Platform authentication method, medium, electronic device and program product

Abstract

The invention relates to the technical field of computers, and discloses a platform authentication method, which comprises the steps that a first server stores a plurality of tenant identifiers and addresses of a plurality of user services, and the first server comprises a data receiving module, a tenant identification module and a data sending module. The data receiving module obtains a first tenant identifier according to the identity authentication request, wherein the first tenant identifier is used for indicating a corresponding first tenant; the tenant identification module obtains the address of a first user service corresponding to the first tenant identifier according to the first tenant identifier, the plurality of tenant identifiers and the addresses of the plurality of user services; the plurality of user services are deployed in a server outside the first server, and the first user service is used for implementing identity authentication; and the data sending module sends the identity authentication request to the first user service according to the address of the first user service, and returns an authentication result to the user terminal. According to the method, the workload of platform authentication work is reduced, and the efficiency of the platform authentication work is improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a platform authentication method, medium, electronic equipment and program product. Background Art

[0002] With the development of the Internet, users have more and more demands for platform services, and the number of users on each platform has also increased dramatically. In the platform's authentication service, users need to authenticate their identities through the platform so that they can continue to use other types of services provided by the platform after successful authentication. Correspondingly, the platform's operation and maintenance work has increased, and the platform's load and resource requirements have increased, resulting in higher and higher operating and maintenance costs for the platform. Therefore, how to reduce the workload of platform services in the user's identity authentication work is a technical problem that needs to be solved urgently. Summary of the invention

[0003] The embodiments of the present invention provide a platform authentication method, a medium, an electronic device and a program product.

[0004] The first aspect of the present application provides a platform authentication method, which is applied to a first server, wherein the first server stores multiple tenant identifiers corresponding to multiple different tenants, and addresses of multiple user services corresponding to the multiple tenant identifiers, and the first server also includes a data receiving module, a tenant identification module and a data sending module, and the method includes: the data receiving module obtains a first tenant identifier according to an identity authentication request input by a user, and the first tenant identifier is used to indicate the first tenant corresponding to the user; the tenant identification module obtains the address of the first user service corresponding to the first tenant identifier from the addresses of multiple user services according to the first tenant identifier, multiple tenant identifiers and addresses of multiple user services; wherein the multiple user services are deployed in a server outside the first server, and the first user service is used to implement identity authentication outside the first server; the data sending module sends an identity authentication request to the first user service according to the address of the first user service, and returns the authentication result output by the first user service according to the identity authentication request to the user terminal.

[0005] It can be understood that the first tenant identifier is also the tenant identifier of the user below, the first server is also the server 300a of the platform service below, the user service corresponding to the first tenant identifier is also called the first user service, the address of the user service corresponding to the first tenant identifier is also called the address of the first user service, and the identity authentication request is also an authentication request.

[0006] The above platform authentication method implements the differentiated needs, differentiated configurations, and authentication work of each tenant in the user service outside the platform service, which reduces the workload of platform authentication work and improves the efficiency of platform authentication work.

[0007] In a possible implementation of the first aspect above, the tenant identification module obtains the address of the first user service corresponding to the first tenant identifier among the addresses of multiple user services based on the first tenant identifier, multiple tenant identifiers, and the addresses of multiple user services, including: the tenant identification module queries whether the first tenant identifier exists among the multiple tenant identifiers based on the first tenant identifier, and if the tenant identification module determines that the first tenant identifier exists among the multiple tenant identifiers, the tenant identification module obtains the address of the first user service corresponding to the first tenant identifier among the addresses of multiple user services.

[0008] In a possible implementation of the first aspect above, returning the authentication result obtained by the first user service according to the identity authentication request to the user terminal includes: the first user service authenticates the identity of the user according to the identity authentication request and obtains the authentication result; the first user service returns the authentication result to the data receiving module; and the data sending module returns the authentication result to the user terminal.

[0009] In a possible implementation of the first aspect, the data receiving module obtains the first tenant identifier according to the identity authentication request input by the user, including: the data receiving module obtains the first tenant identifier according to the user name in the identity authentication request input by the user.

[0010] In a possible implementation of the first aspect, the data receiving module obtains the first tenant identifier according to the identity authentication request input by the user, including: the data receiving module obtains the first tenant identifier according to the tenant information in the identity authentication request input by the user.

[0011] In a possible implementation of the first aspect above, the tenant includes at least one of an insurance company, an insurance product, and an insurance type.

[0012] A second aspect of the present application provides a storage medium on which instructions are stored. When the instructions are executed on an electronic device, the electronic device executes any one of the methods in the first aspect.

[0013] The third aspect of the present application provides a chip device, comprising: a communication interface for inputting and / or outputting information; a processor for executing a computer executable program so that an electronic device equipped with the chip device executes any one of the methods in the above-mentioned first aspect.

[0014] A fourth aspect of the present application provides a program product, characterized in that the program product includes instructions, and when the instructions are executed on an electronic device, the electronic device implements any one of the methods in the first aspect above.

[0015] The fifth aspect of the present application provides an electronic device, comprising: a memory for storing instructions executed by one or more processors of the electronic device; and a processor, which is one of the processors of the electronic device, for executing any one of the methods in the above-mentioned first aspect.

[0016] A sixth aspect of the present application provides a platform server, including:

[0017] A data receiving module for receiving an identity authentication request input by a user; a memory for storing multiple tenant identifiers and addresses of multiple user services corresponding to the multiple tenant identifiers; a tenant identification module for obtaining a first tenant identifier according to the identity authentication request, and obtaining the address of a first user service corresponding to the first tenant identifier according to the first tenant identifier, each tenant identifier, and the address of the user service corresponding to each tenant identifier; a data sending module for sending the identity authentication request to the first user service according to the address of the first user service, and for returning to the user terminal the authentication result obtained by the first user service according to the identity authentication request. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solution of the present application, the following is a brief introduction to the drawings required for use in the embodiments. Obviously, the following drawings are only drawings of some embodiments of the present application. For ordinary technicians in this field, without paying any creative labor, other drawings that can also realize the technical solution of the present application can be obtained based on these drawings.

[0019] Figure 1 According to some embodiments of the present application, a schematic diagram of a platform business scenario in the insurance industry is shown;

[0020] Figure 2 According to some embodiments of the present application, a schematic diagram of the software structure of a server 300a of a platform service is shown;

[0021] Figure 3 According to some embodiments of the present application, a schematic diagram of the interaction process of each module in a platform authentication method is shown;

[0022] Figure 4 According to some embodiments of the present application, a flow chart of a platform authentication method is shown;

[0023] Figure 5 According to some embodiments of the present application, a schematic diagram of the hardware structure of a server 300a of a platform service is shown. DETAILED DESCRIPTION

[0024] The illustrative embodiments of the present application include, but are not limited to, a platform authentication method, a medium, an electronic device, and a program product.

[0025] In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the embodiment of the present application is further described in detail below in combination with the accompanying drawings and implementation schemes. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0026] The technical solution of the embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0027] Figure 1 According to some embodiments of the present application, a platform business scenario of the insurance industry to which the technical solution of the present application is applicable is shown. Figure 1 As shown, the platform business scenario includes a user terminal 100 used by the user, a server 200 of the insurance company, a server 300a running a platform service (such as software as a service (SaaS)), and a database 300b for the platform service deployed on the server. Both the user and the insurance company can access the server 300a to handle insurance business. The user terminal 100 and the insurance company's server 200, and the insurance company's server 200 and the server 300a corresponding to the platform service can communicate through wireless networks such as Wireless-Fidelity (Wi-Fi) and Bluetooth.

[0028] It is understandable that many insurance companies manage their insurance products through various platforms. For example, SaaS service is a service provided by SaaS providers to build all the network infrastructure and software and hardware operating platforms required for informatization for various companies. SaaS providers are responsible for managing hardware and software, and ensuring the availability and security of applications and data according to appropriate service agreements. The insurance company's data is stored in the data center provided by the SaaS provider, such as database 300b. Since a large number of insurance companies use SaaS services to carry out insurance business, multiple tenant projects are deployed on the server 300a of the SaaS service provider. Each tenant project can correspond to an insurance company, and each tenant project has a corresponding sub-database.

[0029] Among them, the user terminal 100 can be installed with the insurance company's client software, such as an insurance application (Application, APP), and the user can manage his or her insurance products through the insurance application, such as medical insurance, pension insurance, vehicle insurance, accident insurance, etc.

[0030] First, the user can send an authentication request to the insurance company's server 200 through the user terminal 100. The authentication request may include various information entered by the user, such as name, password, account type, insurance product name, etc. The insurance company's server 200 sends the user's authentication request to the server 300a corresponding to the platform service. After receiving the user's authentication request, the server 300a corresponding to the platform service identifies the specific tenant of the insurance product based on the various information in the authentication request, and then obtains the stored data from the database 300b corresponding to the tenant.

[0031] The server 300a corresponding to the platform service can compare the data stored in the database 300b with the corresponding information in the user's authentication request, and when the comparison is successful, return the authentication success message to the user terminal 100 through the insurance company's server 200, or when the comparison is unsuccessful, return the authentication failure message to the user terminal 100 through the insurance company's server 200. After receiving the authentication success message, the user can further connect to the insurance company's server 200 and the server 300a corresponding to the platform service through the user terminal 100, and continue to use other types of services provided by the platform. For example, the user can continue to insure other insurance products, generate other insurance policies, or query the status of existing insurance policies, review the documents of existing insurance policies, etc.

[0032] It should be noted that Figure 1 The user terminal 100 in the platform business scenario shown can be any electronic device that can install the insurance company's application and has a display screen. The server 200 and the server 300a can be a single server or a server cluster composed of multiple servers.

[0033] However, with the development of the Internet, the number of users has increased dramatically, and each user has at least one account registered on the platform. All user data and insurance product data of the insurance company are stored in the database 300b of the platform service, and the amount of data stored in the database 300b is increasing. In addition, it can be understood that for different tenants, such as different insurance companies, their respective authentication requirements may be different. It can be understood that tenants can include at least one of insurance companies, insurance products, and insurance types. In this application, the specific meaning of tenants is not specifically limited.

[0034] For example, if the platform can support authentication through the user's username and password. Some tenants may want to use a username that does not distinguish between uppercase and lowercase letters, such as username "yb" and username "YB" correspond to the same user. Some tenants may want to use a username that distinguishes between uppercase and lowercase letters, such as username "yb", username "YB", username "Yb" and username "yB" correspond to different users. Some tenants want to set a maximum of 3 consecutive incorrect login passwords in the password policy security requirements. Some tenants want to set a maximum of 5 consecutive incorrect login passwords in the password policy security requirements. Some tenants want to limit the IP address of the login location, while some tenants do not want to limit the IP address of the login location, and so on. Different authentication requirements of different tenants need to correspond to differentiated configurations. Therefore, the increasing amount of data and the increasing number of differentiated configurations will lead to higher operating costs of the platform, including development costs and hardware costs.

[0035] In view of this, the present application proposes a platform authentication method. In this method, the platform service stores the tenant identifier of each tenant and the address of the user service corresponding to the tenant identifier of each tenant. The platform service can obtain the corresponding tenant identifier and the address of the user service corresponding to the tenant identifier based on the authentication information in the authentication request input by the user. Then, the platform service can send the authentication request sent by the user to the user service outside the platform service corresponding to the tenant identifier of each tenant, so that this user service can authenticate the identity of the user according to the authentication request.

[0036] In the above platform authentication method, the platform service can identify the tenant identifier of the authentication information in the user's authentication request, and then send the user's authentication request to the user service corresponding to the tenant identifier for authentication, and receive the authentication result returned by the user service. This method implements the differentiated needs, differentiated configurations, and authentication work of each tenant in the user service outside the platform service. Therefore, no matter how the number of users or needs of the tenants are improved, it will not affect the configuration operation and maintenance of the platform service. The platform service only provides a functional entry for user identity authentication, which reduces the workload of platform authentication and improves the efficiency of platform authentication.

[0037] In order to facilitate the understanding of this scheme, the following Figure 2 , the structure of the server 300a of the platform service is introduced.

[0038] like Figure 2 As shown, the server 300a (also referred to as the first server) of the platform service may include a data receiving module 3001, a tenant identification module 3002, a data sending module 3003, and a database 300b deployed on the server 300a of the platform service.

[0039] The functions of each module in the server 300a of the platform service and their roles in some embodiments of the present application are described in detail below.

[0040] In some embodiments, the data receiving module 3001 may be used to receive an authentication request (also referred to as an identity authentication request) sent by a user, and to receive an authentication result sent by a user service corresponding to the user's tenant identifier. The authentication request sent by the user may be sent by the user to the data receiving module 3001 through the user terminal 100 and the insurance company's server 200. The user's tenant identifier is also referred to as a first tenant identifier, which is used to indicate the first tenant corresponding to the user.

[0041] For example, the user enters an authentication request on the login page through the page of the insurance application installed on the user terminal 100, or the webpage of the insurance company in the browser on the user terminal 100, to perform authentication. The user's authentication request may include relatively simple authentication information entered by the user, including, for example, a user name, a login password, etc. The data receiving module may send the received authentication request to the tenant identification module 3002. Alternatively, the data receiving module may send the received authentication result to the data sending module 3003.

[0042] In some embodiments, the tenant identification module 3002 can be used to check the identified tenant identifier with the tenant identifiers of each tenant stored in the database 300b after obtaining the user's authentication requirements, and obtain the address of the user service corresponding to the user's tenant identifier. Then, the tenant identification module 3002 sends the address of the user service corresponding to the user's tenant identifier and the user's authentication request to the data sending module 3003. The address of the user service corresponding to the user's tenant identifier is also called the address of the first user service.

[0043] For example, in some embodiments, the tenant identification module 3002 can obtain the tenant identification through the user name. The tenant identification is an identification used to identify which tenant the user currently requesting authentication belongs to. The tenant identification can be adjusted according to the authentication protocol of the platform. For example, if the platform provides the OAuth 2.0 authentication protocol, that is, an authorization protocol that allows users to authorize third-party applications to access their information stored on another service provider without sharing their authentication credentials. Then, the tenant identification can be included in the username. For example, the username can be ab_tenant identification, and the tenant identification can be part of the username. Therefore, the tenant identification module 3002 can obtain the corresponding tenant identification through the obtained username and identify the corresponding tenant.

[0044] For another example, in some embodiments, the server 300a corresponding to the platform service can obtain the tenant identification through the tenant information in the identity authentication request. For example, if the platform provides other customized authentication protocols, and the customized authentication protocol includes a preset tenant identification. The user's authentication request may include a user name, a login password, and tenant information such as a tenant identification. Therefore, the tenant identification module 3002 can identify the corresponding tenant through the tenant identification included in the user's authentication request. It can be understood that the tenant information can also be other information that can be used to identify the tenant. In this application, the specific content of the tenant information is not specifically limited.

[0045] In the embodiment of the present application, there is no specific limitation on the protocols supported by the platform, the content of the tenant identification, and the method by which the tenant identification module 3002 identifies the tenant identity corresponding to the user.

[0046] In some embodiments, the database 300b can be used to store the tenant identifier of each tenant and the address of the user service of each tenant. The database 300b is divided into multiple sub-storage areas, each of which stores the tenant identifier of a tenant and the address of the user service of the tenant. In some embodiments, the tenant identification module 3002 checks the identified tenant identifier with the tenant identifiers of each tenant stored in the database 300b, thereby obtaining the address of the user service corresponding to the tenant identifier of the user.

[0047] In some embodiments, the data sending module 3003 may be used to send the user's authentication request to the user service corresponding to the user's tenant identity according to the address of the user service corresponding to the user's tenant identity. In some embodiments, the user service corresponding to the user's tenant identity will authenticate the user according to the authentication information in the authentication request, and send the authentication result to the data receiving module 3001. In addition, the data sending module 3003 may also be used to send the authentication result to the user terminal 100 through the insurance company's server 200 after receiving the authentication result sent by the user service corresponding to the user's tenant identity.

[0048] It can be understood that in some embodiments, the user service is a system independent of the platform service. The user service may include a server for the user service and a memory for the user service. Each tenant may correspond to a user service, and each tenant may correspond to an independent server for the user service and an independent memory for the user service. In some embodiments, different tenants may also correspond to the same server for the user service and the same independent memory for the user service. In the embodiments of the present application, no specific limitation is made.

[0049] The following is based on Figure 1 and Figure 2 , combined with Figure 3, introduces an interactive process of a platform authentication method in an embodiment of the present application. The specific interactive process of the platform authentication method may include the following steps:

[0050] S301: The user terminal 100 receives an authentication request input by a user.

[0051] In some embodiments, the user may input an authentication request through the interface of the insurance application installed on the user terminal 100. It is understood that the user's authentication request may include relatively simple authentication information input by the user, and the authentication information may include tenant information such as a user name and a login password. In some embodiments, the authentication information input by the user may also include other more content, such as account type, insurance product name, etc. In the embodiments of the present application, the content and type of the authentication information included in the user's authentication request are not specifically limited.

[0052] S302, the user terminal 100 sends the user's authentication request to the insurance company's server.

[0053] S303, the insurance company's server accepts the user's authentication request.

[0054] S304, the insurance company's server sends the user's authentication request to the data receiving module 3001 of the platform service server 300a.

[0055] S305, the data receiving module 3001 receives the user's authentication request.

[0056] In some embodiments, the server 300a corresponding to the platform service may receive the user's authentication request through the insurance company's server 200 and the data receiving module 3001 .

[0057] S306, the data receiving module 3001 sends the user's authentication request to the tenant identification module 3002.

[0058] S307, the tenant identification module 3002 receives the user's authentication request.

[0059] S308, the tenant identification module 3002 obtains the address of the user service corresponding to the tenant identification according to the authentication information in the user's authentication request.

[0060] In some embodiments, the database 300b of the platform service deployed on the server 300a of the platform service can be divided into different storage areas, each of which stores a tenant identifier of a tenant and the address of the user service corresponding to the tenant identifier. In some embodiments, a tenant can be an insurance company, a type of product of an insurance company, etc. In the embodiments of the present application, there is no specific limitation on the content of the tenant.

[0061] In some embodiments, the tenant identification module 3002 can obtain the corresponding tenant identification according to the authentication information in the user's authentication request. The tenant identification module 3002 can obtain the address of the user service corresponding to the tenant identification according to the corresponding tenant identification and the storage area of ​​the database 300b corresponding to the tenant.

[0062] In some embodiments, the tenant identification module 3002 can obtain the tenant identification through the user name. For example, if the platform provides the OAuth 2.0 authentication protocol, when the user enters the user name and login password on the login page of the insurance application in the user terminal 100, the tenant identification module 3002 can identify the corresponding tenant through the tenant identification in the user name.

[0063] In some embodiments, the tenant identification module 3002 can obtain the tenant identification through the tenant information. For example, if the platform provides other customized authentication protocols, and the customized authentication protocol includes a preset tenant identification. When the user enters the user name and login password on the login page of the insurance application in the user terminal 100, the server 300a corresponding to the platform service can identify the corresponding tenant through the tenant identification corresponding to the user name.

[0064] In the embodiment of the present application, there is no specific limitation on the method by which the server 300a corresponding to the platform service identifies the tenant identifier.

[0065] S309 , the tenant identification module 3002 sends the user's authentication request and the address of the user service corresponding to the tenant identification to the data sending module 3003 .

[0066] S310, the data sending module 3003 receives the user's authentication request and the address of the user service corresponding to the tenant identifier.

[0067] S311, the data sending module 3003 sends the user's authentication request to the corresponding user service according to the address of the user service corresponding to the tenant identifier.

[0068] In some embodiments, the data sending module 3003 may send the user's authentication request to the user service corresponding to the address of the user service according to the address of the user service corresponding to the tenant identifier.

[0069] In some embodiments, the data sending module 3003 may also send the user's authentication request to the user service corresponding to the address of the user service based on other information. The other information may be the address of the user service for identity authentication preset in the database 300b, or the address of the user service obtained by the data receiving module 3001 through other means other than the server 300a of the platform service such as the cloud.

[0070] In the embodiment of the present application, the specific source and content of the path based on which the data sending module 3003 sends the user's authentication request are not specifically limited.

[0071] S312, the user service obtains the verification result according to the user's authentication request.

[0072] In some embodiments, the user service corresponding to the tenant identifier of the user can authenticate the user according to the authentication information in the authentication request, thereby determining whether the user is a user of the platform service. In some embodiments, after the server 300a of the platform service sends the user's authentication request to the corresponding user service, the corresponding user service will authenticate the user according to the authentication information in the authentication request. For example, the corresponding user service can check the user name and password in the authentication information with the data in the memory of the corresponding user service. If the result of the check is correct, the verification result obtained by the user service is successful. If the result of the check is wrong, the verification result obtained by the user service is failed.

[0073] S313, the user service sends the verification result to the data receiving module 3001.

[0074] It can be understood that the corresponding user service server will send the result of successful authentication to the data receiving module 3001, thereby returning to the platform service server 300a. Or the corresponding user service server will send the result of failed authentication to the data receiving module 3001, thereby returning to the platform service server 300a.

[0075] S314, the data receiving module 3001 receives the verification result.

[0076] S315, the data receiving module 3001 sends the verification result to the data sending module 3003.

[0077] S316, the data sending module 3003 receives the verification result.

[0078] S317, the data sending module 3003 sends the verification result to the insurance company's server.

[0079] S318, the insurance company's server 200 receives the verification result.

[0080] S319, the insurance company's server 200 sends the verification result to the user terminal.

[0081] In some embodiments, after receiving the authentication result, the data receiving module 3001 sends the authentication result to the insurance company's server 200, and finally returns the authentication result to the user terminal 100 through the insurance company's server 200. The user can obtain the authentication result in the login page of the insurance application in the user terminal 100.

[0082] Moreover, after receiving the authentication success message, the user can continue to use other types of services provided by the platform through the user terminal 100. For example, the user can continue to insure other insurance products, generate other insurance policies, or query the status of existing insurance policies, review the documents of existing insurance policies, etc.

[0083] It can be understood that the storage of the user service corresponding to each tenant can include more information of all users in each tenant. The differentiated needs of each tenant can be set accordingly in the storage of the corresponding user service. For example, the information of users in each tenant can include account types, and users of different account types can obtain different usage permissions. Alternatively, sensitive fields can be set in the information of users in each tenant. For example, if the tenant is insurance company A, "A" can be set as a sensitive field, so when the user registers, "A" cannot be used as registration information. Alternatively, the user's IP can be restricted in the information of users in each tenant. For example, if the tenant is insurance company A, the insurance products of this tenant will not be sold in city a. Therefore, people with IP addresses in city a will not be able to become users of this insurance company A. It can be understood that the differentiated needs of each tenant can be adjusted according to each tenant, and the differentiated configurations corresponding to these differentiated needs will also be set in the user service without having to be set in the platform.

[0084] Therefore, even if the number of tenants and the number of users continue to grow, the database 300b of the platform service only needs to store the tenant identification of each tenant and the address of the user service corresponding to the tenant identification. The server 300a of the platform service can query the tenant identification of each tenant stored in the database 300b of the platform service according to the authentication information in the authentication request input by the user, and the address of the user service corresponding to the tenant identification, so that the authentication request input by the user can be sent to the corresponding user service for authentication. In addition, the server 300a of the platform service can also return the authentication result obtained in the corresponding user service to the user to complete the user's authentication request. In some embodiments, the data structure of the tenant identification and the address of the user service corresponding to the tenant identification can also be set according to the specific authentication protocol of the platform service without the need for additional adjustments according to different tenants and users. The workload of the operation and maintenance work of the platform will not increase rapidly due to the increase in the number of tenants and users.

[0085] The above platform authentication method can identify the tenant ID of the authentication information in the user's authentication request, then send the user's authentication request to the user service corresponding to the tenant ID for authentication, and return the authentication result of the corresponding user service to the user. This method implements the differentiated needs and differentiated configurations of each tenant in the user service, reduces the workload of platform authentication work, and improves the efficiency of platform authentication work.

[0086] Based on the above Figure 1 The scene shown, Figure 4 The flowchart of the platform authentication method in the embodiment of the present application is shown with the server 300a of the platform service as the execution subject. The specific platform authentication method may include the following steps:

[0087] S410: Receive a user's authentication request.

[0088] In some embodiments, the user may send an authentication request to the insurance company's server 200 through the user terminal 100. Furthermore, the server 300a corresponding to the platform service will receive the user's authentication request through the insurance company's server 200.

[0089] It can be understood that the implementation process in step S410 is the same as Figure 3 The implementation process of step S301 to step S305 is the same as that of step S301 to step S305, which will not be repeated here.

[0090] S420: Send the user's authentication request to a corresponding user service according to the authentication information in the user's authentication request.

[0091] It can be understood that the implementation process in step S420 is the same as Figure 3The implementation process from step S306 to step S311 is the same.

[0092] In some embodiments, the authentication information in the user's authentication request may include a user name and password, etc. The server 300a of the platform service can obtain the tenant identifier corresponding to the user by analyzing the content of the authentication information. For example, the tenant identifier can be used to indicate an insurance company corresponding to the user, a type of product of an insurance company, etc. In addition, each tenant can have a corresponding storage area in the database 300b, and the storage areas corresponding to each tenant may also be different. In the embodiments of the present application, there is no specific limitation on the number and content of the tenant identifiers.

[0093] The method by which the platform service server 300a obtains the tenant identifier corresponding to the user by analyzing the content of the authentication information may be related to the authentication protocol in the platform service server 300a. In the embodiment of the present application, the number and content of the authentication protocols in the platform service server 300a are not specifically limited.

[0094] In some embodiments, the server 300a of the platform service can obtain the address of the user service corresponding to the tenant identifier among the addresses of multiple stored user services through the tenant identifier corresponding to the user. In some embodiments, the server 300a of the platform service can also obtain the address of the user service corresponding to the tenant identifier in other ways, such as the address preset in the database 300b, or the address obtained by the data receiving module 3001 through other means other than the server 300a of the platform service through the cloud. In the embodiment of the present application, the specific source and content of the address of the user service corresponding to the tenant identifier obtained by the server 300a of the platform service are not specifically limited.

[0095] In some embodiments, the server 300a of the platform service can send the user's authentication request to the address of the corresponding user service, so that the corresponding user service can authenticate the user according to the user's authentication request. For example, the corresponding user service can authenticate the user based on the set rules of the user's tenant. In the embodiment of the present application, the specific content of the work of the user service performing the identity authentication is not specifically limited.

[0096] S430, receiving the authentication result sent by the corresponding user service, and sending the authentication result to the user terminal through the insurance company's server.

[0097] It can be understood that step S430 and Figure 3 The implementation process and Figure 3 The implementation process from step S314 to step S319 is the same and will not be repeated here.

[0098] The above platform authentication method can identify the tenant ID of the authentication information in the user's authentication request, then send the user's authentication request to the user service corresponding to the tenant ID for authentication, and return the authentication result of the corresponding user service to the user. This method implements the differentiated needs and differentiated configurations of each tenant in the user service, reduces the workload of platform authentication work, and improves the efficiency of platform authentication work.

[0099] To facilitate understanding of the technical solutions implemented in this application, the hardware structure of the server 300a of the platform service is introduced below.

[0100] further, Figure 5 According to some embodiments of the present application, a schematic diagram of the structure of a server 300a of a platform service is shown. Figure 5 As shown, for executing the application provided Figure 3 and Figure 4 The server 300a of the user authentication method shown may include one or more processors 201, system memory 202, non-volatile memory (NVM) 203, input / output (I / O) device 204, communication interface 205, and system control logic 206 for coupling the processor 201, system memory 202, non-volatile memory 203, communication interface 205 and input / output (I / O) device 204.

[0101] Wherein: the processor 201 may include one or more single-core or multi-core processors. In some embodiments, the processor 201 may include any combination of a general-purpose processor and a dedicated processor (e.g., a graphics processor, an application processor, a baseband processor, etc.). In some embodiments, the processor 201 may be used to perform matching with regional sub-library rules according to product information and geographic area information in the request data, and if the matching fails, then matching with tenant sub-library rules according to tenant information in the request data, and executing the insurance business logic according to the result of sub-library rule matching.

[0102] The system memory 202 is a volatile memory, such as a random-access memory (RAM), a double data rate synchronous dynamic random access memory (DDR SDRAM), etc. The system memory is used to temporarily store data and / or instructions. For example, in some embodiments, the system memory 202 can be used to store the executable program for implementing the platform authentication method.

[0103] The non-volatile memory 203 may include one or more tangible, non-temporary computer-readable media for storing data and / or instructions. In some embodiments, the non-volatile memory 203 may include any suitable non-volatile memory such as flash memory and / or any suitable non-volatile storage device, such as a hard disk drive (HDD), a compact disc (CD), a digital versatile disc (DVD), a solid-state drive (SSD), etc. In some embodiments, the non-volatile memory 203 may also be a removable storage medium, such as a secure digital (SD) memory card, etc.

[0104] In particular, the system memory 202 and the non-volatile memory 203 may respectively include: a temporary copy and a permanent copy of the instruction 207. The instruction 207 may include: a program instruction that, when executed by at least one of the processors 201, enables the server 200 to implement the platform authentication method provided in each embodiment of the present application.

[0105] The input / output (I / O) device 204 may include a user interface to enable a user to interact with the server 200b. For example, in some embodiments, the input / output (I / O) device 204 may include an output device such as a display for displaying the software system used in the server 200b, and may also include input devices such as a keyboard, a mouse, and a touch screen. The maintenance personnel of the server 200b may interact with the server 200b through the user interface and input devices such as a keyboard, a mouse, and a touch screen.

[0106] The communication interface 205 may include a transceiver for providing a wired or wireless communication interface for the server 200b, thereby communicating with any other suitable device through one or more networks. In some embodiments, the communication interface 205 may be integrated into other components of the server 200b, for example, the communication interface 205 may be integrated into the processor 201. In some embodiments, the server 200b may communicate with other devices through the communication interface 205.

[0107] System control logic 206 may include any suitable interface controller to provide any suitable interface with other modules of server 200 b. For example, in some embodiments, system control logic 206 may include one or more memory controllers to provide interfaces to system memory 202 and non-volatile memory 203.

[0108] In some embodiments, at least one of the processors 201 may be packaged together with the logic of one or more controllers for the system control logic 206 to form a system in package (System in Package, SiP). In other embodiments, at least one of the processors 201 may also be integrated with the logic of one or more controllers for the system control logic 206 on the same chip to form a system-on-chip (System-on-Chip, SoC).

[0109] It can be understood that the server 200b can be any electronic device that can execute the platform authentication method provided in this application, including but not limited to computers, servers, tablet computers, handheld computers, etc., and the embodiments of this application are not limited thereto.

[0110] It is understood that the structure of the server 200b shown in the embodiment of the present application does not constitute a specific limitation on the server 200b. In other embodiments of the present application, the server 200b may include more or fewer components than shown in the figure, or combine some components, or split some components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0111] The various embodiments of the mechanism disclosed in the present application can be implemented in hardware, software, firmware or a combination of these implementation methods. The embodiments of the present application can be implemented as a computer program or program code executed on a programmable system, which includes at least one processor, a storage system (including volatile and non-volatile memory and / or storage elements), at least one input device and at least one output device.

[0112] Program code can be applied to input instructions to perform the functions described in this application and generate output information. The output information can be applied to one or more output devices in a known manner. For the purposes of this application, a processing system includes any system having a processor such as, for example, a digital signal processor (DSP), a microcontroller, an application specific integrated circuit (ASIC), or a microprocessor.

[0113] Program code can be implemented with high-level programming language or object-oriented programming language to communicate with the processing system. When necessary, program code can also be implemented with assembly language or machine language. In fact, the mechanism described in this application is not limited to the scope of any specific programming language. In either case, the language can be a compiled language or an interpreted language.

[0114] In some cases, the disclosed embodiments may be implemented in hardware, firmware, software, or any combination thereof. The disclosed embodiments may also be implemented as instructions carried or stored on one or more temporary or non-temporary machine-readable (e.g., computer-readable) storage media, which may be read and executed by one or more processors. For example, instructions may be distributed over a network or through other computer-readable media. Therefore, machine-readable media may include any mechanism for storing or transmitting information in a machine (e.g., computer) readable form, including, but not limited to, floppy disks, optical disks, optical disks, read-only memories (CD-ROMs), magneto-optical disks, read-only memories (ROM), random access memories (RAM), erasable programmable read-only memories (EPROM), electrically erasable programmable read-only memories (EEPROM), magnetic cards or optical cards, flash memory, or tangible machine-readable memories for transmitting information (e.g., carrier waves, infrared signal digital signals, etc.) using the Internet in electrical, optical, acoustic, or other forms of propagation signals. Accordingly, machine-readable media include any type of machine-readable media suitable for storing or transmitting electronic instructions or information in a form readable by a machine (eg, a computer).

[0115] In the accompanying drawings, some structural or method features may be shown in a specific arrangement and / or order. However, it should be understood that such a specific arrangement and / or order may not be required. Instead, in some embodiments, these features may be arranged in a manner and / or order different from that shown in the illustrative drawings. In addition, the inclusion of structural or method features in a particular figure does not mean that such features are required in all embodiments, and in some embodiments, these features may not be included or may be combined with other features.

[0116] It should be noted that the units / modules mentioned in the various device embodiments of the present application are all logical units / modules. Physically, a logical unit / module can be a physical unit / module, or a part of a physical unit / module, or can be implemented as a combination of multiple physical units / modules. The physical implementation method of these logical units / modules themselves is not the most important. The combination of functions implemented by these logical units / modules is the key to solving the technical problems proposed by the present application. In addition, in order to highlight the innovative part of the present application, the above-mentioned device embodiments of the present application do not introduce units / modules that are not closely related to solving the technical problems proposed by the present application, which does not mean that there are no other units / modules in the above-mentioned device embodiments.

[0117] It should be noted that in the examples and description of this patent, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "including one" do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0118] Although the present application has been illustrated and described with reference to certain preferred embodiments thereof, it will be apparent to those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the present application.

Claims

1. A platform authentication method, applied to a first server, characterized in that: The first server stores a plurality of tenant identifiers corresponding to a plurality of different tenants and addresses of a plurality of user services corresponding to the plurality of tenant identifiers, and the first server further includes a data receiving module, a tenant identification module and a data sending module, and the method includes: The data receiving module obtains a first tenant identifier according to an identity authentication request input by a user, where the first tenant identifier is used to indicate a first tenant corresponding to the user; The tenant identification module acquires, according to the first tenant identifier, the multiple tenant identifiers and the addresses of the multiple user services, an address of a first user service corresponding to the first tenant identifier among the addresses of the multiple user services; wherein the multiple user services are deployed in a server outside the first server, and the first user service is used to implement identity authentication outside the first server; The data sending module sends the identity authentication request to the first user service according to the address of the first user service, and returns the authentication result output by the first user service according to the identity authentication request to the user terminal.

2. The method according to claim 1, characterized in that The tenant identification module acquires, according to the first tenant identifier, the multiple tenant identifiers, and the addresses of the multiple user services, an address of a first user service corresponding to the first tenant identifier among the addresses of the multiple user services, including: The tenant identification module queries whether there is a first tenant identifier among the multiple tenant identifiers based on the first tenant identifier, and if the tenant identification module determines that the first tenant identifier exists among the multiple tenant identifiers, the tenant identification module obtains an address of a first user service corresponding to the first tenant identifier from the addresses of the multiple user services.

3. The method according to claim 1, characterized in that The returning the authentication result obtained by the first user service according to the identity authentication request to the user terminal includes: The first user service authenticates the identity of the user according to the identity authentication request and obtains an authentication result; The first user service returns the authentication result to the data receiving module; The data sending module returns the authentication result to the user terminal.

4. The method according to claim 1, characterized in that: The data receiving module obtains the first tenant identifier according to the identity authentication request input by the user, including: The data receiving module obtains the first tenant identifier according to the user name in the identity authentication request input by the user.

5. The method according to claim 1, characterized in that The data receiving module obtains the first tenant identifier according to the identity authentication request input by the user, including: The data receiving module obtains the first tenant identifier according to the tenant information in the identity authentication request input by the user.

6. The method according to claim 1, characterized in that The tenant includes at least one of an insurance company, an insurance product, and an insurance type.

7. A platform server, characterized in that: include: A data receiving module, used to receive an identity authentication request input by a user; A memory, in which a user stores a plurality of tenant identifiers and addresses of a plurality of user services corresponding to the plurality of tenant identifiers; a tenant identification module, configured to obtain a first tenant identifier according to the identity authentication request, and obtain an address of a first user service corresponding to the first tenant identifier according to the first tenant identifier, the respective tenant identifiers, and addresses of user services corresponding to the respective tenant identifiers; The data sending module is used to send the identity authentication request to the first user service according to the address of the first user service, and to return the authentication result obtained by the first user service according to the identity authentication request to the user terminal.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and when the instructions are executed on an electronic device, the electronic device executes the platform authentication method according to any one of claims 1 to 6.

9. A chip device, characterized in that: The chip device comprises: A communication interface for inputting and / or outputting information; The processor is used to execute a computer executable program so that an electronic device equipped with the chip device executes the platform authentication method according to any one of claims 1 to 6.

10. A computer program product, characterized in that The computer program product comprises instructions, and when the instructions are executed, the platform authentication method according to any one of claims 1 to 6 is implemented.

11. An electronic device, characterized in that: include: a memory for storing instructions to be executed by one or more processors of the electronic device, and A processor, when the instruction is executed by one or more processors of the electronic device, the processor is used to execute the instruction stored in the memory to implement the platform authentication method according to any one of claims 1 to 6.

Images