User unified management method of intelligent integrated system and related device

Abstract

The invention discloses a user unified management method of an intelligent integrated system and a related device. The method comprises the steps that the intelligent integrated system receives a login request of a login user through a login terminal; the intelligent integrated system calls a unified identity authentication algorithm to perform login authentication processing on login authentication information in the login request, and logs in the intelligent integrated system based on a login authentication result; obtaining user role information of the login user based on a user identifier in the login authentication information; according to the user role information of the login user, performing permission allocation processing on the login user by using a role access control algorithm to obtain an allocation permission of the login user; and when the intelligent integrated system receives that the login user accesses the target subsystem, the intelligent integrated system performs access control on the access request of the user based on the distribution permission of the login user. In the embodiment of the invention, the unified management of the user through the intelligent integrated system is realized, and the access of the user to other subsystems is facilitated.

Description

Technical Field

[0001] The present invention relates to the technical field of user management, and in particular to a user unified management method and related devices for an intelligent integrated system. Background Art

[0002] In the intelligent construction of hospitals, a lot of system management is generally involved, such as intelligent equipment management system, security equipment management system, electromechanical equipment management system, environmental management system and energy management system; these systems are generally independent systems, so the existing method is that users set up corresponding management accounts on each independent system, and log in to the corresponding system through these corresponding management accounts to perform corresponding management and access operations; this will lead to management chaos and the inability to achieve unified management, resulting in low management efficiency. Summary of the invention

[0003] The purpose of the present invention is to overcome the deficiencies of the prior art. The present invention provides a user unified management method and related devices for an intelligent integrated system, which realizes unified management of users through the intelligent integrated system, facilitates users' access to other subsystems, and improves user management efficiency.

[0004] In order to solve the above technical problems, an embodiment of the present invention provides a user unified management method of an intelligent integrated system, which is applied to the intelligent integrated system, wherein the intelligent integrated system integrates at least one subsystem, and the method includes:

[0005] The intelligent integrated system receives a login request from a login user through a login terminal, wherein the login request carries login authentication information of the login user;

[0006] The intelligent integrated system calls a unified identity authentication algorithm to perform login authentication processing on the login authentication information in the login request, and logs in to the intelligent integrated system based on the login authentication result;

[0007] The intelligent integration system obtains the user role information of the logged-in user based on the user identifier in the login authentication information;

[0008] According to the user role information of the logged-in user, the login user is assigned permissions using a role-based access control algorithm to obtain the assigned permissions of the logged-in user;

[0009] When receiving the access request from the logged-in user to the target subsystem, the intelligent integration system performs access control on the access request of the user based on the assigned authority of the logged-in user.

[0010] Optionally, the intelligent integration system receives a login request from a login user through a login terminal, including:

[0011] The intelligent integrated system establishes a network connection with the login terminal, and loads the login page to the login terminal for display;

[0012] The intelligent integrated system receives a login request generated by the login user operating on the login page displayed on the login terminal; wherein the operation is the login user inputting login authentication information according to the information prompted by the login page.

[0013] Optionally, the intelligent integrated system calls a unified identity authentication algorithm to perform login authentication processing on the login authentication information in the login request, including:

[0014] The protected resource authentication center in the intelligent integrated system builds an identity pool IDP for the login user and assigns the login authentication information in the login request to the identity pool IDP;

[0015] The identity pool IDP performs identity authentication based on the login authentication information, and returns an identity authentication number to the protected resource authentication center after the identity pool IDP passes the authentication, wherein the identity authentication number is associated with a SAML assertion in the identity pool IDP;

[0016] The protected resource authentication center indexes the SAML assertion in the identity pool IDP based on the identity authentication number, and performs validity verification processing on the signature in the SAML assertion to obtain a validity verification result of the signature in the SAML assertion;

[0017] A login authentication result of the logged-in user is obtained based on the validity verification result, wherein the login authentication result is signature verification valid or signature verification invalid.

[0018] Optionally, the step of logging into the intelligent integration system based on the login authentication result includes:

[0019] The intelligent integrated system identifies the login authentication result, and when the login authentication result is that the signature verification is invalid, the intelligent integrated system feeds back the login verification failure to the login user through the login terminal;

[0020] When the login authentication result is that the signature verification is valid, the login user is allowed to log in to the intelligent integration system through the login terminal.

[0021] Optionally, the intelligent integration system obtains the user role information of the logged-in user based on the user identifier in the login authentication information, including:

[0022] The intelligent integration system extracts and processes the user identifier in the login authentication information uploaded by the login user to obtain the user identifier of the login user;

[0023] The intelligent integration system obtains the user role information of the logged-in user by matching the user identification in a user role database, wherein the user role database is used to store user identification and user role information managed with the user identification.

[0024] Optionally, performing permission allocation processing on the logged-in user by using a role access control algorithm according to the user role information of the logged-in user to obtain the allocated permissions of the logged-in user includes:

[0025] Inputting the user role information of the logged-in user into the role access control algorithm to perform permission association control, and obtaining the user permission associated with the user role information;

[0026] Permission allocation processing is performed according to the user permissions associated with the user role information to obtain the allocated permissions of the logged-in user.

[0027] Optionally, when receiving the login user's request to access the target subsystem, the intelligent integration system performs access control on the user's access request based on the assigned authority of the login user, including:

[0028] When receiving the login user's access to the target subsystem, the intelligent integration system identifies whether the login user's assigned authority has the authority to access the target subsystem;

[0029] When the assigned authority of the logged-in user has the authority to access the target subsystem, the intelligent integration system allows the logged-in user to access the target subsystem according to the assigned authority;

[0030] When the assigned authority of the logged-in user does not have the authority to access the target subsystem, the intelligent integration system denies the logged-in user access to the target subsystem according to the assigned authority, and generates a denial log to feed back to the logged-in user.

[0031] In addition, an embodiment of the present invention further provides a user unified management device for an intelligent integrated system, which is applied to the intelligent integrated system, wherein the intelligent integrated system is integrated with at least one subsystem, and the device includes:

[0032] Receiving module: used for the intelligent integrated system to receive a login request from a login user through a login terminal, wherein the login request carries the login authentication information of the login user;

[0033] Login authentication module: used for the intelligent integrated system to call a unified identity authentication algorithm to perform login authentication processing on the login authentication information in the login request, and log in to the intelligent integrated system based on the login authentication result;

[0034] Acquisition module: used for the intelligent integration system to obtain the user role information of the logged-in user based on the user identifier in the login authentication information;

[0035] The authority allocation module is used to allocate authority to the logged-in user according to the user role information of the logged-in user using a role access control algorithm to obtain the allocated authority of the logged-in user;

[0036] Access control module: used for the intelligent integration system to perform access control on the access request of the user based on the assigned authority of the logged-in user when receiving the access request of the user to the target subsystem.

[0037] In addition, an embodiment of the present invention further provides a server on which an intelligent integration system is deployed, the server comprising a processor and a memory, the processor running a computer program or code stored in the memory to implement a unified user management method as described in any one of the above.

[0038] In addition, an embodiment of the present invention further provides a computer-readable storage medium for storing a computer program or code. When the computer program or code is executed by a processor, the user unified management method as described in any one of the above is implemented.

[0039] In an embodiment of the present invention, a login request from a login user through a login terminal is received by an intelligent integrated system; the intelligent integrated system calls a unified identity authentication algorithm to perform login authentication processing on the login authentication information in the login request, and logs in to the intelligent integrated system based on the login authentication result; the user role information of the login user is obtained based on the user identifier in the login authentication information; the login user is assigned permissions to the login user using a role access control algorithm according to the user role information of the login user, and the assigned permissions of the login user are obtained; when receiving access to a target subsystem by the login user, the intelligent integrated system performs access control on the user's access request based on the assigned permissions of the login user; thereby achieving unified management of users through the intelligent integrated system, facilitating users' access to other subsystems, and improving user management efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0041] Figure 1 It is a flowchart of a user unified management method of an intelligent integrated system in an embodiment of the present invention;

[0042] Figure 2 is a flow chart of a user unified management method of an intelligent integrated system in another embodiment of the present invention;

[0043] Figure 3 It is a schematic diagram of the structure of a user unified management device of an intelligent integrated system in an embodiment of the present invention;

[0044] Figure 4 It is a schematic diagram of the structural composition of the server in an embodiment of the present invention. DETAILED DESCRIPTION

[0045] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0046] For example, see Figure 1 , Figure 1 It is a flowchart of a user unified management method of an intelligent integrated system in an embodiment of the present invention.

[0047] like Figure 1 As shown, a user unified management method of an intelligent integrated system is applied to the intelligent integrated system, wherein the intelligent integrated system integrates at least one subsystem;

[0048] In the specific implementation process of the present invention, the intelligent integration system can be regarded as an intelligent digital platform. By providing relevant interfaces to the outside world, other systems can be connected to the platform as subsystems through the provided interfaces; and these subsystems are uniformly managed on the platform; thereby achieving unified indexing, unified registration, unified communication, unified data management and utilization, and unified integration. The access management of relevant systems in the hospital area is realized through the Internet of Things, big data and application integration technologies, and an open service interface is provided to build a unified, open and flexibly expandable hospital area comprehensive integration platform; the comprehensive integration system realizes unified governance in data, forming a standard data theme library and special library (people, vehicles, objects, events, etc.), realizing the comprehensive situation of the hospital's refined operation, comprehensive management of security precautions, comprehensive management of logistics operations, and intelligent applications such as medical special systems; realizing the digitization of all elements, all processes, and all scenes, grasping the overall operation of the entire hospital area from a global perspective, and realizing joint command.

[0049] The main functions of the intelligent integrated system are as follows:

[0050] 1) Single sign-on: The platform provides single sign-on authentication services to achieve a unified entry login portal and interface; provides a unified user authentication service that meets the single sign-on specifications, which can achieve one login and one logout, using all connected subsystems, and using digital certificates to achieve unified identity authentication, including digital certificate authentication, import, deletion, authentication service interface, etc. User information is centrally managed by the platform, and interfaces are provided to share with each subsystem; the single sign-on system provides a unified login interface, and each subsystem must be connected according to the single sign-on specifications to achieve single sign-on of each subsystem.

[0051] Single sign-on has the following technical advantages: (1) Centralized identity management: It provides a centralized location to manage user identity information and authentication logic, simplifying the complexity of identity management. It facilitates the unified update and maintenance of user information to ensure the consistency of user data in various systems; (2) Enhanced security: It supports a variety of powerful authentication methods, such as two-factor authentication, certificate authentication, etc., which improves the security of authentication; it reduces the risk of users using weak passwords or reusing passwords in multiple systems; (3) Single sign-on experience: Users only need to log in once to access multiple integrated application systems, which improves user work efficiency and user experience. It avoids the trouble of users frequently switching logins between different systems; (4) Easy to integrate: It can be integrated with various types of application systems (Web applications, mobile applications, desktop applications, etc.) and has a wide range of applicability. It provides rich APIs and documentation to reduce the difficulty and cost of integration; (5) Scalability: It can easily cope with the growing number of users and system scale; it can easily add new authentication methods or integrate with other identity management systems;

[0052] The authentication algorithm plays an important role in ensuring the security of the system and the accuracy of user identity authentication. This single sign-on system integrates the authentication algorithm in a modular way to update the algorithm used to ensure sufficient security of the system. When the single sign-on system hashes the information transmitted by the user, it adds a randomly generated "salt" value to increase the complexity and security of the information hash encryption.

[0053] 2) System integration: The intelligent integration platform realizes interconnection with intelligent special systems, thereby realizing relevant linkage control and facilitating property management and system integration.

[0054] 3) Large screen control: For the control system that displays the large screen content, based on the integrated data, the system platform can connect the content with the large screen display system and control the large screen to display video images and business content pages.

[0055] The method comprises:

[0056] S101: The intelligent integrated system receives a login request from a login user through a login terminal, wherein the login request carries login authentication information of the login user;

[0057] In the specific implementation process of the present invention, the intelligent integration system receives a login request from a login user through a login terminal, including: the intelligent integration system establishes a network connection with the login terminal, and loads a login page to the login terminal for display; the intelligent integration system receives a login request generated by the login user operating on the login page displayed on the login terminal; wherein the operation is an operation for the login user to input login authentication information according to the information prompted by the login page.

[0058] Specifically, a client or APP or mini program is set in the login terminal, the login terminal enters the client or APP or mini program and then establishes a network connection with the intelligent integration system through the network; at this time, the intelligent integration system loads the corresponding login page into the login terminal for display; and receives the login request generated by the login user's operation in the login page displayed on the login terminal; wherein the operation is that the login user inputs the login authentication information according to the information prompted by the login page and the login request is generated according to the corresponding settings according to the login authentication information input by the user's input operation.

[0059] S102: the intelligent integrated system calls a unified identity authentication algorithm to perform login authentication processing on the login authentication information in the login request, and logs in to the intelligent integrated system based on the login authentication result;

[0060] In the specific implementation process of the present invention, the intelligent integrated system calls a unified identity authentication algorithm to perform login authentication processing on the login authentication information in the login request, including: the protected resource authentication center in the intelligent integrated system builds an identity pool IDP for the login user, and assigns the login authentication information in the login request to the identity pool IDP; the identity pool IDP performs identity authentication processing based on the login authentication information, and after the identity pool IDP authentication is passed, returns an identity authentication number to the protected resource authentication center, and the identity authentication number is associated with a SAML assertion in the identity pool IDP; the protected resource authentication center indexes the SAML assertion in the identity pool IDP based on the identity authentication number, and performs validity verification processing on the signature in the SAML assertion to obtain a validity verification result of the signature in the SAML assertion; based on the validity verification result, the login authentication result of the login user is obtained, wherein the login authentication result is a valid signature verification or an invalid signature verification.

[0061] Furthermore, the logging into the intelligent integrated system based on the login authentication result includes: the intelligent integrated system identifying the login authentication result, when the login authentication result is that the signature verification is invalid, the intelligent integrated system feedbacks the login verification failure to the login user through the login terminal; when the login authentication result is that the signature verification is valid, allowing the login user to log in to the intelligent integrated system through the login terminal.

[0062] Specifically, a unified user authentication service that meets the single sign-on specification is provided, which can realize one-time login and one-time logout, use all accessed subsystems, and use digital certificates to realize unified identity authentication, including digital certificate authentication, import, deletion, authentication service interface, etc. This embodiment provides a unified user authentication service based on 3.

[0063] The SAML (Security Assertion Markup Language) algorithm is an authentication method that defines a standard format for exchanging authentication and authorization data between an identity pool (IdP) and a service provider (SP). The IdP authenticates the user and generates a SAML assertion, which the SP receives and verifies to complete single sign-on.

[0064] Among them, SAML related concepts: Assertion Issuer (AssertingParty): It is the business system that issues the assertion; Assertion Relying Party (RelyingParty): It is the business system that consumes the assertion. In the single sign-on scenario, they are also called Identity Provider (IDP-Identity provider) and Service Provider (SP-Service Provider) respectively; IDP in single sign-on refers to the unified identity authentication platform, and SP refers to the service provider that needs to be authenticated: Authentication Subject (Principal): Generally interacts with the two business systems through a Web browser; Response: Issued by the assertion issuer to the authentication subject, containing the most important assertion information; Assertion: Contains important authentication information such as the name, id, and group of the authentication subject.

[0065] The process of SAML (Security Assertion Markup Language) in unified identity authentication is as follows:

[0066] The logged-in user provides authentication information. After being redirected to the IDP, the logged-in user provides authentication information to the IDP; the IDP issues a SAML assertion; if the IDP performs identity authentication, if the authentication is successful, it will send an artifactnumber to the SP (in a redirection manner, the artifactnumber is attached to the redirect address as a parameter, and the redirect address here is the address of the AssertionConsumerServiceURL). Of course, in the complete SAML process, after the authentication is successful, the IDP will issue a SAML assertion containing information about the user's identity, and the assertion will be sent to the SP in some way; the user sends the SAML assertion back to the SP; after receiving the artifact, the SP will re-establish a connection with the SP (for example, through SOAP, sending an ArtifactResolve), obtain the complete assertion information, and then verify the signature of the assertion to ensure the validity of the assertion.

[0067] After obtaining the login authentication result, the intelligent integration system will identify the login authentication result. When the login authentication result is that the signature verification is invalid, the intelligent integration system will feedback the login verification failure to the login user through the login terminal; when the login authentication result is that the signature verification is valid, the login user is allowed to log in to the intelligent integration system through the login terminal; the login user will be managed accordingly subsequently.

[0068] S103: The intelligent integration system obtains user role information of the logged-in user based on the user identifier in the login authentication information;

[0069] In the specific implementation process of the present invention, the intelligent integration system obtains the user role information of the logged-in user based on the user identifier in the login authentication information, including: the intelligent integration system extracts and processes the user identifier in the login authentication information uploaded by the logged-in user to obtain the user identifier of the logged-in user; the intelligent integration system obtains the user role information of the logged-in user by matching the user identifier in a user role database, wherein the user role database is used to store user identifiers and user role information managed with user identifiers.

[0070] Specifically, the user identification of the logged-in user is first extracted, that is, the intelligent integration system obtains the user identification of the logged-in user by extracting and processing the user identification in the login authentication information uploaded by the logged-in user; then the intelligent integration system obtains the user role information of the logged-in user by matching the user identification in the user role database, wherein the user role database is used to store user identification and user role information managed with the user identification.

[0071] S104: performing permission allocation processing on the logged-in user using a role-based access control algorithm according to the user role information of the logged-in user, and obtaining the allocated permissions of the logged-in user;

[0072] In the specific implementation process of the present invention, the permission allocation processing of the logged-in user is performed according to the user role information of the logged-in user using a role access control algorithm to obtain the allocated permissions of the logged-in user, including: inputting the user role information of the logged-in user into the role access control algorithm to perform permission association control to obtain the user permissions associated with the user role information; performing permission allocation processing according to the user permissions associated with the user role information to obtain the allocated permissions of the logged-in user.

[0073] Specifically, unified user authority management is to unify the authority data of each subsystem into the intelligent integration system for management. The authority data of each subsystem is read by the RPC data interface provided by the intelligent integration system. The user directory tree is edited and set to implement authority management and role authority management. Role authority is the authority granted by the system administrator to the role to perform business processing and business query on the system's functional modules. Role authority is mainly divided according to the transaction subject type or business type. After the system authorizes a role, all users belonging to this role also have all the permissions of the role.

[0074] In this embodiment, a role-based access control (RBAC) algorithm is adopted, that is, users are divided into different roles, each role has a specific permission set; the permissions of users are determined by assigning roles to them.

[0075] Role definition and permission association: The system will first define various roles, each of which corresponds to a specific set of permissions; for example, a system may have roles such as "administrator", "ordinary user", and "financial personnel". The administrator role may have all the management permissions of the system, such as user management, system configuration, etc.; the ordinary user role may only have basic operation permissions, such as viewing information, submitting simple forms, etc.; the financial personnel role is granted financial-related permissions, such as financial data entry, report viewing, etc. This approach makes permission management clearer, more organized, and easier to maintain by clearly associating permissions with roles; when the system function changes, only the permissions corresponding to the role need to be adjusted, without modifying the permissions of users one by one, which greatly reduces the complexity of management.

[0076] User and role assignment: Users are assigned to corresponding roles according to their functions or tasks in the organization; this assignment is usually performed by system administrators or personnel with corresponding permissions. For example, in an enterprise, new employees are assigned to the "ordinary user" role according to their positions (such as marketing specialists), while employees responsible for system operation and maintenance are assigned to the "administrator" role; this process ensures that users can only obtain permissions that match their job functions, thereby ensuring the security of the system and the confidentiality of data.

[0077] S105: When receiving a request from the logged-in user to access the target subsystem, the intelligent integration system performs access control on the access request of the user based on the assigned authority of the logged-in user.

[0078] In the specific implementation process of the present invention, when the intelligent integration system receives the login user's access to the target subsystem, the intelligent integration system performs access control on the user's access request based on the login user's assigned permissions, including: when the intelligent integration system receives the login user's access to the target subsystem, it identifies whether the login user's assigned permissions have the permission to access the target subsystem; when the login user's assigned permissions have the permission to access the target subsystem, the intelligent integration system allows the login user to access the target subsystem according to the assigned permissions; when the login user's assigned permissions do not have the permission to access the target subsystem, the intelligent integration system denies the login user's access to the target subsystem according to the assigned permissions, and generates a denial log to feedback to the login user.

[0079] Specifically, after the logged-in user logs in to the intelligent integration system and is assigned the corresponding permissions, the corresponding target subsystem will be accessed, that is, when the intelligent integration system receives the logged-in user's access to the target subsystem, it will identify whether the logged-in user's assigned permissions have the permissions to access the target subsystem; when the logged-in user's assigned permissions have the permissions to access the target subsystem, the intelligent integration system allows the logged-in user to access the target subsystem according to the assigned permissions; at the same time, the intelligent integration system will generate corresponding log information for the logged-in user's access and operations on the target subsystem, and store it to facilitate subsequent management user inquiries; when the logged-in user's assigned permissions do not have the permissions to access the target subsystem, the intelligent integration system will deny the logged-in user's access to the target subsystem according to the assigned permissions, and generate a rejection log to feedback to the logged-in user, and save the rejection log.

[0080] In an embodiment of the present invention, a login request from a login user through a login terminal is received by an intelligent integrated system; the intelligent integrated system calls a unified identity authentication algorithm to perform login authentication processing on the login authentication information in the login request, and logs in to the intelligent integrated system based on the login authentication result; the user role information of the login user is obtained based on the user identifier in the login authentication information; the login user is assigned permissions to the login user using a role access control algorithm according to the user role information of the login user, and the assigned permissions of the login user are obtained; when receiving access to a target subsystem by the login user, the intelligent integrated system performs access control on the user's access request based on the assigned permissions of the login user; thereby achieving unified management of users through the intelligent integrated system, facilitating users' access to other subsystems, and improving user management efficiency.

[0081] For example 2, please refer to Figure 2 , Figure 2 It is a flow chart of a user unified management method of an intelligent integrated system in another embodiment of the present invention.

[0082] like Figure 2 As shown, a user unified management method of an intelligent integrated system is applied to the intelligent integrated system, wherein the intelligent integrated system integrates at least one subsystem, and the method comprises:

[0083] S201: The intelligent integrated system receives a login request from a login user through a login terminal, wherein the login request carries login authentication information of the login user;

[0084] S202: the intelligent integrated system calls a unified identity authentication algorithm to perform login authentication processing on the login authentication information in the login request, and logs in to the intelligent integrated system based on the login authentication result;

[0085] S203: The intelligent integration system obtains the user role information of the logged-in user based on the user identifier in the login authentication information;

[0086] S204: performing permission allocation processing on the logged-in user using a role-based access control algorithm according to the user role information of the logged-in user, and obtaining the allocated permissions of the logged-in user;

[0087] S205: When receiving the request from the logged-in user to access the target subsystem, the intelligent integration system identifies whether the assigned authority of the logged-in user has the authority to access the target subsystem;

[0088] S206: When the assigned authority of the logged-in user has the authority to access the target subsystem, the intelligent integration system allows the logged-in user to access the target subsystem according to the assigned authority;

[0089] S207: When the assigned authority of the logged-in user does not have the authority to access the target subsystem, the intelligent integration system denies the logged-in user access to the target subsystem according to the assigned authority, and generates a denial log to feed back to the logged-in user.

[0090] The specific implementation of this embodiment can be found in the above embodiments and will not be described in detail here.

[0091] For example 3, please refer to Figure 3 , Figure 3 It is a schematic diagram of the structural composition of a user unified management device of an intelligent integrated system in an embodiment of the present invention.

[0092] like Figure 3 As shown, a user unified management device of an intelligent integrated system is applied to the intelligent integrated system, wherein the intelligent integrated system is integrated with at least one subsystem;

[0093] In the specific implementation process of the present invention, the intelligent integration system can be regarded as an intelligent digital platform. By providing relevant interfaces to the outside world, other systems can be connected to the platform as subsystems through the provided interfaces; and these subsystems are uniformly managed on the platform; thereby achieving unified indexing, unified registration, unified communication, unified data management and utilization, and unified integration. The access management of relevant systems in the hospital area is realized through the Internet of Things, big data and application integration technologies, and an open service interface is provided to build a unified, open and flexibly expandable hospital area comprehensive integration platform; the comprehensive integration system realizes unified governance in data, forming a standard data theme library and special library (people, vehicles, objects, events, etc.), realizing the comprehensive situation of the hospital's refined operation, comprehensive management of security precautions, comprehensive management of logistics operations, and intelligent applications such as medical special systems; realizing the digitization of all elements, all processes, and all scenes, grasping the overall operation of the entire hospital area from a global perspective, and realizing joint command.

[0094] The main functions of the intelligent integrated system are as follows:

[0095] 1) Single sign-on: The platform provides single sign-on authentication services to achieve a unified entry login portal and interface; provides a unified user authentication service that meets the single sign-on specifications, which can achieve one login and one logout, using all connected subsystems, and using digital certificates to achieve unified identity authentication, including digital certificate authentication, import, deletion, authentication service interface, etc. User information is centrally managed by the platform, and interfaces are provided to share with each subsystem; the single sign-on system provides a unified login interface, and each subsystem must be connected according to the single sign-on specifications to achieve single sign-on of each subsystem.

[0096] Single sign-on has the following technical advantages: (1) Centralized identity management: It provides a centralized location to manage user identity information and authentication logic, simplifying the complexity of identity management. It facilitates the unified update and maintenance of user information to ensure the consistency of user data in various systems; (2) Enhanced security: It supports a variety of powerful authentication methods, such as two-factor authentication, certificate authentication, etc., which improves the security of authentication; it reduces the risk of users using weak passwords or reusing passwords in multiple systems; (3) Single sign-on experience: Users only need to log in once to access multiple integrated application systems, which improves user work efficiency and user experience. It avoids the trouble of users frequently switching logins between different systems; (4) Easy to integrate: It can be integrated with various types of application systems (Web applications, mobile applications, desktop applications, etc.) and has a wide range of applicability. It provides rich APIs and documentation to reduce the difficulty and cost of integration; (5) Scalability: It can easily cope with the growing number of users and system scale; it can easily add new authentication methods or integrate with other identity management systems;

[0097] The authentication algorithm plays an important role in ensuring the security of the system and the accuracy of user identity authentication. This single sign-on system integrates the authentication algorithm in a modular way to update the algorithm used to ensure sufficient security of the system. When the single sign-on system hashes the information transmitted by the user, it adds a randomly generated "salt" value to increase the complexity and security of the information hash encryption.

[0098] 2) System integration: The intelligent integration platform realizes interconnection with intelligent special systems, thereby realizing relevant linkage control and facilitating property management and system integration.

[0099] 3) Large screen control: For the control system that displays the large screen content, based on the integrated data, the system platform can connect the content with the large screen display system and control the large screen to display video images and business content pages.

[0100] The device comprises:

[0101] Receiving module 301: used for the intelligent integrated system to receive a login request from a login user through a login terminal, wherein the login request carries login authentication information of the login user;

[0102] In the specific implementation process of the present invention, the intelligent integration system receives a login request from a login user through a login terminal, including: the intelligent integration system establishes a network connection with the login terminal, and loads a login page to the login terminal for display; the intelligent integration system receives a login request generated by the login user operating on the login page displayed on the login terminal; wherein the operation is an operation for the login user to input login authentication information according to the information prompted by the login page.

[0103] Specifically, a client or APP or mini program is set in the login terminal, the login terminal enters the client or APP or mini program and then establishes a network connection with the intelligent integration system through the network; at this time, the intelligent integration system loads the corresponding login page into the login terminal for display; and receives the login request generated by the login user's operation in the login page displayed on the login terminal; wherein the operation is that the login user inputs the login authentication information according to the information prompted by the login page and the login request is generated according to the corresponding settings according to the login authentication information input by the user's input operation.

[0104] Login authentication module 302: used for the intelligent integrated system to call a unified identity authentication algorithm to perform login authentication processing on the login authentication information in the login request, and log in to the intelligent integrated system based on the login authentication result;

[0105] In the specific implementation process of the present invention, the intelligent integrated system calls a unified identity authentication algorithm to perform login authentication processing on the login authentication information in the login request, including: the protected resource authentication center in the intelligent integrated system builds an identity pool IDP for the login user, and assigns the login authentication information in the login request to the identity pool IDP; the identity pool IDP performs identity authentication processing based on the login authentication information, and after the identity pool IDP authentication is passed, returns an identity authentication number to the protected resource authentication center, and the identity authentication number is associated with a SAML assertion in the identity pool IDP; the protected resource authentication center indexes the SAML assertion in the identity pool IDP based on the identity authentication number, and performs validity verification processing on the signature in the SAML assertion to obtain a validity verification result of the signature in the SAML assertion; based on the validity verification result, the login authentication result of the login user is obtained, wherein the login authentication result is a valid signature verification or an invalid signature verification.

[0106] Furthermore, the logging into the intelligent integrated system based on the login authentication result includes: the intelligent integrated system identifying the login authentication result, when the login authentication result is that the signature verification is invalid, the intelligent integrated system feedbacks the login verification failure to the login user through the login terminal; when the login authentication result is that the signature verification is valid, allowing the login user to log in to the intelligent integrated system through the login terminal.

[0107] Specifically, a unified user authentication service that meets the single sign-on specification is provided, which can realize one-time login and one-time logout, use all accessed subsystems, and use digital certificates to realize unified identity authentication, including digital certificate authentication, import, deletion, authentication service interface, etc. This embodiment provides a unified user authentication service based on 3.

[0108] The SAML (Security Assertion Markup Language) algorithm is an authentication method that defines a standard format for exchanging authentication and authorization data between an identity pool (IdP) and a service provider (SP). The IdP authenticates the user and generates a SAML assertion, which the SP receives and verifies to complete single sign-on.

[0109] Among them, SAML related concepts: Assertion Issuer (AssertingParty): It is the business system that issues the assertion; Assertion Relying Party (RelyingParty): It is the business system that consumes the assertion. In the single sign-on scenario, they are also called Identity Provider (IDP-Identity provider) and Service Provider (SP-Service Provider) respectively; IDP in single sign-on refers to the unified identity authentication platform, and SP refers to the service provider that needs to be authenticated: Authentication Subject (Principal): Generally interacts with the two business systems through a Web browser; Response: Issued by the assertion issuer to the authentication subject, containing the most important assertion information; Assertion: Contains important authentication information such as the name, id, and group of the authentication subject.

[0110] The process of SAML (Security Assertion Markup Language) in unified identity authentication is as follows:

[0111] The logged-in user provides authentication information. After being redirected to the IDP, the logged-in user provides authentication information to the IDP; the IDP issues a SAML assertion; if the IDP performs identity authentication, if the authentication is successful, it will send an artifactnumber to the SP (in a redirection manner, the artifactnumber is attached to the redirect address as a parameter, and the redirect address here is the address of the AssertionConsumerServiceURL). Of course, in the complete SAML process, after the authentication is successful, the IDP will issue a SAML assertion containing information about the user's identity, and the assertion will be sent to the SP in some way; the user sends the SAML assertion back to the SP; after receiving the artifact, the SP will re-establish a connection with the SP (for example, through SOAP, sending an ArtifactResolve), obtain the complete assertion information, and then verify the signature of the assertion to ensure the validity of the assertion.

[0112] After obtaining the login authentication result, the intelligent integration system will identify the login authentication result. When the login authentication result is that the signature verification is invalid, the intelligent integration system will feedback the login verification failure to the login user through the login terminal; when the login authentication result is that the signature verification is valid, the login user is allowed to log in to the intelligent integration system through the login terminal; the login user will be managed accordingly subsequently.

[0113] Acquisition module 303: used for the intelligent integration system to obtain the user role information of the logged-in user based on the user identifier in the login authentication information;

[0114] In the specific implementation process of the present invention, the intelligent integration system obtains the user role information of the logged-in user based on the user identifier in the login authentication information, including: the intelligent integration system extracts and processes the user identifier in the login authentication information uploaded by the logged-in user to obtain the user identifier of the logged-in user; the intelligent integration system obtains the user role information of the logged-in user by matching the user identifier in a user role database, wherein the user role database is used to store user identifiers and user role information managed with user identifiers.

[0115] Specifically, the user identification of the logged-in user is first extracted, that is, the intelligent integration system obtains the user identification of the logged-in user by extracting and processing the user identification in the login authentication information uploaded by the logged-in user; then the intelligent integration system obtains the user role information of the logged-in user by matching the user identification in the user role database, wherein the user role database is used to store user identification and user role information managed with the user identification.

[0116] The authority allocation module 304 is used to allocate authority to the logged-in user using a role-based access control algorithm according to the user role information of the logged-in user, and obtain the allocated authority of the logged-in user;

[0117] In the specific implementation process of the present invention, the permission allocation processing of the logged-in user is performed according to the user role information of the logged-in user using a role access control algorithm to obtain the allocated permissions of the logged-in user, including: inputting the user role information of the logged-in user into the role access control algorithm to perform permission association control to obtain the user permissions associated with the user role information; performing permission allocation processing according to the user permissions associated with the user role information to obtain the allocated permissions of the logged-in user.

[0118] Specifically, unified user authority management is to unify the authority data of each subsystem into the intelligent integration system for management. The authority data of each subsystem is read by the RPC data interface provided by the intelligent integration system. The user directory tree is edited and set to implement authority management and role authority management. Role authority is the authority granted by the system administrator to the role to perform business processing and business query on the system's functional modules. Role authority is mainly divided according to the transaction subject type or business type. After the system authorizes a role, all users belonging to this role also have all the permissions of the role.

[0119] In this embodiment, a role-based access control (RBAC) algorithm is adopted, that is, users are divided into different roles, each role has a specific permission set; the permissions of users are determined by assigning roles to them.

[0120] Role definition and permission association: The system will first define various roles, each of which corresponds to a specific set of permissions; for example, a system may have roles such as "administrator", "ordinary user", and "financial personnel". The administrator role may have all the management permissions of the system, such as user management, system configuration, etc.; the ordinary user role may only have basic operation permissions, such as viewing information, submitting simple forms, etc.; the financial personnel role is granted financial-related permissions, such as financial data entry, report viewing, etc. This approach makes permission management clearer, more organized, and easier to maintain by clearly associating permissions with roles; when the system function changes, only the permissions corresponding to the role need to be adjusted, without modifying the permissions of users one by one, which greatly reduces the complexity of management.

[0121] User and role assignment: Users are assigned to corresponding roles according to their functions or tasks in the organization; this assignment is usually performed by system administrators or personnel with corresponding permissions. For example, in an enterprise, new employees are assigned to the "ordinary user" role according to their positions (such as marketing specialists), while employees responsible for system operation and maintenance are assigned to the "administrator" role; this process ensures that users can only obtain permissions that match their job functions, thereby ensuring the security of the system and the confidentiality of data.

[0122] Access control module 305: is used for the intelligent integration system to perform access control on the access request of the user based on the assigned authority of the logged-in user when receiving the access request of the user to the target subsystem.

[0123] In the specific implementation process of the present invention, when the intelligent integration system receives the login user's access to the target subsystem, the intelligent integration system performs access control on the user's access request based on the login user's assigned permissions, including: when the intelligent integration system receives the login user's access to the target subsystem, it identifies whether the login user's assigned permissions have the permission to access the target subsystem; when the login user's assigned permissions have the permission to access the target subsystem, the intelligent integration system allows the login user to access the target subsystem according to the assigned permissions; when the login user's assigned permissions do not have the permission to access the target subsystem, the intelligent integration system denies the login user's access to the target subsystem according to the assigned permissions, and generates a denial log to feedback to the login user.

[0124] Specifically, after the logged-in user logs in to the intelligent integration system and is assigned the corresponding permissions, the corresponding target subsystem will be accessed, that is, when the intelligent integration system receives the logged-in user's access to the target subsystem, it will identify whether the logged-in user's assigned permissions have the permissions to access the target subsystem; when the logged-in user's assigned permissions have the permissions to access the target subsystem, the intelligent integration system allows the logged-in user to access the target subsystem according to the assigned permissions; at the same time, the intelligent integration system will generate corresponding log information for the logged-in user's access and operations on the target subsystem, and store it to facilitate subsequent management user inquiries; when the logged-in user's assigned permissions do not have the permissions to access the target subsystem, the intelligent integration system will deny the logged-in user's access to the target subsystem according to the assigned permissions, and generate a rejection log to feedback to the logged-in user, and save the rejection log.

[0125] In an embodiment of the present invention, a login request from a login user through a login terminal is received by an intelligent integrated system; the intelligent integrated system calls a unified identity authentication algorithm to perform login authentication processing on the login authentication information in the login request, and logs in to the intelligent integrated system based on the login authentication result; the user role information of the login user is obtained based on the user identifier in the login authentication information; the login user is assigned permissions to the login user using a role access control algorithm according to the user role information of the login user, and the assigned permissions of the login user are obtained; when receiving access to a target subsystem by the login user, the intelligent integrated system performs access control on the user's access request based on the assigned permissions of the login user; thereby achieving unified management of users through the intelligent integrated system, facilitating users' access to other subsystems, and improving user management efficiency.

[0126] A computer-readable storage medium provided in an embodiment of the present invention stores a computer program on the computer-readable storage medium, and when the program is executed by a processor, the user unified management method of any one of the above embodiments is implemented. The computer-readable storage medium includes, but is not limited to, any type of disk (including floppy disk, hard disk, optical disk, CD-ROM, and magneto-optical disk), ROM (Read-Only Memory), RAM (Random Access Memory), EPROM (Erasable Programmable Read-Only Memory), EEPROM (Electrically Erasable Programmable Read-Only Memory), flash memory, magnetic card or optical card. That is, the storage device includes any medium that can store or transmit information in a readable form by a device (for example, a computer, a mobile phone), which can be a read-only memory, a disk or an optical disk, etc.

[0127] An embodiment of the present invention further provides a computer application program, which runs on a computer and is used to execute the user unified management method of any one of the above embodiments.

[0128] also, Figure 4 It is a schematic diagram of the structural composition of the server in an embodiment of the present invention.

[0129] The embodiment of the present invention also provides a server, such as Figure 4 The server includes a processor 402, a memory 403, an input unit 404, a display unit 405 and other devices. Those skilled in the art will understand that Figure 4 The structural components of the server shown do not constitute a limitation on all devices, and may include more or fewer components than shown, or combine certain components. The memory 403 can be used to store the application 401 and each functional module, and the processor 402 runs the application 401 stored in the memory 403, thereby executing various functional applications and data processing of the device. The memory can be an internal memory or an external memory, or include both internal and external memories. The internal memory may include a read-only memory (ROM), a programmable ROM (PROM), an electrically programmable ROM (EPROM), an electrically erasable programmable ROM (EEPROM), a flash memory, or a random access memory. The external memory may include a hard disk, a floppy disk, a ZIP disk, a U disk, a magnetic tape, etc. The memory disclosed in the present invention includes but is not limited to these types of memories. The memory disclosed in the present invention is only used as an example and not as a limitation.

[0130] The input unit 404 is used to receive the input of the signal and the keyword input by the user. The input unit 404 may include a touch panel and other input devices. The touch panel can collect the user's touch operation on or near it (such as the user's operation on or near the touch panel using any suitable object or accessory such as a finger, stylus, etc.), and drive the corresponding connection device according to a pre-set program; other input devices may include but are not limited to one or more of a physical keyboard, a function key (such as a playback control key, a switch key, etc.), a trackball, a mouse, a joystick, etc. The display unit 405 can be used to display the information input by the user or the information provided to the user and various menus of the terminal device. The display unit 405 can be in the form of a liquid crystal display, an organic light emitting diode, etc. The processor 402 is the control center of the terminal device, which uses various interfaces and lines to connect the various parts of the entire device, and executes various functions and processes data by running or executing software programs and / or modules stored in the memory 403, and calling the data stored in the memory.

[0131] As an embodiment, the server has an intelligent integration system deployed on it, and the server includes: one or more processors 402, a memory 403, and one or more applications 401, wherein the one or more applications 401 are stored in the memory 403 and are configured to be executed by the one or more processors 402, and the one or more applications 401 are configured to execute the user unified management method in any one of the above-mentioned embodiments.

[0132] In an embodiment of the present invention, a login request from a login user through a login terminal is received by an intelligent integrated system; the intelligent integrated system calls a unified identity authentication algorithm to perform login authentication processing on the login authentication information in the login request, and logs in to the intelligent integrated system based on the login authentication result; the user role information of the login user is obtained based on the user identifier in the login authentication information; the login user is assigned permissions to the login user using a role access control algorithm according to the user role information of the login user, and the assigned permissions of the login user are obtained; when receiving access to a target subsystem by the login user, the intelligent integrated system performs access control on the user's access request based on the assigned permissions of the login user; thereby achieving unified management of users through the intelligent integrated system, facilitating users' access to other subsystems, and improving user management efficiency.

[0133] In addition, the above is a detailed introduction to the user unified management method and related devices of an intelligent integrated system provided by an embodiment of the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A user unified management method for an intelligent integrated system, characterized in that: Applied to an intelligent integrated system, wherein at least one subsystem is integrated in the intelligent integrated system; the method comprises: The intelligent integrated system receives a login request from a login user through a login terminal, wherein the login request carries login authentication information of the login user; The intelligent integrated system calls a unified identity authentication algorithm to perform login authentication processing on the login authentication information in the login request, and logs in to the intelligent integrated system based on the login authentication result; The intelligent integration system obtains the user role information of the logged-in user based on the user identifier in the login authentication information; According to the user role information of the logged-in user, the login user is assigned permissions using a role-based access control algorithm to obtain the assigned permissions of the logged-in user; When receiving the access request from the logged-in user to the target subsystem, the intelligent integration system performs access control on the access request of the user based on the assigned authority of the logged-in user.

2. The user unified management method according to claim 1, characterized in that: The intelligent integration system receives a login request from a login user through a login terminal, including: The intelligent integrated system establishes a network connection with the login terminal, and loads the login page to the login terminal for display; The intelligent integrated system receives a login request generated by the login user operating on the login page displayed on the login terminal; wherein the operation is the login user inputting login authentication information according to the information prompted by the login page.

3. The user unified management method according to claim 1, characterized in that: The intelligent integrated system calls a unified identity authentication algorithm to perform login authentication processing on the login authentication information in the login request, including: The protected resource authentication center in the intelligent integrated system builds an identity pool IDP for the login user and assigns the login authentication information in the login request to the identity pool IDP; The identity pool IDP performs identity authentication based on the login authentication information, and returns an identity authentication number to the protected resource authentication center after the identity pool IDP passes the authentication, wherein the identity authentication number is associated with a SAML assertion in the identity pool IDP; The protected resource authentication center indexes the SAML assertion in the identity pool IDP based on the identity authentication number, and performs validity verification processing on the signature in the SAML assertion to obtain a validity verification result of the signature in the SAML assertion; A login authentication result of the logged-in user is obtained based on the validity verification result, wherein the login authentication result is signature verification valid or signature verification invalid.

4. The user unified management method according to claim 1, characterized in that: The step of logging into the intelligent integration system based on the login authentication result includes: The intelligent integrated system identifies the login authentication result, and when the login authentication result is that the signature verification is invalid, the intelligent integrated system feeds back the login verification failure to the login user through the login terminal; When the login authentication result is that the signature verification is valid, the login user is allowed to log in to the intelligent integration system through the login terminal.

5. The user unified management method according to claim 1, characterized in that: The intelligent integration system obtains the user role information of the logged-in user based on the user identifier in the login authentication information, including: The intelligent integration system extracts and processes the user identifier in the login authentication information uploaded by the login user to obtain the user identifier of the login user; The intelligent integration system obtains the user role information of the logged-in user by matching the user identification in a user role database, wherein the user role database is used to store user identification and user role information managed with the user identification.

6. The user unified management method according to claim 1, characterized in that: The performing permission allocation processing on the logged-in user by using a role access control algorithm according to the user role information of the logged-in user to obtain the allocated permission of the logged-in user includes: Inputting the user role information of the logged-in user into the role access control algorithm to perform permission association control, and obtaining the user permission associated with the user role information; Permission allocation processing is performed according to the user permissions associated with the user role information to obtain the allocated permissions of the logged-in user.

7. The user unified management method according to claim 1, characterized in that: When receiving the login user's access to the target subsystem, the intelligent integration system performs access control on the user's access request based on the login user's assigned authority, including: When receiving the login user's access to the target subsystem, the intelligent integration system identifies whether the login user's assigned authority has the authority to access the target subsystem; When the assigned authority of the logged-in user has the authority to access the target subsystem, the intelligent integration system allows the logged-in user to access the target subsystem according to the assigned authority; When the assigned authority of the logged-in user does not have the authority to access the target subsystem, the intelligent integration system denies the logged-in user access to the target subsystem according to the assigned authority, and generates a denial log to feed back to the logged-in user.

8. A user unified management device for an intelligent integrated system, characterized in that: Applied to an intelligent integrated system, wherein at least one subsystem is integrated in the intelligent integrated system; the device comprises: Receiving module: used for the intelligent integrated system to receive a login request from a login user through a login terminal, wherein the login request carries the login authentication information of the login user; Login authentication module: used for the intelligent integrated system to call a unified identity authentication algorithm to perform login authentication processing on the login authentication information in the login request, and log in to the intelligent integrated system based on the login authentication result; Acquisition module: used for the intelligent integration system to obtain the user role information of the logged-in user based on the user identifier in the login authentication information; The authority allocation module is used to allocate authority to the logged-in user according to the user role information of the logged-in user using a role access control algorithm to obtain the allocated authority of the logged-in user; Access control module: used for the intelligent integration system to perform access control on the access request of the user based on the assigned authority of the logged-in user when receiving the access request of the user to the target subsystem.

9. A server, on which an intelligent integrated system is deployed, the server comprising a processor and a memory, characterized in that: The processor runs the computer program or code stored in the memory to implement the user unified management method according to any one of claims 1 to 7.

10. A computer-readable storage medium for storing a computer program or code, characterized in that: When the computer program or code is executed by a processor, the user unified management method according to any one of claims 1 to 7 is implemented.

Images