Cross-domain account management method and device, equipment, medium and product

Abstract

The invention provides a cross-domain account management method and device, equipment, a medium and a product. The method comprises the steps that under the condition that a centralized authentication request is obtained, account information corresponding to a first network end where a user logs in currently is determined, the centralized authentication request is used for indicating the user to access a second network end from the first network end, and each of the first network end and the second network end comprises any one of a user management system, a data field and a service system; according to the account information corresponding to the first network side, account information corresponding to a second network side is matched in an account model, and the account model comprises primary account information, secondary account information and secondary account information of the user; and logging in the second network end according to the account information corresponding to the second network end. The technical problem that unified authentication of accounts and cross-domain access of data cannot be achieved under the condition that all data domain interfaces are not transformed in the prior art is solved.

Description

Technical Field

[0001] The present application belongs to the field of communication technology, and in particular, relates to a cross-domain account management method, device, equipment, medium and product. Background Art

[0002] With the development of information technology at this stage, people are increasingly dependent on information technology and information systems in the process of production and life, but the data information of a single department is increasingly unable to meet people's requirements for information. Therefore, information sharing across units, organizations, and information domains is needed.

[0003] In order to facilitate cross-domain access for users, there are currently unified authentication systems, unified user organizational structures, and unified information push platforms to achieve unified authentication and cross-domain access. However, this unified access method requires the transformation of the interfaces of each unit system to achieve a unified standardized interface, which has high construction costs and cycles, and also fails to meet the authority management needs of different types of employees.

[0004] Therefore, it is very important to ensure unified account authentication and cross-domain data access without modifying the interfaces of each data domain. Summary of the invention

[0005] The embodiments of the present application provide a cross-domain account management method, apparatus, device, storage medium and computer program product to solve the technical problem in the related art that unified account authentication and cross-domain data access cannot be achieved without modifying the interfaces of each data domain.

[0006] In a first aspect, an embodiment of the present application provides a cross-domain account management method, which is applied to a user management system. The user management system is associated with multiple data domains, each data domain includes multiple business systems, and the method includes:

[0007] In the case of obtaining a centralized authentication request, determining the account information corresponding to the first network terminal currently logged in by the user, the centralized authentication request is used to instruct the user to access the second network terminal from the first network terminal, and the first network terminal and the second network terminal both include any one of a user management system, a data domain, and a business system;

[0008] According to the account information corresponding to the first network end, the account information corresponding to the second network end is matched in the account model, the account model includes the user's main account information, sub-account information and sub-account information, wherein the main account information is associated with at least one sub-account information, and the sub-account information is associated with at least one sub-account information, the main account information is the account information corresponding to the user management system, the sub-account information is the account information corresponding to the data domain, and the sub-account information is the account information corresponding to the business system;

[0009] Log in to the second network terminal according to the account information corresponding to the second network terminal.

[0010] In a second aspect, an embodiment of the present application provides a cross-domain account management device, the device comprising:

[0011] A determination module, used to determine the account information corresponding to the first network terminal currently logged in by the user when a centralized authentication request is obtained, the centralized authentication request is used to instruct the user to access the second network terminal from the first network terminal, and the first network terminal and the second network terminal both include any one of a user management system, a data domain, and a business system;

[0012] A matching module, used to match the account information corresponding to the second network end in the account model according to the account information corresponding to the first network end, wherein the account model includes the user's main account information, sub-account information and sub-account information, wherein the main account information is associated with at least one sub-account information, and the sub-account information is associated with at least one sub-account information, the main account information is the account information corresponding to the user management system, the sub-account information is the account information corresponding to the data domain, and the sub-account information is the account information corresponding to the business system;

[0013] The login module is used to log in to the second network terminal according to the account information corresponding to the second network terminal.

[0014] In a third aspect, an embodiment of the present application provides an electronic device, the device comprising:

[0015] A processor and a memory storing programs or instructions;

[0016] The above method is implemented when the processor executes the program or instruction.

[0017] In a fourth aspect, an embodiment of the present application provides a machine-readable storage medium, on which a program or instruction is stored, and the program or instruction implements the above method when executed by a processor.

[0018] In a fifth aspect, an embodiment of the present application provides a computer program product. When instructions in the computer program product are executed by a processor of an electronic device, the electronic device executes the above method.

[0019] This application determines the account information corresponding to the first network terminal that the user is currently logged in to when a centralized authentication request is obtained, matches the account information corresponding to the second network terminal in the account model according to the account information corresponding to the first network terminal, and logs in to the second network terminal according to the account information corresponding to the second network terminal. This application realizes switching between different data domains and different business systems by constructing an account model of the user's mutually related main account information, secondary account information, and secondary account information, and constructs a corresponding relationship between account information and the user management system, ensuring unified authentication and cross-domain data access without the need to modify the interfaces of each data domain. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solution of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0021] Figure 1 is a flow chart of a cross-domain account management method according to an embodiment of the present invention;

[0022] Figure 2 is a structural diagram of an account model according to an embodiment of the present invention;

[0023] Figure 3 is a flow chart for establishing an account model according to an embodiment of the present invention;

[0024] Figure 4 is a schematic diagram of a process of locking an account according to an embodiment of the present invention;

[0025] Figure 5 is a schematic diagram of a process of creating a new account according to an embodiment of the present invention;

[0026] Figure 6 is a schematic diagram of a process of changing an account according to an embodiment of the present invention;

[0027] Figure 7 is a structural block diagram of a cross-domain account management device according to an embodiment of the present invention;

[0028] Figure 8 is a schematic structural diagram of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0029] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present application, rather than to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is only to provide a better understanding of the present application by illustrating the examples of the present application.

[0030] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "include..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0031] In addition, it should be noted that the acquisition, storage, use, and processing of data in the embodiments of this application are in compliance with the relevant provisions of national laws and regulations. It should be noted that in the embodiments of this application, some existing solutions in the industry such as certain software, components, and models may be mentioned, and they should be considered as exemplary. Their purpose is only to illustrate the feasibility of the implementation of the technical solution of this application, but it does not mean that the applicant has or will necessarily use the solution.

[0032] In order to solve the problems of the prior art, an embodiment of the present application provides a cross-domain account management method. Figure 1 is a flow chart of a cross-domain account management method according to an embodiment of the present invention. Figure 1 As shown, the cross-domain account management method may include the following steps:

[0033] S110, when a centralized authentication request is obtained, determining the account information corresponding to the first network terminal currently logged in by the user.

[0034] In S110, the centralized authentication request may be used to instruct the user to access the second network end from the first network end, wherein the first network end and the second network end may be any one of a user management system, a data domain, and a business system, and the centralized authentication request may be used to enable the user to switch from the currently logged-in first network end to another network end;

[0035] In this embodiment, the relationship among the user management system, the data domain and the business system may be: the user management system is associated with multiple data domains, and each data domain includes multiple business systems.

[0036] For example, the user management system can be a unified authentication system, the single data domain can be a data platform representing a certain unit or organization, and the single business system can be an application system within the data platform.

[0037] It is understandable that by tracing the request port of the centralized authentication request, the first network terminal currently logged in by the user who sent the centralized authentication request can be determined, and further the account information corresponding to the first network terminal of the user can be determined.

[0038] S120, matching the account information corresponding to the second network end in the account model according to the account information corresponding to the first network end.

[0039] In S120, the account model may be an account model constructed according to preset rules, and used to allocate an account to each legally registered user. Figure 2 is a structural diagram of an account model according to an embodiment of the present invention. Figure 2 As shown, the account model may include primary account information, secondary account information and slave account information, wherein each user may be associated with one primary account information, each primary account information may be associated with m secondary account information, and each secondary account information may be associated with n slave account information, wherein m and n are positive integers.

[0040] Among them, the account information can correspond to the network end, the main account information is the account information corresponding to the user management system, the sub-account information is the account information corresponding to the data domain, and the slave account information is the account information corresponding to the business system. It can be understood that according to the different construction maturity of the data domain, the data domain can be divided into a newly built data domain and an already built data domain. In the case that the data domain is an already built data domain, the sub-account information can be the self-encoding information that each data domain already has; it can be understood that the already built data domain can also include multiple already built business systems, and the slave account information can be the business system account that has completed unified management of each business system.

[0041] For example, in the scenario of assigning an account to a new user, Figure 3 is a flow chart of establishing an account model according to an embodiment of the present invention, such as Figure 3 As shown, the user management system can obtain the employee number from the group's centralized human resources management system as the primary account information of the new user. For example, the user with employee number E0000000001 has the primary account information E0000000001;

[0042] The management end of the data domain can associate the original account information of the data domain with the main account information to obtain the sub-account information. For example, the account number of the user with employee number E0000000001 in the original account information of data domain B is B0000000001. After associating the main account information with the original account information, the sub-account information obtained is BE0000000001.

[0043] The management end of the data domain can also obtain the secondary account information based on the original account of the application system of the data domain according to the preset coding rules. For example, the original account of the user with employee number E0000000001 in the A business system of the B data domain is BE0000000001A, and the secondary account information obtained is BE0000000001AC.

[0044] In this way, through the constructed account model, it is possible to match the account information corresponding to the first network end with the account information corresponding to the second network end, thereby enabling the user to switch from the first network end to the second network end and achieve cross-domain access to data.

[0045] S130, logging into the second network terminal according to the account information corresponding to the second network terminal.

[0046] In S130, after the account information of the second network terminal is obtained, the second network terminal can be logged in according to the account information corresponding to the second network terminal.

[0047] In this embodiment, if the first network terminal is a business system, when the user logs in to the second network terminal from the first network terminal, it can first determine whether the status of the account information is an account locked state. If the status of the account information is an account locked state, the user account locked information can be returned to the business system.

[0048] When the account information is not locked and is correct, the number of times the account information has been successfully logged in can be counted. If the number exceeds this number, the account information is invalid, and a user account information invalidation message can be returned to the business system.

[0049] When the account information is not locked, is correct, and has not expired, it can be analyzed whether the account information is low-security level account information. If the account information is low-security level account information, a message to modify the account information can be returned to the business system.

[0050] After logging into the second network terminal according to the account information corresponding to the second network terminal, the user management system can record the login log to achieve single sign-on of the user.

[0051] In the embodiment of the present application, by obtaining the centralized authentication request, the account information corresponding to the first network terminal currently logged in by the user is determined, and the account information corresponding to the second network terminal is matched in the account model according to the account information corresponding to the first network terminal, and the second network terminal is logged in according to the account information corresponding to the second network terminal. The present application realizes the switching between different data domains and different business systems by constructing an account model of the main account information, secondary account information and secondary account information of the user, and constructing the corresponding relationship between the account information and the user management system, and ensures the unified authentication and cross-domain data access without the need to modify the interfaces of each unit.

[0052] In some embodiments, the account information includes an account number and a password, and logging into the second network terminal according to the account information corresponding to the second network terminal includes:

[0053] If the password does not match the account, and the number of times the password does not match the account exceeds a preset threshold, an account lock request is generated, where the account lock request is used to request to lock the account information corresponding to the second network end;

[0054] Sending an account lock request to the management end of the user management system;

[0055] Receive the first approval result fed back by the management end of the user management system;

[0056] If the first approval result is passed, the account lock request is executed.

[0057] In this embodiment, the account lock request may also be made based on a user request. For example, when a user resigns or changes positions, the user may make an account lock request for account information corresponding to the second network end that is no longer in use.

[0058] In this way, by locking the account information corresponding to the second network end when the account number and password do not match, the data security of the user management system, data domain and business system can be improved.

[0059] In some embodiments, when the account information corresponding to the locked second network end is the secondary account information, and when the first approval result is passed, executing the account locking request includes:

[0060] If the first approval result is passed, determining whether the business type of the business system corresponding to the account information meets the preset business type;

[0061] When the business type of the business system corresponding to the slave account information meets the preset business type, it is determined whether the task in the business system has been completed; when the task in the business system has been completed, the slave account information is locked.

[0062] In this embodiment, the business types of the business system can be divided into two categories, one is a business system with a high degree of importance that requires monitoring and auditing by an administrator of the data domain management end, and the other is a business system that does not require monitoring and auditing by an administrator of the data domain management end. The preset business type may be a business system with a high degree of importance that requires monitoring and auditing by an administrator of the data domain management end. When the business type of the business system corresponding to the slave account information meets the preset business type, the administrator of the data domain needs to monitor whether the tasks of the slave account in the business system have been completed. When the tasks in the business system have been completed, the administrator of the data domain management end can lock the slave account information.

[0063] Figure 4 FIG. 1 is a flowchart of locking an account according to an embodiment of the present invention. Figure 4 As shown, S410, the user management system initiates an account locking process;

[0064] S420, determine the application type, if the application type is push agent, execute S430, if the application type is direct lock, execute S460;

[0065] In this embodiment, the application type is also the business type; push agency means that the administrator of the data domain management terminal carries out the locking process on behalf of the administrator; direct locking means that the user management system can directly execute the locking process.

[0066] S430, push account lock agent information;

[0067] The user management system pushes the agency information to the data domain management end.

[0068] S440, asynchronous processing by the application administrator of the data domain;

[0069] The application administrator of the data domain is the administrator of the data domain management end. The administrator of the data domain management end can manage the audit of the data domain and the audit of the business system associated with the data domain.

[0070] S450, the application administrator of the data domain ends the agency;

[0071] S460, the system locks the account;

[0072] S470, the mark is locked successfully.

[0073] The business management system records the locked account information.

[0074] In this way, by executing different binding processes for the slave account information corresponding to business systems of different business types, for business systems with high importance, the administrator of the data domain management end monitors and reviews the task execution of the slave account in the business system to ensure that the account is locked only after the task is fully executed and the review is passed. This can effectively prevent account locking due to misoperation or failure to complete important tasks, thereby improving the security and stability of the business system.

[0075] In some embodiments, the method further comprises:

[0076] When all the secondary account information associated with the first secondary account information has completed account locking, the first secondary account information is locked;

[0077] When all sub-account information associated with the first main account information has completed account locking, the first main account information is locked.

[0078] In this embodiment, the user's account can be locked according to the account lock range of the account lock request. The account lock request can lock all accounts of the user, including primary account information, secondary account information and secondary account information, or only lock some of the user's accounts.

[0079] It is understandable that an account lock request cannot lock a sub-account information without locking all the slave account information associated with the sub-account information, nor can it lock the main account information without locking all the sub-account information associated with the main account information. Otherwise, it will be impossible to switch to the unlocked slave account information associated with the sub-account information or the unlocked sub-account information associated with the main account information according to the centralized authentication request.

[0080] In this way, locking conflicts or confusion caused by improper account locking order are avoided. At the same time, the layer-by-layer locking method (i.e., from account information to secondary account information and then to primary account information) is adopted to ensure the overall security of the user management system.

[0081] In some embodiments, the method further comprises:

[0082] In the case of obtaining a sub-account operation request, sending the sub-account operation request to the management end of the user management system, where the sub-account operation request includes at least one of a sub-account change request and a sub-account creation request;

[0083] Receive the second approval result fed back by the management end of the user management system;

[0084] If the second approval result is passed, the slave account operation request is executed.

[0085] In this embodiment, the user management system may approve the slave account operation request according to the following constraints. If the slave account operation request does not meet the following constraints, the management end of the user management system may feedback a second approval result of failure:

[0086] First, a sub-account change request or a sub-account creation request cannot be mutually exclusive with existing sub-account attributes. For example, the data domain is the Finance Department, and the sub-account has two attributes: accountant and auditor. These two attributes are mutually exclusive. Users cannot request a sub-account with these two attributes at the same time through a sub-account change request or a sub-account creation request.

[0087] Secondly, a sub-account change request or a sub-account creation request cannot cause the number of sub-account information of the user to exceed the preset number. For example, the system stipulates that the user's main account information can be associated with 5 sub-account information, and each sub-account information can be associated with 10 sub-account information. Then the user cannot cause a single sub-account information to be associated with more than 10 sub-account information through a sub-account change request or a sub-account creation request.

[0088] Finally, the request to change a slave account or to create a slave account needs to meet the prerequisites. For example, there is a hierarchical relationship between different slave accounts. If a user wants to change or create a high-level slave account, he needs to obtain a low-level slave account first.

[0089] In this way, by setting constraints on account operation requests, the user's account permissions and the rationality of the account structure can be controlled to ensure the security and stability of the system. These constraints not only prevent potential resource abuse and misconfiguration, but also promote the standardization and automation of the account management system.

[0090] In some embodiments, when the second approval result is passed, executing the slave account operation request includes:

[0091] In the case where the slave account operation request includes a slave account creation request, generating slave account information according to a preset coding rule;

[0092] Parse the request to create a new slave account and obtain the target sub-account information to be associated with the slave account information;

[0093] Associate the secondary account information with the target secondary account information.

[0094] In the case where the slave account operation request includes a slave account change request, parsing the slave account change request to obtain initial slave account information;

[0095] The initial slave account information is changed according to the slave account change request to obtain the target slave account information.

[0096] Figure 5is a schematic diagram of a process of creating a new account according to an embodiment of the present invention. Figure 5 As shown, S510, initiate a new account creation process;

[0097] When it is obtained that the sub-account operation request is a sub-account creation request, the sub-account creation request is sent to the management end of the user management system, and the second approval result fed back by the management end of the user management system is received; when the second approval result is passed, the sub-account operation request is executed.

[0098] S520, completing account creation;

[0099] The secondary account information may be generated according to a preset coding rule, wherein the preset coding rule may be configured to obtain the secondary account information according to a coding combination of the secondary account information and a business system corresponding to the secondary account information.

[0100] S530, storing the binding relationship;

[0101] Parse the slave account creation request to obtain the target sub-account information to be associated with the slave account information; and associate the slave account information with the target sub-account information.

[0102] S540, push account information.

[0103] After completing the request to create a new slave account, the newly created slave account information can be returned to the network terminal currently used by the user.

[0104] Figure 6 is a flow chart of changing an account according to an embodiment of the present invention. Figure 6 As shown, S610, initiate an account change process;

[0105] When it is obtained that the sub-account operation request is a sub-account change request, the sub-account change request is sent to the management end of the user management system, and the second approval result fed back by the management end of the user management system is received; when the second approval result is passed, the sub-account operation request is executed.

[0106] S620, completing the account information change;

[0107] The initial sub-account information can be obtained by parsing the sub-account change request; then the initial sub-account information can be changed according to the sub-account change request to obtain the target sub-account information.

[0108] S630, storing the changed data;

[0109] S640, push account information.

[0110] After completing the account change request, the target of the change can be returned from the account information to the network terminal that the user is currently using.

[0111] It is understandable that the above-mentioned method for changing and creating a secondary account can also be applied to changing and creating secondary account information and primary account information.

[0112] In this way, by setting the change and creation methods of the main account information, sub-account information and subordinate account information in the account model, flexible control of the user's account model is achieved.

[0113] Figure 7 A schematic diagram of the structure of a cross-domain account management device provided in another embodiment of the present application is shown. For ease of explanation, only the parts related to the embodiment of the present application are shown.

[0114] Reference Figure 7 , the cross-domain account management device 700 may include:

[0115] A determination module 701 is used to determine the account information corresponding to the first network terminal currently logged in by the user when a centralized authentication request is obtained, the centralized authentication request is used to instruct the user to access the second network terminal from the first network terminal, and the first network terminal and the second network terminal both include any one of a user management system, a data domain, and a business system;

[0116] A matching module 702 is used to match the account information corresponding to the second network end in the account model according to the account information corresponding to the first network end, wherein the account model includes the user's main account information, sub-account information and sub-account information, wherein the main account information is associated with at least one sub-account information, and the sub-account information is associated with at least one sub-account information, the main account information is the account information corresponding to the user management system, the sub-account information is the account information corresponding to the data domain, and the sub-account information is the account information corresponding to the business system;

[0117] The login module 703 is used to log in to the second network terminal according to the account information corresponding to the second network terminal.

[0118] In some embodiments, the login module 703 may include the following units:

[0119] A generating unit, configured to generate an account lock request when the password does not match the account and the number of times the password does not match the account exceeds a preset threshold, wherein the account lock request is used to request to lock the account information corresponding to the second network end;

[0120] A sending unit, used to send the account lock request to the management end of the user management system;

[0121] A receiving unit, used for receiving a first approval result fed back by a management end of the user management system;

[0122] The execution unit is used to execute the account locking request if the first approval result is passed.

[0123] In some embodiments, the execution unit may include the following units:

[0124] a determination subunit, for determining whether the business type of the business system corresponding to the secondary account information meets the preset business type when the account information corresponding to the locked second network terminal is the secondary account information and the first approval result is passed;

[0125] The determination subunit is further used to determine whether the task in the business system has been executed when the business type of the business system corresponding to the account information meets the preset business type;

[0126] The locking subunit is used to lock the slave account information when the task in the business system is completed.

[0127] In some embodiments, the locking subunit may also be used to:

[0128] When all the secondary account information associated with the first secondary account information has completed account locking, the first secondary account information is locked;

[0129] When all sub-account information associated with the first main account information has completed account locking, the first main account information is locked.

[0130] In some embodiments, the cross-domain account management device may further include the following modules:

[0131] A sending module, configured to send the sub-account operation request to the management end of the user management system for approval when a sub-account operation request is obtained, wherein the sub-account operation request includes at least one of a sub-account change request and a sub-account creation request;

[0132] A receiving module, used for receiving a second approval result fed back by a management end of the user management system;

[0133] The execution module is used to execute the slave account operation request if the second approval result is passed.

[0134] In some embodiments, the execution module may include the following units:

[0135] A generating unit, configured to generate slave account information according to a preset coding rule when the slave account operation request includes a slave account creation request;

[0136] A parsing unit, used for parsing a request for creating a new slave account, and obtaining target sub-account information to be associated with the slave account information;

[0137] The associating unit is used to associate the secondary account information with the target secondary account information.

[0138] The parsing unit is further configured to parse the slave account change request to obtain initial slave account information when the slave account operation request includes a slave account change request;

[0139] The changing unit is used to change the initial slave account information according to the slave account change request to obtain the target slave account information.

[0140] It should be noted that the information interaction, execution process, etc. between the above-mentioned devices / units are based on the same concept as the method embodiment of the present application, and are devices corresponding to the above-mentioned cross-domain account management method. All implementation methods in the above-mentioned method embodiment are applicable to the embodiment of the device. Its specific functions and the technical effects brought about can be found in the method embodiment part, which will not be repeated here.

[0141] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0142] Figure 8 is a schematic diagram of the structure of an electronic device according to an embodiment of the present invention. Figure 8 As shown:

[0143] The device may include a processor 801 and a memory 802 storing programs or instructions.

[0144] When the processor 801 executes the program, the steps in any of the above method embodiments are implemented.

[0145] Exemplarily, the program may be divided into one or more modules / units, one or more modules / units are stored in the memory 802 and executed by the processor 801 to complete the present application. One or more modules / units may be a series of program instruction segments capable of completing a specific function, and the instruction segments are used to describe the execution process of the program in the device.

[0146] Specifically, the processor 801 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0147] The memory 802 may include a large capacity memory for data or instructions. By way of example and not limitation, the memory 802 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive or a combination of two or more of these. In appropriate cases, the memory 802 may include a removable or non-removable (or fixed) medium. In appropriate cases, the memory 802 may be inside or outside the integrated gateway disaster recovery device. In a specific embodiment, the memory 802 is a non-volatile solid-state memory.

[0148] The memory may include read-only memory (ROM), random access memory (RAM), magnetic disk storage media devices, optical storage media devices, flash memory devices, electrical, optical or other physical / tangible memory storage devices. Thus, typically, the memory includes one or more tangible (non-transitory) machine-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to an aspect of the present disclosure.

[0149] The processor 801 implements any one of the methods in the above embodiments by reading and executing the program or instruction stored in the memory 802 .

[0150] In one example, the electronic device may further include a communication interface 803 and a bus 804. The processor 801, the memory 802, and the communication interface 803 are connected via the bus 804 and communicate with each other.

[0151] The communication interface 803 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiments of the present application.

[0152] Bus 804 includes hardware, software or both, and the parts of online data flow billing equipment are coupled to each other. For example, but not limitation, bus may include accelerated graphics port (AGP) or other graphics bus, enhanced industrial standard architecture (EISA) bus, front-end bus (FSB), hypertransport (HT) interconnection, industrial standard architecture (ISA) bus, infinite bandwidth interconnection, low pin count (LPC) bus, memory bus, micro channel architecture (MCA) bus, peripheral component interconnection (PCI) bus, PCI-Express (PCI-X) bus, serial advanced technology attachment (SATA) bus, video electronics standard association local (VLB) bus or other suitable bus or two or more of these combinations. In appropriate cases, bus 804 may include one or more buses. Although the present application embodiment describes and shows a specific bus, the application considers any suitable bus or interconnection.

[0153] In addition, in combination with the method in the above embodiment, the embodiment of the present application may provide a machine-readable storage medium for implementation. The machine-readable storage medium stores a program or instruction; when the program or instruction is executed by a processor, any one of the methods in the above embodiment is implemented. The machine-readable storage medium can be read by a machine such as a computer.

[0154] An embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface and the processor are coupled, and the processor is used to run programs or instructions to implement the various processes of the above-mentioned method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0155] It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

[0156] An embodiment of the present application provides a computer program product, which is stored in a machine-readable storage medium. The program product is executed by at least one processor to implement the various processes of the above-mentioned method embodiment and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0157] It should be clear that the present application is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present application.

[0158] The functional modules shown in the above block diagram can be implemented as hardware, software, firmware or their combination. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), suitable firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present application are programs or code segments that are used to perform the required tasks. Programs or code segments can be stored in machine-readable media, or transmitted on a transmission medium or a communication link by a data signal carried in a carrier wave. "Machine-readable media" can include any medium that can store or transmit information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, etc. Code segments can be downloaded via computer grids such as the Internet, intranets, etc.

[0159] It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, this application is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiment, or in a different order from the embodiment, or several steps can be performed simultaneously.

[0160] Aspects of the present disclosure are described above with reference to the flowchart and / or block diagram of the method, device (system) and program product according to the embodiment of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by a computer program or instruction. These programs or instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine so that these instructions executed by the processor of the computer or other programmable data processing device enable the implementation of the function / action specified in one or more boxes of the flowchart and / or block diagram. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field programmable logic circuit. It can also be understood that each box in the block diagram and / or flowchart and the combination of boxes in the block diagram and / or flowchart can also be implemented by dedicated hardware that performs a specified function or action, or can be implemented by a combination of dedicated hardware and computer instructions.

[0161] The above are only specific implementation methods of the present application. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the protection scope of the present application is not limited to this. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in this application, and these modifications or replacements should be included in the protection scope of this application.

Claims

1. A cross-domain account management method, characterized in that: Applied to a user management system, the user management system is associated with multiple data domains, each data domain includes multiple business systems, the method includes: In the case of obtaining a centralized authentication request, determining the account information corresponding to the first network terminal currently logged in by the user, wherein the centralized authentication request is used to instruct the user to access the second network terminal from the first network terminal; According to the account information corresponding to the first network end, the account information corresponding to the second network end is matched in the account model, the account model includes the main account information, the sub-account information and the secondary account information of the user, wherein the main account information is associated with at least one of the sub-account information, and the sub-account information is associated with at least one secondary account information, the main account information is the account information corresponding to the user management system, the sub-account information is the account information corresponding to the data domain, and the secondary account information is the account information corresponding to the business system; Log in to the second network terminal according to the account information corresponding to the second network terminal.

2. The method according to claim 1, characterized in that The account information includes an account number and a password, and logging into the second network terminal according to the account information corresponding to the second network terminal includes: If the password does not match the account, and the number of times the password does not match the account exceeds a preset threshold, generating an account lock request, wherein the account lock request is used to request to lock the account information corresponding to the second network end; Sending the account lock request to the management end of the user management system; Receiving a first approval result fed back by a management end of the user management system; If the first approval result is passed, the account locking request is executed.

3. The method according to claim 2, characterized in that In a case where the account information corresponding to the second network end is secondary account information, executing the account locking request in a case where the first approval result is passed includes: If the first approval result is passed, determining whether the business type of the business system corresponding to the slave account information conforms to a preset business type; When the business type of the business system corresponding to the slave account information meets the preset business type, it is determined whether the task in the business system is completed; when the task in the business system is completed, the slave account information is locked.

4. The method according to claim 3, characterized in that The method further comprises: When all the secondary account information associated with the first secondary account information has completed account locking, locking the first secondary account information; When all sub-account information associated with the first primary account information has completed account locking, the first primary account information is locked.

5. The method according to claim 1, characterized in that The method further comprises: In the case of obtaining a sub-account operation request, sending the sub-account operation request to the management end of the user management system, wherein the sub-account operation request includes at least one of a sub-account change request and a sub-account creation request; Receiving a second approval result fed back by the management end of the user management system; If the second approval result is passed, the slave account operation request is executed.

6. The method according to claim 5, characterized in that The executing the slave account operation request when the second approval result is passed includes: In the case where the slave account operation request includes the slave account creation request, generating slave account information according to a preset coding rule; Parsing the slave account creation request to obtain target sub-account information to be associated with the slave account information; The slave account information is associated with the target secondary account information. In a case where the slave account operation request includes the slave account change request, parsing the slave account change request to obtain initial slave account information; The initial slave account information is changed according to the slave account change request to obtain target slave account information.

7. A cross-domain account management device, characterized in that: The device comprises: a determination module, configured to determine account information corresponding to a first network terminal currently logged in by a user when a centralized authentication request is obtained, wherein the centralized authentication request is used to instruct the user to access a second network terminal from the first network terminal, and the first network terminal and the second network terminal both include any one of the user management system, the data domain, and the business system; a matching module, configured to match the account information corresponding to the second network end in the account model according to the account information corresponding to the first network end, wherein the account model includes the primary account information, the secondary account information and the secondary account information of the user, wherein the primary account information is associated with at least one of the secondary account information, and the secondary account information is associated with at least one secondary account information, the primary account information is the account information corresponding to the user management system, the secondary account information is the account information corresponding to the data domain, and the secondary account information is the account information corresponding to the business system; The login module is used to log in to the second network terminal according to the account information corresponding to the second network terminal.

8. An electronic device, characterized in that: The device comprises: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, the method according to any one of claims 1 to 6 is implemented.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement the method according to any one of claims 1 to 6.

10. A computer program product, characterized in that When the instructions in the computer program product are executed by a processor of an electronic device, the electronic device executes the method according to any one of claims 1 to 6.

Images