A certificate-based authorization management method and system

Abstract

The present invention provides a certificate-based authorization management method and system. A corresponding authorization certificate is generated for each user's device; wherein the authorization certificate includes at least one of a device unique identifier, authorization status, authorization duration, authorization validity period, and a function permission identifier; when a user's access request to an information system is received, it is determined whether the authorization certificate corresponding to the user's device can be obtained from the system's cache. If so, the authorization is valid, allowing the user to access the information system; if not, it is determined whether the authorization certificate file can be read in the entire system. If it can be read, the authorization certificate is cached, allowing the user to access the information system; if it cannot be read, an authorization certificate import entry is provided to the user, and the authorization certificate provided by the user is imported into the system; the imported authorization certificate is verified, and after verification of legality, the user is allowed to access the information system. The present invention greatly improves security, and users do not need to remember passwords.

Description

Technical Field

[0001] One or more embodiments of the present invention relate to network communication technology, and more particularly, to a certificate-based authorization management method and system. Background Art

[0002] With the rapid development of information technology, information systems are increasingly being used across all industries. From internal corporate management to government public services and even daily life, information systems play a vital role. However, as information system applications deepen, their security issues become increasingly prominent. Ensuring the secure, stable, and reliable operation of information systems has become a critical issue that demands urgent attention. Traditional information system authorization and access control methods primarily rely on username and password authentication, but this approach presents numerous security risks. First, passwords are easily guessed, cracked, or leaked, allowing unauthorized users to easily access the system. Second, traditional access control methods lack dynamic monitoring and management of user behavior, making them difficult to adapt to complex and changing network environments.

[0003] Therefore, seeking a more advanced and reliable information system authorization access control method has become an urgent need in the industry. Summary of the Invention

[0004] One or more embodiments of the present invention describe a certificate-based authorization management method and system, which can solve at least one problem in the prior art.

[0005] According to a first aspect, a certificate-based authorization management method is provided, the method comprising:

[0006] Generate a corresponding authorization certificate for each user's device using predefined rules and templates; wherein the authorization certificate includes at least one of the device's unique identifier, authorization status, authorization duration, authorization validity period, and function permission identifier;

[0007] The method further includes:

[0008] When receiving a user's access request to the information system, it is determined whether the authorization certificate corresponding to the user's device can be obtained from the system's cache. If so, the authorization is valid and the user is allowed to access the information system;

[0009] If the authorization certificate corresponding to the user's device cannot be obtained from the system's cache, then determine whether the authorization certificate file can be read in the entire system. If it can be read, then cache the authorization certificate and allow the user to access the information system;

[0010] If the authorization certificate file cannot be read in the entire system, an authorization certificate import entry is provided to the user to import the authorization certificate provided by the user into the system;

[0011] Verify the imported authorization certificate. If it is verified to be legal, the user is allowed to access the information system.

[0012] The step of generating a corresponding authorization certificate for each user device further includes: encrypting the generated authorization certificate using an elliptic curve encryption algorithm ECC;

[0013] and / or,

[0014] The generated authorization certificate is digitally signed.

[0015] After the authorization certificate provided by the user is imported into the system and before the imported authorization certificate is verified, the method further includes: decrypting the imported authorization certificate; and / or verifying the digital signature of the imported authorization certificate.

[0016] Generating a corresponding authorization certificate for each user device includes:

[0017] Obtaining historical behavior data of the user; wherein the behavior data includes at least one of: login records, access records, usage habit data, and usage demand data of the user;

[0018] Use big data analysis technology to analyze users' historical behavior data and predict their future behavior; and

[0019] Based on the predicted future behavior of the user, a corresponding authorization certificate is generated for the user's user device.

[0020] Before allowing the user to access the information system, the method further includes: judging whether the current time is within the authorization validity period included in the authorization certificate; if so, the authorization is valid, and continuing to allow the user to access the information system.

[0021] The verification of the imported authorization certificate includes:

[0022] Determine whether there is a historical authorization certificate corresponding to the user's device. If not, the verification fails. If so, determine whether the device unique identifier included in the historical authorization certificate is the same as the device unique identifier included in the imported authorization certificate. If they are not the same, the verification fails. If they are the same, the verification is legal and the imported authorization certificate is cached.

[0023] Generating a corresponding authorization certificate for each user's device includes:

[0024] For different users, different roles and permissions are assigned to different users according to actual needs. According to the role and permission assigned to each user, a corresponding authorization certificate is generated for the user's device;

[0025] and / or,

[0026] Based on user behavior and time factors, the authorization certificate generated for each user's device is adjusted in real time.

[0027] According to a second aspect, there is provided a certificate-based authorization management system, the system comprising:

[0028] An authorization certificate generation module is configured to generate a corresponding authorization certificate for each user's device based on predefined rules and templates; wherein the authorization certificate includes at least one of a device unique identifier, authorization status, authorization duration, authorization validity period, and function permission identifier;

[0029] A user interaction module configured to receive a user's access request to the information system;

[0030] The authorization processing module is configured to determine whether the authorization certificate corresponding to the user's device can be obtained from the system's cache when the user interaction module receives a user's access request to the information system. If so, the authorization is valid and the user is allowed to access the information system; if the authorization certificate corresponding to the user's device cannot be obtained from the system's cache, determine whether the authorization certificate can be read in the entire system. If it can be read, cache the authorization certificate and allow the user to access the information system; if the authorization certificate cannot be read in the entire system, provide the user with an authorization certificate import entry through the user interaction module, and import the authorization certificate provided by the user into the system through the user interaction module; verify the imported authorization certificate, and after verification of its legality, allow the user to access the information system.

[0031] According to a third aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed in a computer, the computer is caused to implement the method described in any embodiment of the present invention.

[0032] According to a fourth aspect, a computing device is provided, comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method described in any embodiment of the present invention is implemented.

[0033] The certificate-based authorization management method and system provided by various embodiments of the present invention can achieve at least the following beneficial effects:

[0034] 1. When it is necessary to verify the authorization certificate, the processing method of the embodiment of the present invention is: first, the required authorization certificate is searched from the system cache. If it can be found, authorization processing is performed based on the authorization certificate in the cache; next, if the required authorization certificate cannot be found from the system cache, the required authorization certificate is further obtained by reading a file in the entire system. If it can be read, authorization processing is performed based on the read authorization certificate; next, if the required authorization certificate cannot be obtained by reading a file in the entire system, an authorization certificate import entry is provided to the user, and authorization processing is performed based on the authorization certificate imported by the user.

[0035] 2. In this embodiment of the present invention, an authorization certificate can be generated and issued for each user's device. Each device that accesses the information system must verify the authorization certificate corresponding to the user's device, thereby significantly improving security. Furthermore, users no longer need to remember passwords, further facilitating user experience. Furthermore, the use of authorization certificates facilitates dynamic monitoring and management of user behavior, enabling the system to cope with complex and changing network environments.

[0036] 3. In various embodiments of the present invention, digital encryption certificate technology can be introduced and key encryption mechanisms can be utilized to ensure the identity authentication of users accessing the information system and the security of data transmission. Furthermore, precise, dynamic, and secure authorization control of access users can be achieved by defining multiple access roles, setting authorized access times, matching devices, and verifying certificate status.

[0037] 4. The embodiments of the present invention improve the security of information systems: by adopting encryption mechanisms and digital certificate technology, the security of user identity authentication and data transmission is ensured, and information leakage and illegal access are effectively prevented.

[0038] 5. The embodiment of the present invention implements flexible access control: by defining multiple access roles and authorization management strategies, introducing automated and intelligent means to assign different roles and permissions to users according to actual needs, precise control of access users is achieved.

[0039] 6. The embodiment of the present invention enhances the system's dynamic management capabilities: it supports dynamic authorization management and can adjust access rights in real time based on user behavior, time and other factors, thereby improving the system's flexibility and dynamic response capabilities.

[0040] 7. The embodiment of the present invention improves user experience: through the matching function of the device unique identifier, it ensures that only authorized devices can access the system, avoiding the trouble of users switching between different devices, and improving user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0042] Figure 1 It is a schematic diagram of a system architecture applied in one embodiment of the present invention.

[0043] Figure 2 The figure is a flow chart of a certificate-based authorization management method in one embodiment of the present invention.

[0044] Figure 3 It is a flowchart of a certificate-based authorization management method in another embodiment of the present invention.

[0045] Figure 4 This is a flow chart of a method for authorization verification based on Redis cache in one embodiment of the present invention.

[0046] Figure 5 This is a flow chart of a method for importing an authorization certificate in one embodiment of the present invention.

[0047] Figure 6 It is a structural diagram of a certificate-based authorization management system in one embodiment of the present invention. DETAILED DESCRIPTION

[0048] The solution provided by the present invention is described below with reference to the accompanying drawings.

[0049] First, it should be noted that the terms used in the embodiments of the present invention are for the purpose of describing specific embodiments only and are not intended to limit the present invention. As used in the embodiments of the present invention and the appended claims, the singular forms "a," "the," and "the" are intended to include the plural forms, unless the context clearly indicates otherwise.

[0050] It should be understood that the term "and / or" as used herein is merely a description of the relationship between associated objects, indicating that three possible relationships exist. For example, "A and / or B" can represent: A exists alone, A and B exist simultaneously, or B exists alone. Furthermore, the character " / " in this document generally indicates that the associated objects are in an "or" relationship.

[0051] In order to facilitate understanding of the method provided by the present invention, the system architecture involved and applicable to the present invention is first described. Figure 1 As shown in , the system includes an information system and a certificate-based authorization management system.

[0052] It should be understood that Figure 1 The number of information systems and certificate-based authorization management systems is merely illustrative. Any number may be selected and deployed as needed.

[0053] Figure 2 This is a flow chart of a certificate-based authorization management method in one embodiment of the present invention. Figure 1 and Figure 2 , the method comprising:

[0054] Step 201: Generate a corresponding authorization certificate for each user's device through predefined rules and templates; wherein the authorization certificate includes at least one of the device unique identifier, authorization status, authorization duration, authorization validity period, and function permission identifier.

[0055] Step 203: When a user's access request to the information system is received, it is determined whether the authorization certificate corresponding to the user's device can be obtained from the system's cache. If so, step 205 is executed; otherwise, step 207 is executed.

[0056] Step 205: The authorization is valid, the user is allowed to access the information system, and the current process ends.

[0057] Step 207: Determine whether the authorization certificate file can be read in the entire system. If it can be read, execute step 209; otherwise, execute step 211.

[0058] Step 209: Cache the authorization certificate and execute step 205.

[0059] Step 211: Provide the user with an authorization certificate import entry.

[0060] Step 213: Import the authorization certificate provided by the user into the system.

[0061] Step 215: Verify the imported authorization certificate. If the authorization certificate is not legal, execute step 217; if the authorization certificate is legal, execute step 209.

[0062] Step 217: Deny the user access to the information system and end the current process.

[0063] See also Figure 2As shown in the process, when it is necessary to verify the authorization certificate, the processing method of the embodiment of the present invention is: first, the required authorization certificate is searched from the system cache, and if it can be found, authorization processing is performed based on the authorization certificate in the cache; next, if the required authorization certificate cannot be found from the system cache, the required authorization certificate is further obtained by reading a file in the entire system, and if it can be read, authorization processing is performed based on the read authorization certificate; next, if the required authorization certificate cannot be obtained by reading a file in the entire system, an authorization certificate import entry is provided to the user, and authorization processing is performed based on the authorization certificate imported by the user.

[0064] according to Figure 2 As can be seen from the illustrated process, in this embodiment of the present invention, an authorization certificate can be generated and issued for each user's device. Each device must verify the authorization certificate corresponding to the user's device when accessing the information system, thereby greatly improving security. Furthermore, users do not need to remember passwords, which is more convenient for users. Furthermore, the use of authorization certificates facilitates dynamic monitoring and management of user behavior, enabling them to cope with complex and changing network environments.

[0065] In various embodiments of the present invention, digital encryption certificate technology can be introduced and key encryption mechanisms can be used to ensure the identity authentication of users accessing the information system and the security of data transmission. Furthermore, precise, dynamic, and secure authorization control of access users can be achieved by defining multiple access roles, setting authorized access times, matching devices, and verifying certificate status.

[0066] The following combination Figure 2 、 Figure 3 、 Figure 4 as well as Figure 5 The process shown here illustrates the certificate-based authorization management method in various embodiments of the present invention.

[0067] First, execute step 201: generate a corresponding authorization certificate for each user's device through predefined rules and templates; wherein the authorization certificate includes at least one of the device unique identifier, authorization status, authorization duration, authorization validity period, and function permission identifier.

[0068] First, regarding step 201, in the embodiment of the present invention, the enrichment and flexibility of the authorization information are achieved. In order to meet the authorization requirements of different information systems, the authorization information can be enriched and the flexibility can be improved, which is specifically reflected in:

[0069] First, more fields can be added to the authorization certificate, such as: 1. Device code: A unique device identifier, such as a device code, can be added to the authorization certificate for binding the device. Subsequent certificate updates need to match this device code; 2. Authorization status: An authorization status can be added to the authorization certificate to mark whether the authorization status is trial or formal; 3. Authorization duration: An authorization duration can be added to the authorization certificate to declare the certificate duration; 4. Authorization start and end time: An authorization start and end time can be added to the authorization certificate to record the certificate validity period; 5. Functional permission identification: A functional permission identification can be added to the authorization certificate to distinguish the authorization scope and control system version, etc., to achieve more refined binding and control of the device. The addition of these fields makes authorization management more flexible and refined, and customized authorization settings can be made according to actual needs.

[0070] Secondly, the concept of dynamic authorization has been introduced, allowing system administrators to dynamically adjust the information in the authorization certificate based on the user's actual needs and behavior. For example, the authorization duration and permission scope can be automatically adjusted based on factors such as the user's login time and access frequency, achieving more intelligent authorization management.

[0071] Therefore, in one embodiment of the present invention, in step 201, generating a corresponding authorization certificate for each user's device includes:

[0072] For different users, different roles and permissions are assigned to different users according to actual needs. According to the role and permission assigned to each user, a corresponding authorization certificate is generated for the user's device;

[0073] and / or,

[0074] Based on user behavior and time factors, the authorization certificate generated for each user's device is adjusted in real time.

[0075] On the second aspect, for step 201, in one embodiment of the present invention, automation and intelligence of authorization management can also be achieved. In order to improve the efficiency and accuracy of authorization management, automated and intelligent technical means are introduced. First, the automatic generation and update of authorization information is realized. By configuring rules and templates, the system can automatically generate authorization certificates that meet the requirements and automatically update them when needed. This not only reduces the workload of the administrator, but also improves the accuracy and consistency of the authorization information. Secondly, big data analysis technology is used to analyze and predict user behavior to achieve intelligent authorization management. By analyzing the user's login records, access records and other data, the user's usage habits and needs can be understood, and the user's future behavior can be predicted and authorization settings can be made in advance. This intelligent authorization management method can meet the user's needs more accurately and improve the user's usage experience. Therefore, in another embodiment of the present invention, in this step 201, the process of generating a corresponding authorization certificate for each user's device may include:

[0076] Step 211: Obtaining historical behavior data of the user; wherein the behavior data includes at least one of the user's login records, access records, usage habit data, and usage demand data;

[0077] Step 2013: Analyze the user's historical behavior data using big data analysis technology and predict the user's future behavior; and

[0078] Step 2015: Generate a corresponding authorization certificate for the user's user device based on the predicted future behavior of the user.

[0079] Thirdly, in step 201, to ensure the security and credibility of the authorization certificate, an encryption algorithm may be used to encrypt and sign the certificate. Therefore, in one embodiment of the present invention, in step 201, generating a corresponding authorization certificate for each user device further includes: encrypting the generated authorization certificate using an elliptic curve cryptography algorithm (ECC); and / or digitally signing the generated authorization certificate.

[0080] As can be seen, the encryption algorithm has been upgraded, replacing the original RSA algorithm with the more secure and efficient Elliptic Curve Cryptography (ECC). The ECC algorithm has the advantages of short key length, high computational efficiency, and strong security, effectively resisting various attack methods. Secondly, digital signature technology has been introduced to sign and verify authorization certificates. This digital signature ensures that authorization certificates are not tampered with during transmission and verifies the authenticity and validity of the certificate. In addition, a secure random number generation algorithm can be used to ensure that each generated authorization certificate is unique and unpredictable.

[0081] When verification of an authorization certificate is required, the processing method of one embodiment of the present invention is as follows: first, the required authorization certificate is searched from the system cache. If the required authorization certificate can be found, authorization processing is performed based on the authorization certificate in the cache. Next, if the required authorization certificate cannot be found from the system cache, the required authorization certificate is obtained by reading a file in the entire system. If the required authorization certificate can be obtained, authorization processing is performed based on the read authorization certificate. Next, if the required authorization certificate cannot be obtained by reading a file in the entire system, an authorization certificate import entry is provided to the user, and authorization processing is performed based on the authorization certificate imported by the user. The specific process can be seen in the description of the following steps.

[0082] Next, step 203 is executed: when a user's access request to the information system is received, it is determined whether the authorization certificate corresponding to the user's device can be obtained from the system's cache. If so, step 205 is executed; otherwise, step 207 is executed.

[0083] In this embodiment of the present invention, existing legitimate authorization certificates are pre-loaded into the system's cache, such as Redis. This method optimizes the authorization verification process and time. Through caching and multi-threading, rapid verification and response to authorization certificates are achieved. When a user attempts to access a protected resource, the system can quickly complete the authorization verification and provide a corresponding response. This rapid response improves the user experience and reduces wait times.

[0084] In this step 203, if the authorization certificate corresponding to the user's device can be obtained from the system's cache, and before executing step 205, it can further include: determining whether the current time is within the authorization validity period included in the authorization certificate. If so, continue to execute the processing in step 205, that is, the authorization is valid and the user is allowed to access the information system.

[0085] Next, step 207 to step 209 are executed: determining whether the authorization certificate file can be read in the entire system; if it can be read, executing step 209; otherwise, executing step 211.

[0086] In step 209, the authorization certificate is cached so that when the user accesses the information system again in the subsequent process, the authorization certificate can be directly read from the cache, thereby speeding up the access process.

[0087] Next, step 211 is executed: providing the user with an authorization certificate import entry.

[0088] Next, step 213 is executed: importing the authorization certificate provided by the user into the system.

[0089] Here, the authorization certificate may be an encrypted certificate, and thus the imported authorization certificate may be further decrypted.

[0090] The authorization certificate may be a digitally signed certificate, and therefore the digital signature of the imported authorization certificate may be further verified.

[0091] Step 215: Verify the imported authorization certificate. If the authorization certificate is not legal, execute step 217; if the authorization certificate is legal, execute step 209.

[0092] In step 215, the process of verifying the imported authorization certificate may include:

[0093] Step 2151: Determine whether there is a historical authorization certificate corresponding to the user's device. If not, the verification fails and step 217 is executed. If so, step 2153 is executed.

[0094] Step 2153: Determine the unique device identifier (e.g., Figure 5 The device ID shown in FIG is the same as the device unique identifier included in the imported authorization certificate. If they are not the same, the verification fails and step 217 is executed; if they are the same, step 2155 is executed.

[0095] Step 2155: Verify the validity and execute the process of step 209 and step 205;

[0096] Alternatively, continue to determine whether the current time is within the authorization validity period included in the authorization certificate. If so, verify the legality and execute the process of steps 209 and 205, thereby allowing the user to access the information system. If not, the verification fails and execute step 217.

[0097] In this embodiment of the present invention, after obtaining the assigned authorization certificate, the user imports the authorization certificate on the authorization interface. During import, the user first determines whether historical authorization information exists. If not, the import fails. If historical authorization exists, the new certificate is decrypted and the information is verified to determine whether the device codes of the new and old authorization certificates match and whether the current time is within the certificate's validity period. If these conditions are met, the certificate is considered valid and the authorization information is saved to the cache. The certificate import is complete.

[0098] In an embodiment of the present invention, the import process of the authorization certificate is simplified, reducing the difficulty of user operation. The user only needs to select the import certificate file and enter the password in the authorization interface to complete the import and verification process of the authorization certificate. In addition, friendly error prompts and solutions are provided to help users quickly solve problems and successfully import certificates. Secondly, the present invention optimizes the process and time of authorization verification. Through caching technology and multi-threading technology, rapid verification and response of authorization information are achieved. When a user attempts to access a protected resource, the system can complete the authorization verification and give a corresponding response result in a short time. This fast response speed can improve the user experience and reduce waiting time.

[0099] One embodiment of the present invention also proposes a certificate-based authorization management system, see Figure 6 , the system comprises:

[0100] The authorization certificate generation module 601 is configured to generate a corresponding authorization certificate for each user's device based on predefined rules and templates; wherein the authorization certificate includes at least one of the device unique identifier, authorization status, authorization duration, authorization validity period, and function permission identifier;

[0101] A user interaction module 602 is configured to receive a user's request to access the information system;

[0102] The authorization processing module 603 is configured to determine whether the authorization certificate corresponding to the user's device can be obtained from the system's cache when the user interaction module receives a user's access request to the information system. If so, the authorization is valid and the user is allowed to access the information system; if the authorization certificate corresponding to the user's device cannot be obtained from the system's cache, then determine whether the authorization certificate can be read in the entire system. If it can be read, then cache the authorization certificate and allow the user to access the information system; if the authorization certificate cannot be read in the entire system, then provide the user with an authorization certificate import entry through the user interaction module, and import the authorization certificate provided by the user into the system through the user interaction module; verify the imported authorization certificate, and after verification of its legality, allow the user to access the information system.

[0103] In one embodiment of the system of the present invention, the authorization certificate generation module 601 is further configured to execute: encrypting the generated authorization certificate using the elliptic curve cryptography algorithm ECC; and / or digitally signing the generated authorization certificate.

[0104] In one embodiment of the system of the present invention, after importing the authorization certificate provided by the user into the system and before verifying the imported authorization certificate, the authorization processing module 603 further performs: decrypting the imported authorization certificate; and / or, verifying the digital signature of the imported authorization certificate.

[0105] In one embodiment of the system of the present invention, the authorization certificate generation module 601 is configured to perform:

[0106] Obtaining historical behavior data of the user; wherein the behavior data includes at least one of: login records, access records, usage habit data, and usage demand data of the user;

[0107] Use big data analysis technology to analyze users' historical behavior data and predict their future behavior; and

[0108] Based on the predicted future behavior of the user, a corresponding authorization certificate is generated for the user's user device.

[0109] In one embodiment of the system of the present invention, the authorization processing module 603 further performs the following steps before allowing the user to access the information system: determining whether the current time is within the authorization validity period included in the authorization certificate; if so, the authorization is valid, and the process of allowing the user to access the information system continues.

[0110] In one embodiment of the system of the present invention, the authorization processing module 603 is configured to perform:

[0111] Determine whether there is a historical authorization certificate corresponding to the user's device. If not, the verification fails. If so, determine whether the device unique identifier included in the historical authorization certificate is the same as the device unique identifier included in the imported authorization certificate. If they are not the same, the verification fails. If they are the same, the verification is legal and the imported authorization certificate is cached.

[0112] In one embodiment of the system of the present invention, the authorization certificate generation module 601 is configured to perform:

[0113] For different users, different roles and permissions are assigned to different users according to actual needs. According to the role and permission assigned to each user, a corresponding authorization certificate is generated for the user's device;

[0114] and / or,

[0115] Based on user behavior and time factors, the authorization certificate generated for each user's device is adjusted in real time.

[0116] It should be noted that the aforementioned devices are typically implemented on a server. They can be installed on separate servers, or some or all of them can be installed on the same server. The server can be a single server or a server cluster consisting of multiple servers. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a host product in a cloud computing service system. The aforementioned devices can also be implemented on a computer terminal with strong computing capabilities.

[0117] An embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed in a computer, the computer is caused to execute the method in any one of the embodiments in the specification.

[0118] An embodiment of the present invention provides a computing device, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method in any embodiment of the specification is implemented.

[0119] It should be understood that the structures illustrated in the embodiments of the present invention do not constitute specific limitations on the apparatus of the embodiments of the present invention. In other embodiments of the present invention, the apparatus may include more or fewer components than shown, or may combine or separate certain components, or arrange the components differently. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0120] The various embodiments of the present invention are described in a progressive manner. Similar portions between the various embodiments can be referred to in conjunction with each other. Each embodiment focuses on the differences between the other embodiments. In particular, the device embodiments are generally similar to the method embodiments, so their description is relatively simple. For relevant portions, refer to the description of the method embodiments.

[0121] Those skilled in the art will appreciate that in one or more of the above examples, the functions described in the present invention may be implemented using hardware, software, widgets, or any combination thereof. When implemented using software, these functions may be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.

[0122] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent replacements, improvements, etc. made on the basis of the technical solution of the present invention should be included in the scope of protection of the present invention.

Claims

1. A certificate-based authorization management method, characterized in that: The method includes: Generate a corresponding authorization certificate for each user's device using predefined rules and templates; wherein the authorization certificate includes at least one of the device's unique identifier, authorization status, authorization duration, authorization validity period, and function permission identifier; The method further includes: When receiving a user's access request to the information system, it is determined whether the authorization certificate corresponding to the user's device can be obtained from the system's cache. If so, the authorization is valid and the user is allowed to access the information system; If the authorization certificate corresponding to the user's device cannot be obtained from the system's cache, then determine whether the authorization certificate file can be read in the entire system. If it can be read, then cache the authorization certificate and allow the user to access the information system; If the authorization certificate file cannot be read in the entire system, an authorization certificate import entry is provided to the user to import the authorization certificate provided by the user into the system; Verify the imported authorization certificate. After verification, the user is allowed to access the information system. Verify the imported authorization certificate, including: Determine whether there is a historical authorization certificate corresponding to the user's device. If not, the verification fails. If so, determine whether the device unique identifier included in the historical authorization certificate is the same as the device unique identifier included in the imported authorization certificate. If they are not the same, the verification fails. If they are the same, the verification is legal and the imported authorization certificate is cached.

2. The method according to claim 1, characterized in that The step of generating a corresponding authorization certificate for each user device further includes: encrypting the generated authorization certificate using an elliptic curve encryption algorithm ECC; and / or, The generated authorization certificate is digitally signed.

3. The method according to claim 2, characterized in that After the authorization certificate provided by the user is imported into the system and before the imported authorization certificate is verified, the method further includes: decrypting the imported authorization certificate; and / or verifying the digital signature of the imported authorization certificate.

4. The method according to claim 1, wherein Generating a corresponding authorization certificate for each user device includes: Obtaining historical behavior data of the user; wherein the behavior data includes at least one of: login records, access records, usage habit data, and usage demand data of the user; Use big data analysis technology to analyze users' historical behavior data and predict their future behavior; and Based on the predicted future behavior of the user, a corresponding authorization certificate is generated for the user's user device.

5. The method according to claim 1, wherein Before allowing the user to access the information system, the method further includes: judging whether the current time is within the authorization validity period included in the authorization certificate; if so, the authorization is valid, and continuing to allow the user to access the information system.

6. The method according to any one of claims 1 to 5, characterized in that Generating a corresponding authorization certificate for each user's device includes: For different users, different roles and permissions are assigned to different users according to actual needs. According to the role and permission assigned to each user, a corresponding authorization certificate is generated for the user's device; and / or, Based on user behavior and time factors, the authorization certificate generated for each user's device is adjusted in real time.

7. Certificate-based authorization management system, characterized in that: The system includes: An authorization certificate generation module is configured to generate a corresponding authorization certificate for each user's device based on predefined rules and templates; wherein the authorization certificate includes at least one of a device unique identifier, authorization status, authorization duration, authorization validity period, and function permission identifier; A user interaction module configured to receive a user's access request to the information system; The authorization processing module is configured to, when the user interaction module receives a user's access request to the information system, determine whether the authorization certificate corresponding to the user's device can be obtained from the system's cache; if so, the authorization is valid and the user is allowed to access the information system; if the authorization certificate corresponding to the user's device cannot be obtained from the system's cache, determine whether the authorization certificate can be read in the entire system; if so, cache the authorization certificate and allow the user to access the information system; if the authorization certificate cannot be read in the entire system, provide the user with an authorization certificate import entry through the user interaction module, and import the authorization certificate provided by the user into the system through the user interaction module; Verify the imported authorization certificate. After verification, the user is allowed to access the information system. Verify the imported authorization certificate, including: Determine whether there is a historical authorization certificate corresponding to the user's device. If not, the verification fails. If so, determine whether the device unique identifier included in the historical authorization certificate is the same as the device unique identifier included in the imported authorization certificate. If they are not the same, the verification fails. If they are the same, the verification is legal and the imported authorization certificate is cached.

8. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 6.

9. A computing device comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method according to any one of claims 1 to 6 is implemented.

Images