: A computer-readable storage medium, wherein at least one instruction, at least one program, code set or instruction set is stored in the computer-readable storage medium, wherein the at least one instruction, at least one program, code set or instruction set is loaded and executed by a processor to implement the permission proxy method based on dynamic identity switching as described above.
[0024] In summary, this application has at least the following beneficial effects: 1. The method of this application ensures that the agent operates within the scope of authorization by dynamically loading and verifying the principal's authority information. The system allows users to switch to other users' identities to perform business operations during the authorization period through simple operations, ensuring operational transparency and traceability. This flexible, secure, and efficient authority management and agency mechanism significantly improves the security of the system and user experience, and is particularly suitable for scenarios such as leave, business trips, temporary project cooperation, and management authority transfer. BRIEF DESCRIPTION OF THE DRAWINGS
[0025] Figure 1 This is one of the data interaction diagrams of the permission proxy method based on dynamic identity switching in this embodiment; Figure 2 This is a data interaction diagram of the permission proxy method based on dynamic identity switching of this embodiment; Figure 3 is a flowchart of steps S3-S5 of the permission proxy method based on dynamic identity switching of this embodiment; Figure 4 It is a structural diagram of the authority proxy device based on dynamic identity switching of this embodiment. DETAILED DESCRIPTION
[0026] The present application provides a permission proxy method, device, terminal and storage medium based on dynamic identity switching. In order to make the purpose, technical solution and advantages of the present application clearer, the implementation method of the present application will be further described in detail below.
[0027] The following is a further detailed description of an embodiment of a permission proxy method based on dynamic identity switching of the present application in conjunction with the drawings of the specification.
[0028] The permission proxy method based on dynamic identity switching of the present application is realized through the interaction between the client and the server, wherein the client has two user identities, one is a normal user, whose ID is the user himself; the other is an agent. When the client is an agent, the ID is not the user himself, but the principal, that is, a normal user who entrusts the account to the current user for agency.
[0029] like Figure 1 and Figure 2 The data interaction diagram of this embodiment is shown in FIG. Figure 1 There are three interacting parties in the example, of which the client (principal) and the client (agent) are both normal users, and their login IDs are their own. Figure 2 The interaction process occurs in Figure 1 after, Figure 2 There are two interacting parties, namely the server and the agent. The agent here is Figure 1 The agent is a person who uses the same identity as the client (agent), and the agent's login ID is the same as the client (principal).
[0030] For ease of understanding, this embodiment will start from the normal use of a normal user to illustrate the process of identity switching and authority proxy. In this embodiment, the use process of two user identities is connected together to provide a complete description of identity switching and authority proxy.
[0031] This embodiment is a permission proxy method based on dynamic identity switching, the data interaction process of the method is as follows Figure 1 As shown, the following steps are included: S1. Receive a login request, call the corresponding login interface according to the login request, generate and return a common token according to the login interface, specifically including the following steps: S11, receiving a login request from the client, and performing login verification on the login operation request. When the login verification passes, the client user logs in successfully.
[0032] S12. Call the corresponding login interface according to the login request, generate and record the current first timestamp.
[0033] In this embodiment, the client has two different API interfaces, and the two different interfaces will generate two different dynamic tokens. One of them is a login interface, which corresponds to the login function. The interface is called based on the login request; the dynamic token includes a normal token and a proxy token.
[0034] S13. Generate a common token based on the login interface and return the common token to the client.
[0035] The contents of a common token include the current user information, user authority range, and token mode. The user information includes the user ID and user name, and the user authority range includes all permitted functional operations.
[0036] The dynamic token generated by the login interface is a common token, and its corresponding token mode is the common mode.
[0037] S2. Receive an operation request, the operation request includes a generated common token, and perform a second validity verification on the common token, specifically including the following steps: S21. When the client logs in successfully, the server has generated a common token based on the login request. The server will return the generated common token to the client. At this time, the request header of any operation request issued by the client to the server will carry this common token, that is, any operation request sent by the client received by the server will contain the common token.
[0038] S22, generating and recording a second timestamp of receiving the operation request, and performing a second validity verification on the common token according to the first timestamp and the second timestamp; The process of the second validity verification is: when the interval between the first timestamp and the second timestamp does not exceed the preset token validity period, the second validity verification passes and the ordinary token is valid, otherwise the second validity verification fails.
[0039] In a specific implementation, when the client user performs any operation after successfully logging in, if the execution time exceeds 10 minutes from the login time (that is, the token validity period is set to 10 minutes), then it will be displayed that the operation is invalid, that is, the second validity verification of the ordinary token fails. At this time, you need to log in again. This is to ensure the security of the system client.
[0040] In addition, it should be noted that if the ordinary token is valid and the second validity verification is passed, the first timestamp will be updated with the time when the current operation request occurs, and the second timestamp will continue to be updated with the next operation request.
[0041] After the second validity verification is passed, it is proved that the ordinary token generated during login is valid. Then the subsequent identity switching and authority delegation are carried out according to the actual operation. The process is as follows Figure 3 As shown, the following steps are included: S3: Generate and store a proxy token according to the first operation, wherein the proxy token includes a proxy authority scope, and the proxy authority scope includes all permitted proxy operations. Encrypt the proxy token, which specifically includes the following steps: S31. When the common token is valid, the user identity of the current client is determined to be a normal user according to the common mode.
[0042] In this embodiment, the user identity of the client can be determined based on the token mode. When the token mode is normal mode, the user identity is a normal user (also called the principal at this time); when the token mode is proxy mode, the user identity is an agent. By identifying the token mode, the authority scope verification method for different identities can be determined according to different token modes. Specifically, the query logic of the preset user authority configuration table is determined according to different token modes.
[0043] S32, determining whether the functional operation corresponding to the operation request is included in the user's authority range, and if so, determining that the functional operation is valid; In a specific implementation, when the user identity is a normal user, the local database is queried for the user's authority range according to the user ID in the common token to determine whether the user authority range corresponding to the user ID in the common token is within the authority range of the database. If so, determine whether the functional operation corresponding to the current operation request is within the user authority range of the ordinary token. If so, the current functional operation is valid. If any of the above items is judged as no, a message indicating that the operation is not authorized will be popped up.
[0044] S33. When the functional operation is valid, selectively receive proxy configuration information generated by a normal user according to a first operation, where the first operation is within the scope of user authority.
[0045] In this embodiment, if the first operation is proxy information configuration, the normal user (principal) will generate proxy configuration information after the proxy information configuration operation on the client is completed. At this time, the server will receive the proxy configuration information. The proxy configuration information includes the identity information of the current normal user, the scope of proxy authority, the proxy ID and the authorization period. The authorization period includes the authorization start time and the authorization end time. The proxy ID is the ID of the normal user being delegated.
[0046] S34. The server generates a proxy token based on the proxy configuration information. The proxy token includes the scope of proxy authority. The scope of proxy authority includes all permitted proxy operations. The proxy token also includes the normal user's identity information, proxy ID, authorization period, token mode, and a randomly generated unique identifier. By assigning a unique identifier to each proxy token, the use of the proxy token can be tracked and identified. This helps prevent the proxy token from being accidentally or maliciously reused, enhancing the security of the token.
[0047] S35, encrypting the proxy token and storing it in the distributed cache system. In this embodiment, the information in the proxy token is encrypted by AES to ensure the security of the proxy token during transmission and storage; The distributed cache system is located on the server side. The encrypted proxy token is stored in the distributed cache system (Redis). The proxy ID is part of the cache key. The cache value is the encrypted proxy token. The cache validity period is the authorization period.
[0048] S36, the server generates delegation information based on the proxy token and sends the delegation information to the client. The generated delegation information has the same content as the proxy configuration information, except that the proxy configuration information is configured by a normal user on the client, while the delegation information is used to be displayed on the client interface of the normal user corresponding to the proxy ID.
[0049] S4, selectively receiving an identity switching request, the identity switching request including an encrypted proxy token, and performing a first validity verification on the encrypted proxy token, specifically comprising the following steps: S41. Selectively receive an identity switching request sent by a client, where the identity switching request is generated according to the delegation information.
[0050] It should be noted that the client at this time refers to the client of the normal user corresponding to the proxy ID, because the delegation information will be displayed on the interface of the current client. At this time, the normal user corresponding to the proxy ID can generate an identity switching request and send it to the server by clicking the delegation information. The identity switching request includes the encrypted proxy token obtained from the delegation information.
[0051] It should be noted that the current client's delegation information is stored in the current client's browser SessionStorage.
[0052] Next, the server will verify the encrypted proxy token to determine whether the current normal user (agent) can switch identities.
[0053] S42: Perform a first validity verification on the encrypted proxy token.
[0054] The first validity verification includes: decrypting the encrypted proxy token using the same key as that used to encrypt the proxy token, thereby recovering all data in the proxy token.
[0055] S43. Obtain the proxy ID from the decrypted proxy token, and generate a cache key based on the proxy ID, so that the corresponding proxy token can be quickly located through the proxy ID.
[0056] In some cases, the normal user (principal) of the client may reset the proxy configuration information, usually due to incorrect permission configuration or authorization period configuration. As the normal user reconfigures the proxy information, new proxy configuration information will be generated.
[0057] If the server receives updated proxy configuration information, it generates an updated proxy token based on the updated proxy configuration information, and the proxy token before the update becomes invalid. The dynamic token before the update is overwritten with the latest generated proxy token, and the latest generated proxy token is stored in Redis.
[0058] In the above process, when a normal user (principal) modifies the proxy configuration information, the server will regenerate an updated proxy token and update the Redis cache.
[0059] To prevent the agent from unauthorized access, the agent token in the client's browser SessionStorage will become invalid. The system will prompt the normal user (agent) and automatically refresh the agent token based on the agent ID and update the information in SessionStorage.
[0060] S44. Obtain the latest generated proxy token from Redis, compare the latest generated proxy token with the proxy token obtained from the delegation information, i.e., SessionStorage, and obtain a comparison result. If the comparison results are consistent, the first validity verification is passed.
[0061] If the two are consistent, it means that the proxy token provided by the agent is valid; if they are inconsistent, it may mean that the proxy token has expired, been tampered with, or has been replaced with a new proxy token.
[0062] The above steps are to avoid the situation where the information obtained by normal users (agents) is not refreshed in time. For example, if the normal user (agent) has sent an identity switching request, and the proxy configuration information is reset afterwards, the normal user (agent) will not be able to obtain the regenerated proxy token and new delegation information in time. Although the content in the client browser SessionStorage is refreshed, the normal user (agent) does not get the refreshed information when starting the verification. At this time, there will be inconsistent comparison results until the normal user (agent) clicks on the delegation information again to resend the identity switching request. At this time, the delegation information is the latest data.
[0063] S5. When the first validity verification is passed, selectively receiving a second operation request, and when the second operation corresponding to the second operation request is the same as any proxy operation in the proxy authority range, executing the second operation, specifically comprising the following steps: S51, when the first validity verification is passed, the token mode is switched from the normal mode to the proxy mode, and the user identity is changed accordingly. At this time, the user identity of the client is the proxy; The above steps correspond to Figure 1 Step 10 in the above code has been fully executed. Figure 1 After the user identity is switched, the client's identity has changed from a normal user (agent) to an agent. The user has not changed, but the ID has become the ID of the normal user (principal). Figure 2 The data interaction process shown.
[0064] S52: When the token mode is the proxy mode, the server receives the second operation request sent by the agent, reads the proxy authority range in the proxy token, and determines whether the second operation corresponding to the second operation request is included in the proxy authority range.
[0065] Each proxy operation has a unique permission code. If the permission code corresponding to the agent's current second operation request is not within the scope of the agent's permission, the server will refuse to process the operation request and return a corresponding error message to the agent. Otherwise, the server will accept the agent's second operation request normally. The above-mentioned permission verification method is also applicable to the verification of the user permission scope in step S32.
[0066] S53: If yes, the second operation is valid; when the second operation is valid, execute the second operation.
[0067] In a specific implementation, when the user is an agent, the agent authority range in the agent token is directly read. If the second operation falls within the agent authority range, the current agent operation (second operation) is valid, and the server will execute the corresponding process based on the second operation.
[0068] S6. Generate and store audit logs based on proxy configuration information and proxy mode, specifically including the following steps.
[0069] When the server performs proxy operations, it will also record detailed operation logs, including operation time, operation content, operation mode (normal mode or proxy mode), agent information and principal information, providing detailed data support for post-audit and ensuring transparency and traceability of operations.
[0070] Based on the same inventive concept as above, the embodiment of the present application also discloses a permission proxy device based on dynamic identity switching, the structure of which is as follows: Figure 4 As shown, the device includes the following modules: An agent token generation module is used to generate and store an agent token according to the first operation, wherein the agent token includes an agent authority range, the agent authority range includes all allowed agent operations, and the agent token is encrypted; An identity switching module, configured to selectively receive an identity switching request, the identity switching request including an encrypted proxy token, perform a first validity verification on the encrypted proxy token, and when the first validity verification passes, execute an identity switching operation corresponding to the identity switching request; The proxy authority verification module is used to selectively receive a second operation request after the identity switching operation is completed, and execute the second operation when the second operation corresponding to the second operation request is the same as any proxy operation in the proxy authority range.
[0071] In a specific implementation scheme, the proxy token generation module includes the following units: The first proxy token generation unit is used to determine that the user identity of the current client is a normal user according to the normal mode when the normal token is valid, and to determine whether the function operation corresponding to the operation request is included in the user authority range, and if so, to determine that the function operation is valid; A second proxy token generation unit is used to selectively receive proxy configuration information generated by a normal user according to the first operation when the function operation is valid, the proxy configuration information including the identity information of the current normal user, the proxy authority range, the proxy ID and the authorization period; The third proxy token generation unit is used to generate a proxy token based on the proxy configuration information. The proxy token includes the proxy authority range, and the proxy authority range includes all allowed proxy operations. The proxy token is encrypting and storing it in the distributed cache system, and delegation information is generated based on the proxy token and sent to the client.
[0072] In a specific implementation scheme, the identity switching generation module includes the following units: A first identity switching generation unit, configured to selectively receive an identity switching request sent by a client, the identity switching request being generated according to the delegation information, the identity switching request including an encrypted proxy token obtained from the delegation information, and performing a first validity verification on the encrypted proxy token; The first validity verification includes: decrypting the encrypted proxy token, obtaining the proxy ID from the decrypted proxy token, and generating a cache key according to the proxy ID; The second identity switching generation unit is used to obtain the latest generated proxy token from the distributed cache system, compare the latest generated proxy token with the proxy token obtained from the delegation information and obtain the comparison result. If the comparison result is consistent, the first validity verification is passed, and the identity switching operation corresponding to the identity switching request is executed.
[0073] In a specific implementation scheme, the proxy authority verification module includes the following units: The first proxy authority verification unit is used to switch the token mode from the normal mode to the proxy mode after the identity switching operation is completed, and the user identity of the client is the proxy at this time; The second proxy authority verification unit is used to selectively receive a second operation request when the token mode is the proxy mode, read the proxy authority range in the proxy token, and determine whether the second operation corresponding to the second operation request is included in the proxy authority range. If so, the second operation is valid; when the second operation is valid, execute the second operation.
[0074] In a specific feasible implementation method, a permission proxy device based on dynamic identity switching further includes the following modules: The ordinary token generation module is used to receive the client's login request and perform login verification on the login request. When the login verification is passed, the corresponding login interface is called according to the login request, the current first timestamp is generated and recorded, and an ordinary token is generated according to the login interface and returned to the client. The ordinary token includes the current user information, user authority range and token mode. The user authority range includes all allowed functional operations. The token mode includes ordinary mode and proxy mode. The token mode of the ordinary token is ordinary mode.
[0075] An operation request verification module is used to receive an operation request sent by a client, where the operation request includes an ordinary token returned to the client, generate and record a second timestamp of the received operation request, and perform a second validity verification on the ordinary token based on the first timestamp and the second timestamp; when the interval between the first timestamp and the second timestamp does not exceed the preset token validity period, the second validity verification passes and the ordinary token is valid; otherwise, the second validity verification fails.
[0076] The proxy configuration information update module is used to generate an updated proxy token based on the updated proxy configuration information if updated proxy configuration information is received, and the proxy token before the update becomes invalid, and the dynamic token before the update is overwritten with the latest generated proxy token, and the latest generated proxy token is stored in the distributed cache system.
[0077] From the above functional introduction, it can be seen that the permission proxy device based on dynamic identity switching in this application has built a multi-layer verified permission switching system. By dynamically generating, encrypting, storing and verifying tokens, it provides the system with a safe and efficient proxy access control mechanism, which promotes the sustained, rapid and healthy development of the economy and society.
[0078] Based on the same inventive concept mentioned above, an embodiment of the present application also discloses a computer-readable storage medium, which stores at least one instruction, at least one program, code set or instruction set, and the at least one instruction, at least one program, code set or instruction set can be loaded and executed by a processor to implement the permission proxy method based on dynamic identity switching provided by the above method embodiment.
[0079] Also based on the same inventive concept mentioned above, an embodiment of the present application also discloses a computer-readable storage medium, in which at least one instruction, at least one program, code set or instruction set is stored, and the at least one instruction, at least one program, code set or instruction set is loaded and executed by a processor to implement the permission proxy method based on dynamic identity switching as described above.
[0080] Those skilled in the art will appreciate that all or part of the steps to implement the above embodiments may be accomplished by hardware or by instructing related hardware through a program, and the program may be stored in the computer-readable storage medium, which may include, for example, various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.
[0081] The above description is only an optional embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.
Claims
1. A permission proxy method based on dynamic identity switching, characterized in that: The steps include: Generate and store a proxy token according to the first operation, wherein the proxy token includes a proxy authority range, and the proxy authority range includes all allowed proxy operations, and encrypt the proxy token; selectively receiving an identity switching request, the identity switching request including the encrypted proxy token, performing a first validity verification on the encrypted proxy token, and when the first validity verification passes, executing an identity switching operation corresponding to the identity switching request; When the identity switching operation is completed, a second operation request is selectively received, and when a second operation corresponding to the second operation request is the same as any one of the proxy operations in the proxy authority range, the second operation is executed.
2. The permission proxy method based on dynamic identity switching according to claim 1 is characterized in that: Before the proxy token is generated and stored according to the first operation, the following steps are also included: Receive a login request from a client, perform login verification on the login request, and when the login verification passes, call the corresponding login interface according to the login request, generate and record the current first timestamp, generate a common token according to the login interface and return the common token to the client, the common token includes current user information, user authority range and token mode, the user authority range includes all allowed functional operations, the token mode includes common mode and proxy mode, and the token mode of the common token is the common mode.
3. The permission proxy method based on dynamic identity switching according to claim 2 is characterized in that: After generating a common token according to the login interface and returning the common token to the client, the following steps are also included: receiving an operation request sent by the client, the operation request including the common token returned to the client, generating and recording a second timestamp of receiving the operation request, and performing a second validity verification on the common token according to the first timestamp and the second timestamp; When the interval time between the first timestamp and the second timestamp does not exceed the preset token validity period, the second validity verification passes and the ordinary token is valid; otherwise, the second validity verification fails.
4. The permission proxy method based on dynamic identity switching according to claim 2 is characterized in that: The generating and storing of a proxy token according to the first operation, wherein the proxy token includes a proxy authority range, and the proxy authority range includes all permitted proxy operations, and the encrypting and returning of the proxy token specifically includes the following steps: When the common token is valid, the user identity of the current client is determined to be a normal user according to the common mode, and whether the function operation corresponding to the operation request is included in the user authority range, and if so, the function operation is deemed to be valid; When the functional operation is valid, selectively receiving proxy configuration information generated by the normal user according to the first operation, the proxy configuration information includes the current identity information of the normal user, the proxy authority range, the proxy ID and the authorization period; A proxy token is generated based on the proxy configuration information, the proxy token includes a proxy authority range, and the proxy authority range includes all permitted proxy operations. The proxy token is encrypted and stored in a distributed cache system, and delegation information is generated based on the proxy token and sent to the client.
5. The permission proxy method based on dynamic identity switching according to claim 4 is characterized in that: After the proxy token is encrypted and stored in the distributed cache system, the following steps are also included: If updated proxy configuration information is received, an updated proxy token is generated based on the updated proxy configuration information, the proxy token before the update becomes invalid, the dynamic token before the update is overwritten by the newly generated proxy token, and the newly generated proxy token is stored in the distributed cache system.
6. The permission proxy method based on dynamic identity switching according to claim 5 is characterized in that: The selectively receiving an identity switching request, wherein the identity switching request includes the encrypted proxy token, performing a first validity verification on the encrypted proxy token, and when the first validity verification passes, executing an identity switching operation corresponding to the identity switching request, specifically includes the following steps: selectively receiving an identity switching request sent by a client, the identity switching request being generated according to the delegation information, the identity switching request including the encrypted proxy token obtained from the delegation information, and performing a first validity verification on the encrypted proxy token; The first validity verification includes: decrypting the encrypted proxy token, obtaining the proxy ID from the decrypted proxy token, and generating a cache key according to the proxy ID; Obtain the most recently generated proxy token from the distributed cache system, compare the most recently generated proxy token with the proxy token obtained from the delegation information and obtain a comparison result; if the comparison results are consistent, the first validity verification passes, and execute the identity switching operation corresponding to the identity switching request.
7. The permission proxy method based on dynamic identity switching according to claim 4 is characterized in that: When the identity switching operation is completed, selectively receiving a second operation request, and when the second operation corresponding to the second operation request is the same as any one of the proxy operations in the proxy authority range, executing the second operation, specifically includes the following steps: When the identity switching operation is completed, the token mode is switched from the normal mode to the proxy mode, and the user identity of the client is now a proxy; When the token mode is the proxy mode, selectively receiving a second operation request, reading the proxy authority range in the proxy token, and determining whether the second operation corresponding to the second operation request is included in the proxy authority range, and if so, the second operation is valid; When the second operation is valid, the second operation is performed.
8. A permission proxy device based on dynamic identity switching, characterized in that: Includes the following modules: A proxy token generation module, used to generate and store a proxy token according to the first operation, wherein the proxy token includes a proxy authority range, the proxy authority range includes all allowed proxy operations, and the proxy token is encrypted; An identity switching module, configured to selectively receive an identity switching request, wherein the identity switching request includes the encrypted proxy token, perform a first validity verification on the encrypted proxy token, and when the first validity verification passes, execute an identity switching operation corresponding to the identity switching request; The proxy authority verification module is used to selectively receive a second operation request after the identity switching operation is completed, and execute the second operation when the second operation corresponding to the second operation request is the same as any one of the proxy operations in the proxy authority range.
9. An intelligent terminal, characterized in that: It includes a memory and a processor, wherein the memory stores at least one instruction, at least one program, code set or instruction set, and the at least one instruction, at least one program, code set or instruction set is loaded and executed by the processor to implement the permission proxy method based on dynamic identity switching as described in any one of claims 1 to 7.
10. A computer-readable storage medium, characterized in that: The readable storage medium stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, at least one program, a code set or an instruction set is loaded and executed by a processor to implement the permission proxy method based on dynamic identity switching as described in any one of claims 1 to 7.