A method and system for unified management of multi-system users

Abstract

The present invention provides a method and system for unified management of users of multiple systems in the field of business system management technology. The method comprises: step S1, issuing a token after authenticating authentication information; step S2, matching personal information, department information, and all business field information from a database based on authentication information and displaying through a user interface; step S3, matching a jump address of a business system and an interface address of a business item based on a selection signal of the business field information; step S4, extracting statistical data and agent data of each business item through the interface address, associating them with the corresponding jump address, and displaying the statistical data and agent data through a user interface; step S5, the user interface jumps to the corresponding business system based on a click signal of the statistical data or agent data and automatically logs in through a token. The advantages of the present invention are: realizing unified management of users of multiple business systems, and greatly improving user work efficiency, data value, security, and resource utilization.

Description

Technical Field

[0001] The present invention relates to the technical field of business system management, and in particular to a method and system for unified management of multi-system users. Background Art

[0002] In the existing multi-system environment, for example, an enterprise may have business systems such as accounting system, purchase management system, inventory management system, financial management system, customer relationship management system, project management system, order management system, human resource management system, etc. Users often need to switch between multiple business systems to complete their work. Traditionally, each business system has an independent login interface, user interface and data management mechanism, resulting in the following disadvantages:

[0003] 1. Inefficiency: Users need to remember the login credentials of multiple business systems and frequently switch between different business systems, which not only increases the user's operational burden but also reduces work efficiency.

[0004] 2. Data island problem: Due to the lack of effective data sharing mechanism between business systems, the phenomenon of information island is serious, resulting in the inability to fully utilize data resources, affecting the accuracy and timeliness of decision-making.

[0005] 3. Security risks: In a multi-system environment, user data is stored in different business systems in a dispersed manner, increasing the risk of data leakage and abuse.

[0006] 4. High maintenance cost: Multiple business systems need to be maintained separately, which increases the workload of the IT support team and the maintenance cost of the business systems.

[0007] Therefore, how to provide a unified management method and system for users of multiple systems to achieve unified management of users of multiple business systems and improve user work efficiency, data value, security and resource utilization has become a technical problem that needs to be solved urgently. Summary of the invention

[0008] The technical problem to be solved by the present invention is to provide a method and system for unified management of users of multiple systems, so as to realize unified management of users of multiple business systems and improve user work efficiency, data value, security and resource utilization.

[0009] In a first aspect, the present invention provides a method for unified management of multi-system users, comprising the following steps:

[0010] Step S1, the authentication server obtains the input authentication information, authenticates the authentication information, performs authentication risk assessment during the authentication process, and issues a token through a security protocol after the authentication is completed;

[0011] Step S2: matching the user's personal information, department information and all business field information from a preset database based on the authentication information, and displaying the personal information, department information and a field information list including each business field information through a user interface;

[0012] Step S3, based on the selection signal of the field information list, matching the jump address of the business system corresponding to each selected business field information and the interface address of the business item that the business system is responsible for;

[0013] Step S4, extracting and synchronizing statistical data and agent data of each business item in real time through the interface address, associating the statistical data and agent data with the corresponding jump address, and displaying the statistical data and agent data through the user interface;

[0014] Step S5, the user interface jumps to the corresponding business system based on the click signal of the statistical data or the agency data, and the jumped business system is automatically logged in through the token;

[0015] Step S6: The business system obtains the input operation instruction and performs the corresponding operation based on the operation instruction;

[0016] The step S1 is specifically as follows:

[0017] The authentication server obtains the input authentication information carrying the account password, user unique identifier, timestamp, device ID, hash value and signature data; the hash value is obtained by performing hash calculation on the account password, user unique identifier, timestamp and device ID; the signature data is obtained by signing the hash value with a private key, and the authentication server stores a public key matching the private key;

[0018] The authentication server parses the authentication information to obtain the account password, user unique identifier, timestamp, device ID, hash value and signature data. After verifying the signature data with the public key, the account password, user unique identifier, timestamp and device ID are checked for integrity with the hash value, and then the timestamp is checked for timeliness. The device ID is checked for legitimacy with the preset device management table, and the account password is checked for correctness with the preset user management table. After the verification passes, the mobile phone number is matched from the user management table with the user unique identifier, a verification code is sent to the mobile phone number, the verification code input rule is displayed through the authentication interface, and the characters entered in the authentication interface are verified based on the verification code input rule;

[0019] During the authentication process, at least the authentication time, authentication duration, authentication IP address, and authentication behavior of the network environment are recorded in real time. Based on historical authentication behaviors and big data analysis technology, authentication risk assessment is performed to generate a risk assessment report. When the risk assessment report indicates that there is a high-risk authentication situation, a new authentication step is added;

[0020] After the authentication is completed, a token for logging into each business system is issued through the security protocol of HTTPS, TCP, TLS or SSL.

[0021] Furthermore, the step S2 is specifically as follows:

[0022] Based on the user's unique identifier carried in the authentication information, the user's personal data encrypted by the SM4 algorithm and the 3DES algorithm is matched from a preset database, the personal data is decrypted by the SM4 algorithm and the 3DES algorithm to obtain the personal information, department information and all business field information, and the desensitized personal information, department information and a list of field information containing information on each business field are displayed through a user interface. After verifying a preset number of desensitized data through the user interface, the complete list of personal information, department information and field information containing information on each business field is displayed.

[0023] Furthermore, in step S3, the business items at least include to-do items, item statistics, and message notifications.

[0024] Furthermore, the step S4 is specifically as follows:

[0025] The statistical data and agent data of each business item are extracted and synchronized in real time based on the interface address through the ETL tool, the statistical data and agent data are cached in real time in the memory, the statistical data and agent data are associated with the corresponding jump address, and the statistical data and agent data are displayed through the user interface.

[0026] Furthermore, the step S6 is specifically as follows:

[0027] The business system obtains the input operation instruction and performs the corresponding operation based on the operation instruction. When the operation lacks relevant business data, the corresponding business data is obtained from the remaining business systems through the API service and the operation instruction is continued to be executed.

[0028] In a second aspect, the present invention provides a multi-system user unified management system, including the following modules:

[0029] The security authentication module is used for the authentication server to obtain the input authentication information, authenticate the authentication information, conduct authentication risk assessment during the authentication process, and issue a token through a security protocol after the authentication is completed;

[0030] A personal data matching module, used to match the user's personal information, department information and all business field information from a preset database based on the authentication information, and display the personal information, department information and a field information list containing information of each business field through a user interface;

[0031] An address matching module, for matching the jump address of the business system corresponding to each selected business domain information and the interface address of the business item that the business system is responsible for based on the selection signal of the domain information list;

[0032] An extraction data display module is used to extract and synchronize the statistical data and agent data of each business item in real time through the interface address, associate the statistical data and agent data with the corresponding jump address, and display the statistical data and agent data through the user interface;

[0033] A business system jump module, which is used for the user interface to jump to the corresponding business system based on the click signal of statistical data or agency data, and automatically log in to the jumped business system through the token;

[0034] An operation instruction execution module is used for the business system to obtain input operation instructions and execute corresponding operations based on the operation instructions;

[0035] The security authentication module is specifically used for:

[0036] The authentication server obtains the input authentication information carrying the account password, user unique identifier, timestamp, device ID, hash value and signature data; the hash value is obtained by performing hash calculation on the account password, user unique identifier, timestamp and device ID; the signature data is obtained by signing the hash value with a private key, and the authentication server stores a public key matching the private key;

[0037] The authentication server parses the authentication information to obtain the account password, user unique identifier, timestamp, device ID, hash value and signature data. After verifying the signature data with the public key, the account password, user unique identifier, timestamp and device ID are checked for integrity with the hash value, and then the timestamp is checked for timeliness. The device ID is checked for legitimacy with the preset device management table, and the account password is checked for correctness with the preset user management table. After the verification passes, the mobile phone number is matched from the user management table with the user unique identifier, a verification code is sent to the mobile phone number, the verification code input rule is displayed through the authentication interface, and the characters entered in the authentication interface are verified based on the verification code input rule;

[0038] During the authentication process, at least the authentication time, authentication duration, authentication IP address, and authentication behavior of the network environment are recorded in real time. Based on historical authentication behaviors and big data analysis technology, authentication risk assessment is performed to generate a risk assessment report. When the risk assessment report indicates that there is a high-risk authentication situation, a new authentication step is added;

[0039] After the authentication is completed, a token for logging into each business system is issued through the security protocol of HTTPS, TCP, TLS or SSL.

[0040] Furthermore, the personal data matching module is specifically used to:

[0041] Based on the user's unique identifier carried in the authentication information, the user's personal data encrypted by the SM4 algorithm and the 3DES algorithm is matched from a preset database, the personal data is decrypted by the SM4 algorithm and the 3DES algorithm to obtain the personal information, department information and all business field information, and the desensitized personal information, department information and a list of field information containing information on each business field are displayed through a user interface. After verifying a preset number of desensitized data through the user interface, the complete list of personal information, department information and field information containing information on each business field is displayed.

[0042] Furthermore, in the address matching module, the business items at least include to-do items, item statistics and message notifications.

[0043] Furthermore, the extracted data display module is specifically used for:

[0044] The statistical data and agent data of each business item are extracted and synchronized in real time based on the interface address through the ETL tool, the statistical data and agent data are cached in real time in the memory, the statistical data and agent data are associated with the corresponding jump address, and the statistical data and agent data are displayed through the user interface.

[0045] Furthermore, the operation instruction execution module is specifically used for:

[0046] The business system obtains the input operation instruction and performs the corresponding operation based on the operation instruction. When the operation lacks relevant business data, the corresponding business data is obtained from the remaining business systems through the API service and the operation instruction is continued to be executed.

[0047] The advantages of the present invention are:

[0048] 1. Obtain the input authentication information through the authentication server, authenticate the authentication information, conduct authentication risk assessment during the authentication process, and issue a token through the security protocol after the authentication is completed; then match the user's personal information, department information and all business field information from the preset database based on the authentication information, display the personal information, department information and the field information list containing each business field information through the user interface, and match the jump address of the business system corresponding to the selected business field information and the interface address of the business items that the business system is responsible for based on the selection signal of the field information list, extract and synchronize the statistical data and agency data of each business item in real time through the interface address, associate the statistical data and agency data with the corresponding jump address, and display the statistical data and agency data through the user interface, and then the user interface jumps to the corresponding business system based on the click signal of the statistical data or agency data, and automatically logs in to the jumped business system through the token, and finally the business system obtains the input operation instruction to perform the corresponding operation; that is, through a unified user The interface manages users of different business systems in a unified manner, and the token obtained through authentication automatically logs in to each business system. There is no need to remember login credentials for multiple business systems as traditionally, and to frequently switch between different business systems. When a business system lacks relevant business data to execute an operation instruction, it obtains the corresponding business data from the remaining business systems through the API service and continues to execute the operation instruction, showing the business data sharing between business systems to avoid the problem of data islands. The user's personal data is stored in a unified database, and the personal data is doubly encrypted by the SM4 algorithm and the 3DES algorithm, combined with multiple authentications of authentication information, effectively reducing the risk of data leakage and abuse. Users of multiple business systems are managed in a unified manner through a unified user interface and database, avoiding repeated development of the same functions, so as to reduce the workload of the IT support team and the maintenance cost of the business system, and ultimately achieving unified management of users of multiple business systems, and greatly improving user work efficiency, data value, security and resource utilization.

[0049] 2. By setting the authentication information to carry the account password, user unique identifier, timestamp, device ID, hash value and signature data, the signature data can be used for signature verification, the hash value for integrity verification, the timestamp for timeliness verification, and the account password and device ID for legitimacy verification. At least 5 security measures (account password, timestamp, device ID, hash value, signature data) are taken before and after, which greatly improves the reliability of authentication.

[0050] 3. Match the mobile phone number from the user management table through the user's unique identifier, send a verification code to the mobile phone number, display the verification code input rules through the authentication interface, and verify the characters entered on the authentication interface based on the verification code input rules. For example, if the verification code input rules are set to move the last two characters to the front, and the verification code sent is 141528, the characters entered must be 281415 for the verification to pass. This can ensure that it is a real person operating at this time, avoid AI directly obtaining the verification code for input, and further improve the reliability of authentication.

[0051] 4. By recording in real time during the authentication process at least the authentication time, authentication duration, authentication IP address, and authentication behavior of the network environment, authentication risk assessment is performed based on historical authentication behavior and big data analysis technology, and a risk assessment report is generated. When the risk assessment report shows that there is a high-risk authentication situation, a new authentication step is added, that is, big data analysis technology is combined to identify risks from authentication behavior, thereby further improving the reliability of authentication.

[0052] 5. After the authentication is completed, the token used to log in to each business system is issued through the security protocol of HTTPS, TCP, TLS or SSL, which greatly improves the security of token transmission.

[0053] 6. Display desensitized personal information, department information, and a list of field information containing information on various business fields through the user interface. After verifying a preset number of desensitized data through the user interface, display the complete personal information, department information, and a list of field information containing information on various business fields. For example, desensitize several digits in the ID card in the personal information. Only after the digits in the desensitized position are correctly entered, the complete personal information, department information, and a list of field information containing information on various business fields are displayed, thereby preventing illegal users from operating and further improving security.

[0054] 7. Use ETL tools to extract and synchronize statistical data and agency data of each business item in real time based on the interface address, cache the statistical data and agency data in real time into the memory, associate the statistical data and agency data with the corresponding jump address, and display the statistical data and agency data through the user interface. That is, the real-time extraction of the ETL tool combined with the memory cache greatly improves the timeliness of the display of statistical data and agency data.

[0055] 8. When an operation lacks relevant business data, the corresponding business data is obtained from other business systems through API services and the operation instructions are continued to be executed. That is, each business system shares data through API services to avoid the emergence of data islands and effectively improve the value of data utilization. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] The present invention will be further described below in conjunction with embodiments with reference to the accompanying drawings.

[0057] Figure 1 The present invention is a flowchart of a method for unified management of multiple system users.

[0058] Figure 2 It is a structural schematic diagram of a multi-system user unified management system of the present invention. DETAILED DESCRIPTION

[0059] The technical solution in the embodiments of the present application has the following overall idea: users of different business systems are uniformly managed through a unified user interface, and the token obtained through authentication is used to automatically log in to each business system, without the need to remember login credentials for multiple business systems as traditionally, and frequently switch between different business systems; when a business system lacks relevant business data to execute an operation instruction, the corresponding business data is obtained from the remaining business systems through the API service and the operation instruction is continued to be executed, showing the business data sharing between business systems to avoid the problem of data islands; the user's personal data is uniformly stored in a database, and the personal data is doubly encrypted by the SM4 algorithm and the 3DES algorithm, combined with multiple authentications of authentication information, effectively reducing the risk of data leakage and abuse; users of multiple business systems are uniformly managed through a unified user interface and database to avoid repeated development of the same functions, so as to reduce the workload of the IT support team and the maintenance cost of the business system, and ultimately achieve unified management of users of multiple business systems, and improve user work efficiency, data value, security and resource utilization.

[0060] Please refer to Figure 1 to Figure 2 As shown, a preferred embodiment of a method for unified management of multiple system users of the present invention comprises the following steps:

[0061] Step S1, the authentication server obtains the input authentication information, authenticates the authentication information, performs authentication risk assessment during the authentication process, and issues a token through a security protocol after the authentication is completed; the authentication server is used to process various authentication requests and verification logic;

[0062] Step S2: matching the user's personal information, department information and all business field information from a preset database based on the authentication information, and displaying the personal information, department information and a field information list including each business field information through a user interface;

[0063] Step S3, based on the selection signal of the field information list, matching the jump address of the business system corresponding to each selected business field information and the interface address of the business item that the business system is responsible for;

[0064] Step S4, extracting and synchronizing statistical data and agent data of each business item in real time through the interface address, associating the statistical data and agent data with the corresponding jump address, and displaying the statistical data and agent data through the user interface;

[0065] Step S5, the user interface jumps to the corresponding business system based on the click signal of the statistical data or the agency data, and the token is used to automatically log in to the jumped business system, that is, to realize the single sign-on function;

[0066] Step S6: The business system obtains the input operation instruction and performs the corresponding operation based on the operation instruction;

[0067] Obtain statistical data and pending data of business matters of each business system through a unified user interface, and jump to the corresponding business system in real time to process business data or business tasks, so that users can manage data and tasks of multiple business systems in one user interface, optimize data management, simplify the operation process of users of multiple systems, improve the data acquisition efficiency of users of multiple systems, reduce security risks, and reduce maintenance costs, thereby greatly improving the user experience.

[0068] The step S1 is specifically as follows:

[0069] The authentication server obtains the input authentication information carrying the account password, user unique identifier, timestamp, device ID, hash value and signature data; the hash value is obtained by performing hash calculation on the account password, user unique identifier, timestamp and device ID; the signature data is obtained by signing the hash value with a private key, and the authentication server stores a public key matching the private key;

[0070] By setting the authentication information to carry the account password, user unique identifier, timestamp, device ID, hash value and signature data, the signature data can be used for signature verification, the hash value for integrity verification, the timestamp for timeliness verification, and the account password and device ID for legitimacy verification. At least 5 security measures (account password, timestamp, device ID, hash value, signature data) are taken before and after, which greatly improves the reliability of authentication.

[0071] The authentication server parses the authentication information to obtain the account password, user unique identifier, timestamp, device ID, hash value and signature data. After verifying the signature data with the public key, the account password, user unique identifier, timestamp and device ID are checked for integrity with the hash value, and then the timestamp is checked for timeliness. The device ID is checked for legitimacy with the preset device management table, and the account password is checked for correctness with the preset user management table. After the verification passes, the mobile phone number is matched from the user management table with the user unique identifier, a verification code is sent to the mobile phone number, the verification code input rule is displayed through the authentication interface, and the characters entered in the authentication interface are verified based on the verification code input rule;

[0072] The mobile phone number is matched from the user management table through the user's unique identifier, a verification code is sent to the mobile phone number, the verification code input rules are displayed through the authentication interface, and the characters entered on the authentication interface are verified based on the verification code input rules. For example, the verification code input rules are set to move the last two characters to the front, and the verification code sent is 141528, then the input characters need to be 281415 for the verification to pass. This can ensure that it is a real person operating at this time, avoid AI directly obtaining the verification code for input, and further improve the reliability of authentication.

[0073] During the authentication process, at least the authentication time, authentication duration, authentication IP address, and authentication behavior of the network environment are recorded in real time. Based on historical authentication behaviors and big data analysis technology, authentication risk assessment is performed on the authentication behavior, and a risk assessment report is generated. When the risk assessment report indicates that there is a high-risk authentication situation, a new authentication step is added;

[0074] By recording in real time during the authentication process at least the authentication time, authentication duration, authentication IP address, and network environment of the authentication behavior, performing authentication risk assessment based on historical authentication behavior and big data analysis technology, and generating a risk assessment report, when the risk assessment report shows that there is a high-risk authentication situation, adding a new authentication step, that is, combining big data analysis technology to identify risks from authentication behavior, further improving the reliability of authentication.

[0075] After the authentication is completed, a token for logging into each business system is issued through the security protocol of HTTPS, TCP, TLS or SSL.

[0076] After the authentication is completed, the token used to log in to each business system is issued through the security protocol of HTTPS, TCP, TLS or SSL, which greatly improves the security of token transmission.

[0077] The step S2 is specifically as follows:

[0078] Based on the user's unique identifier carried in the authentication information, the user's personal data encrypted by the SM4 algorithm and the 3DES algorithm is matched from a preset database, the personal data is decrypted by the SM4 algorithm and the 3DES algorithm to obtain the personal information, department information and all business field information, and the desensitized personal information, department information and a list of field information containing information on each business field are displayed through a user interface. After verifying a preset number of desensitized data through the user interface, the complete list of personal information, department information and field information containing information on each business field is displayed.

[0079] The desensitized personal information, department information, and a list of field information containing information on various business fields are displayed through the user interface. After verifying a preset number of desensitized data through the user interface, the complete personal information, department information, and a list of field information containing information on various business fields are displayed. For example, several digits in the ID card in the personal information are desensitized. Only after the digits in the desensitized position are correctly entered, the complete personal information, department information, and a list of field information containing information on various business fields are displayed, thereby preventing illegal users from operating and further improving security.

[0080] In step S3, the business items at least include to-do items, task statistics and message notifications.

[0081] The step S4 is specifically as follows:

[0082] The statistical data and agent data of each business item are extracted and synchronized in real time based on the interface address through the ETL tool, the statistical data and agent data are cached in real time in the memory, the statistical data and agent data are associated with the corresponding jump address, and the statistical data and agent data are displayed through the user interface.

[0083] Through the ETL tool, the statistical data and agency data of each business item are extracted and synchronized in real time based on the interface address, the statistical data and agency data are cached in real time in the memory, the statistical data and agency data are associated with the corresponding jump address, and the statistical data and agency data are displayed through the user interface. That is, the real-time extraction of the ETL tool is combined with the memory cache, which greatly improves the timeliness of the display of statistical data and agency data.

[0084] The step S6 is specifically as follows:

[0085] The business system obtains the input operation instruction and performs the corresponding operation based on the operation instruction. When the operation lacks relevant business data, the corresponding business data is obtained from the remaining business systems through the API service and the operation instruction is continued to be executed.

[0086] When an operation lacks relevant business data, the corresponding business data is obtained from other business systems through API services and the operation instructions are continued to be executed. That is, each business system shares data through API services to avoid the emergence of data islands and effectively improve the value of data utilization.

[0087] A preferred embodiment of a multi-system user unified management system of the present invention includes the following modules:

[0088] The security authentication module is used for the authentication server to obtain the input authentication information, authenticate the authentication information, conduct authentication risk assessment during the authentication process, and issue a token through a security protocol after the authentication is completed; the authentication server is used to process various authentication requests and verification logic;

[0089] A personal data matching module, used to match the user's personal information, department information and all business field information from a preset database based on the authentication information, and display the personal information, department information and a field information list containing information of each business field through a user interface;

[0090] An address matching module, for matching the jump address of the business system corresponding to each selected business domain information and the interface address of the business item that the business system is responsible for based on the selection signal of the domain information list;

[0091] An extraction data display module is used to extract and synchronize the statistical data and agent data of each business item in real time through the interface address, associate the statistical data and agent data with the corresponding jump address, and display the statistical data and agent data through the user interface;

[0092] A business system jump module, which is used for the user interface to jump to the corresponding business system based on the click signal of statistical data or agency data, and automatically log in to the jumped business system through the token, that is, to realize the single sign-on function;

[0093] An operation instruction execution module is used for the business system to obtain input operation instructions and execute corresponding operations based on the operation instructions;

[0094] Obtain statistical data and pending data of business matters of each business system through a unified user interface, and jump to the corresponding business system in real time to process business data or business tasks, so that users can manage data and tasks of multiple business systems in one user interface, optimize data management, simplify the operation process of users of multiple systems, improve the data acquisition efficiency of users of multiple systems, reduce security risks, and reduce maintenance costs, thereby greatly improving the user experience.

[0095] The security authentication module is specifically used for:

[0096] The authentication server obtains the input authentication information carrying the account password, user unique identifier, timestamp, device ID, hash value and signature data; the hash value is obtained by performing hash calculation on the account password, user unique identifier, timestamp and device ID; the signature data is obtained by signing the hash value with a private key, and the authentication server stores a public key matching the private key;

[0097] By setting the authentication information to carry the account password, user unique identifier, timestamp, device ID, hash value and signature data, the signature data can be used for signature verification, the hash value for integrity verification, the timestamp for timeliness verification, and the account password and device ID for legitimacy verification. At least 5 security measures (account password, timestamp, device ID, hash value, signature data) are taken before and after, which greatly improves the reliability of authentication.

[0098] The authentication server parses the authentication information to obtain the account password, user unique identifier, timestamp, device ID, hash value and signature data. After verifying the signature data with the public key, the account password, user unique identifier, timestamp and device ID are checked for integrity with the hash value, and then the timestamp is checked for timeliness. The device ID is checked for legitimacy with the preset device management table, and the account password is checked for correctness with the preset user management table. After the verification passes, the mobile phone number is matched from the user management table with the user unique identifier, a verification code is sent to the mobile phone number, the verification code input rule is displayed through the authentication interface, and the characters entered in the authentication interface are verified based on the verification code input rule;

[0099] The mobile phone number is matched from the user management table through the user's unique identifier, a verification code is sent to the mobile phone number, the verification code input rules are displayed through the authentication interface, and the characters entered on the authentication interface are verified based on the verification code input rules. For example, the verification code input rules are set to move the last two characters to the front, and the verification code sent is 141528, then the input characters need to be 281415 for the verification to pass. This can ensure that it is a real person operating at this time, avoid AI directly obtaining the verification code for input, and further improve the reliability of authentication.

[0100] During the authentication process, at least the authentication time, authentication duration, authentication IP address, and authentication behavior of the network environment are recorded in real time. Based on historical authentication behaviors and big data analysis technology, authentication risk assessment is performed on the authentication behavior, and a risk assessment report is generated. When the risk assessment report indicates that there is a high-risk authentication situation, a new authentication step is added;

[0101] By recording in real time during the authentication process at least the authentication time, authentication duration, authentication IP address, and network environment of the authentication behavior, performing authentication risk assessment based on historical authentication behavior and big data analysis technology, and generating a risk assessment report, when the risk assessment report shows that there is a high-risk authentication situation, adding a new authentication step, that is, combining big data analysis technology to identify risks from authentication behavior, further improving the reliability of authentication.

[0102] After the authentication is completed, a token for logging into each business system is issued through the security protocol of HTTPS, TCP, TLS or SSL.

[0103] After the authentication is completed, the token used to log in to each business system is issued through the security protocol of HTTPS, TCP, TLS or SSL, which greatly improves the security of token transmission.

[0104] The personal data matching module is specifically used for:

[0105] Based on the user's unique identifier carried in the authentication information, the user's personal data encrypted by the SM4 algorithm and the 3DES algorithm is matched from a preset database, the personal data is decrypted by the SM4 algorithm and the 3DES algorithm to obtain the personal information, department information and all business field information, and the desensitized personal information, department information and a list of field information containing information on each business field are displayed through a user interface. After verifying a preset number of desensitized data through the user interface, the complete list of personal information, department information and field information containing information on each business field is displayed.

[0106] The desensitized personal information, department information, and a list of field information containing information on various business fields are displayed through the user interface. After verifying a preset number of desensitized data through the user interface, the complete personal information, department information, and a list of field information containing information on various business fields are displayed. For example, several digits in the ID card in the personal information are desensitized. Only after the digits in the desensitized position are correctly entered, the complete personal information, department information, and a list of field information containing information on various business fields are displayed, thereby preventing illegal users from operating and further improving security.

[0107] In the address matching module, the business items at least include to-do items, item statistics and message notifications.

[0108] The extracted data display module is specifically used for:

[0109] The statistical data and agent data of each business item are extracted and synchronized in real time based on the interface address through the ETL tool, the statistical data and agent data are cached in real time in the memory, the statistical data and agent data are associated with the corresponding jump address, and the statistical data and agent data are displayed through the user interface.

[0110] Through the ETL tool, the statistical data and agency data of each business item are extracted and synchronized in real time based on the interface address, the statistical data and agency data are cached in real time in the memory, the statistical data and agency data are associated with the corresponding jump address, and the statistical data and agency data are displayed through the user interface. That is, the real-time extraction of the ETL tool is combined with the memory cache, which greatly improves the timeliness of the display of statistical data and agency data.

[0111] The operation instruction execution module is specifically used for:

[0112] The business system obtains the input operation instruction and performs the corresponding operation based on the operation instruction. When the operation lacks relevant business data, the corresponding business data is obtained from the remaining business systems through the API service and the operation instruction is continued to be executed.

[0113] When an operation lacks relevant business data, the corresponding business data is obtained from other business systems through API services and the operation instructions are continued to be executed. That is, each business system shares data through API services to avoid the emergence of data islands and effectively improve the value of data utilization.

[0114] In summary, the advantages of the present invention are:

[0115] 1. Obtain the input authentication information through the authentication server, authenticate the authentication information, conduct authentication risk assessment during the authentication process, and issue a token through the security protocol after the authentication is completed; then match the user's personal information, department information and all business field information from the preset database based on the authentication information, display the personal information, department information and the field information list containing each business field information through the user interface, and match the jump address of the business system corresponding to the selected business field information and the interface address of the business items that the business system is responsible for based on the selection signal of the field information list, extract and synchronize the statistical data and agency data of each business item in real time through the interface address, associate the statistical data and agency data with the corresponding jump address, and display the statistical data and agency data through the user interface, and then the user interface jumps to the corresponding business system based on the click signal of the statistical data or agency data, and automatically logs in to the jumped business system through the token, and finally the business system obtains the input operation instruction to perform the corresponding operation; that is, through a unified user The interface manages users of different business systems in a unified manner, and the token obtained through authentication automatically logs in to each business system. There is no need to remember login credentials for multiple business systems as traditionally, and to frequently switch between different business systems. When a business system lacks relevant business data to execute an operation instruction, it obtains the corresponding business data from the remaining business systems through the API service and continues to execute the operation instruction, showing the business data sharing between business systems to avoid the problem of data islands. The user's personal data is stored in a unified database, and the personal data is doubly encrypted by the SM4 algorithm and the 3DES algorithm, combined with multiple authentications of authentication information, effectively reducing the risk of data leakage and abuse. Users of multiple business systems are managed in a unified manner through a unified user interface and database, avoiding repeated development of the same functions, so as to reduce the workload of the IT support team and the maintenance cost of the business system, and ultimately achieving unified management of users of multiple business systems, and greatly improving user work efficiency, data value, security and resource utilization.

[0116] 2. By setting the authentication information to carry the account password, user unique identifier, timestamp, device ID, hash value and signature data, the signature data can be used for signature verification, the hash value for integrity verification, the timestamp for timeliness verification, and the account password and device ID for legitimacy verification. At least 5 security measures (account password, timestamp, device ID, hash value, signature data) are taken before and after, which greatly improves the reliability of authentication.

[0117] 3. Match the mobile phone number from the user management table through the user's unique identifier, send a verification code to the mobile phone number, display the verification code input rules through the authentication interface, and verify the characters entered on the authentication interface based on the verification code input rules. For example, if the verification code input rules are set to move the last two characters to the front, and the verification code sent is 141528, the characters entered must be 281415 for the verification to pass. This can ensure that it is a real person operating at this time, avoid AI directly obtaining the verification code for input, and further improve the reliability of authentication.

[0118] 4. By recording in real time during the authentication process at least the authentication time, authentication duration, authentication IP address, and authentication behavior of the network environment, authentication risk assessment is performed based on historical authentication behavior and big data analysis technology, and a risk assessment report is generated. When the risk assessment report shows that there is a high-risk authentication situation, a new authentication step is added, that is, big data analysis technology is combined to identify risks from authentication behavior, thereby further improving the reliability of authentication.

[0119] 5. After the authentication is completed, the token used to log in to each business system is issued through the security protocol of HTTPS, TCP, TLS or SSL, which greatly improves the security of token transmission.

[0120] 6. Display desensitized personal information, department information, and a list of field information containing information on various business fields through the user interface. After verifying a preset number of desensitized data through the user interface, display the complete personal information, department information, and a list of field information containing information on various business fields. For example, desensitize several digits in the ID card in the personal information. Only after the digits in the desensitized position are correctly entered, the complete personal information, department information, and a list of field information containing information on various business fields are displayed, thereby preventing illegal users from operating and further improving security.

[0121] 7. Use ETL tools to extract and synchronize statistical data and agency data of each business item in real time based on the interface address, cache the statistical data and agency data in real time into the memory, associate the statistical data and agency data with the corresponding jump address, and display the statistical data and agency data through the user interface. That is, the real-time extraction of the ETL tool combined with the memory cache greatly improves the timeliness of the display of statistical data and agency data.

[0122] 8. When an operation lacks relevant business data, the corresponding business data is obtained from other business systems through API services and the operation instructions are continued to be executed. That is, each business system shares data through API services to avoid the emergence of data islands and effectively improve the value of data utilization.

[0123] Although the specific implementation modes of the present invention are described above, those skilled in the art should understand that the specific implementation modes described are only illustrative and are not intended to limit the scope of the present invention. Equivalent modifications and changes made by those skilled in the art in accordance with the spirit of the present invention should be included in the scope of protection of the claims of the present invention.

Claims

1. A method for unified management of multi-system users, characterized by: The steps include: Step S1, the authentication server obtains the input authentication information, authenticates the authentication information, performs authentication risk assessment during the authentication process, and issues a token through a security protocol after the authentication is completed; Step S2: matching the user's personal information, department information and all business field information from a preset database based on the authentication information, and displaying the personal information, department information and a field information list including each business field information through a user interface; Step S3, based on the selection signal of the field information list, matching the jump address of the business system corresponding to each selected business field information and the interface address of the business item that the business system is responsible for; Step S4, extracting and synchronizing the statistical data and pending data of each business item in real time through the interface address, associating the statistical data and pending data with the corresponding jump address, and displaying the statistical data and pending data through the user interface; Step S5, the user interface jumps to the corresponding business system based on the click signal of the statistical data or the to-do data, and the jumped business system is automatically logged in through the token; Step S6: The business system obtains the input operation instruction and performs the corresponding operation based on the operation instruction; The step S1 is specifically as follows: The authentication server obtains the input authentication information carrying the account password, user unique identifier, timestamp, device ID, hash value and signature data; the hash value is obtained by performing hash calculation on the account password, user unique identifier, timestamp and device ID; the signature data is obtained by signing the hash value with a private key, and the authentication server stores a public key matching the private key; The authentication server parses the authentication information to obtain the account password, user unique identifier, timestamp, device ID, hash value and signature data. After verifying the signature data with the public key, the account password, user unique identifier, timestamp and device ID are checked for integrity with the hash value, and then the timestamp is checked for timeliness. The device ID is checked for legitimacy with the preset device management table, and the account password is checked for correctness with the preset user management table. After the verification passes, the mobile phone number is matched from the user management table with the user unique identifier, a verification code is sent to the mobile phone number, the verification code input rule is displayed through the authentication interface, and the characters entered in the authentication interface are verified based on the verification code input rule; During the authentication process, at least the authentication time, authentication duration, authentication IP address, and authentication behavior of the network environment are recorded in real time. Based on historical authentication behaviors and big data analysis technology, authentication risk assessment is performed to generate a risk assessment report. When the risk assessment report indicates that there is a high-risk authentication situation, a new authentication step is added; After the authentication is completed, a token for logging into each business system is issued through the security protocol of HTTPS, TCP, TLS or SSL.

2. A method for unified management of multiple system users as claimed in claim 1, characterized in that: The step S2 is specifically as follows: Based on the user's unique identifier carried in the authentication information, the user's personal data encrypted by the SM4 algorithm and the 3DES algorithm is matched from a preset database, the personal data is decrypted by the SM4 algorithm and the 3DES algorithm to obtain the personal information, department information and all business field information, and the desensitized personal information, department information and a list of field information containing information on each business field are displayed through a user interface. After verifying a preset number of desensitized data through the user interface, the complete list of personal information, department information and field information containing information on each business field is displayed.

3. A method for unified management of multiple system users as claimed in claim 1, characterized in that: In step S3, the business items at least include to-do items, task statistics and message notifications.

4. A method for unified management of multiple system users as claimed in claim 1, characterized in that: The step S4 is specifically as follows: The statistical data and pending data of each business item are extracted and synchronized in real time based on the interface address through the ETL tool, the statistical data and pending data are cached in real time in the memory, the statistical data and pending data are associated with the corresponding jump address, and the statistical data and pending data are displayed through the user interface.

5. A method for unified management of multiple system users as claimed in claim 1, characterized in that: The step S6 is specifically as follows: The business system obtains the input operation instruction and performs the corresponding operation based on the operation instruction. When the operation lacks relevant business data, the corresponding business data is obtained from the remaining business systems through the API service and the operation instruction is continued to be executed.

6. A unified management system for multi-system users, characterized by: Includes the following modules: The security authentication module is used for the authentication server to obtain the input authentication information, authenticate the authentication information, conduct authentication risk assessment during the authentication process, and issue a token through a security protocol after the authentication is completed; A personal data matching module, used to match the user's personal information, department information and all business field information from a preset database based on the authentication information, and display the personal information, department information and a field information list containing information of each business field through a user interface; An address matching module, for matching the jump address of the business system corresponding to each selected business domain information and the interface address of the business item that the business system is responsible for based on the selection signal of the domain information list; An extraction data display module is used to extract and synchronize the statistical data and pending data of each business item in real time through the interface address, associate the statistical data and pending data with the corresponding jump address, and display the statistical data and pending data through the user interface; A business system jump module, which is used for the user interface to jump to the corresponding business system based on the click signal of statistical data or to-do data, and automatically log in to the jumped business system through the token; An operation instruction execution module is used for the business system to obtain input operation instructions and execute corresponding operations based on the operation instructions; The security authentication module is specifically used for: The authentication server obtains the input authentication information carrying the account password, user unique identifier, timestamp, device ID, hash value and signature data; the hash value is obtained by performing hash calculation on the account password, user unique identifier, timestamp and device ID; the signature data is obtained by signing the hash value with a private key, and the authentication server stores a public key matching the private key; The authentication server parses the authentication information to obtain the account password, user unique identifier, timestamp, device ID, hash value and signature data. After verifying the signature data with the public key, the account password, user unique identifier, timestamp and device ID are checked for integrity with the hash value, and then the timestamp is checked for timeliness. The device ID is checked for legitimacy with the preset device management table, and the account password is checked for correctness with the preset user management table. After the verification passes, the mobile phone number is matched from the user management table with the user unique identifier, a verification code is sent to the mobile phone number, the verification code input rule is displayed through the authentication interface, and the characters entered in the authentication interface are verified based on the verification code input rule; During the authentication process, at least the authentication time, authentication duration, authentication IP address, and authentication behavior of the network environment are recorded in real time. Based on historical authentication behaviors and big data analysis technology, authentication risk assessment is performed to generate a risk assessment report. When the risk assessment report indicates that there is a high-risk authentication situation, a new authentication step is added; After the authentication is completed, a token for logging into each business system is issued through the security protocol of HTTPS, TCP, TLS or SSL.

7. A multi-system user unified management system as claimed in claim 6, characterized in that: The personal data matching module is specifically used for: Based on the user's unique identifier carried in the authentication information, the user's personal data encrypted by the SM4 algorithm and the 3DES algorithm is matched from a preset database, the personal data is decrypted by the SM4 algorithm and the 3DES algorithm to obtain the personal information, department information and all business field information, and the desensitized personal information, department information and a list of field information containing information on each business field are displayed through a user interface. After verifying a preset number of desensitized data through the user interface, the complete list of personal information, department information and field information containing information on each business field is displayed.

8. A multi-system user unified management system as claimed in claim 6, characterized in that: In the address matching module, the business items at least include to-do items, item statistics and message notifications.

9. A multi-system user unified management system as claimed in claim 6, characterized in that: The extracted data display module is specifically used for: The statistical data and pending data of each business item are extracted and synchronized in real time based on the interface address through the ETL tool, the statistical data and pending data are cached in real time in the memory, the statistical data and pending data are associated with the corresponding jump address, and the statistical data and pending data are displayed through the user interface.

10. A multi-system user unified management system as claimed in claim 6, characterized in that: The operation instruction execution module is specifically used for: The business system obtains the input operation instruction and performs the corresponding operation based on the operation instruction. When the operation lacks relevant business data, the corresponding business data is obtained from the remaining business systems through the API service and the operation instruction is continued to be executed.

Images