Authentication method for keeping identity consistency in multi-information system
By introducing a unified identity authentication platform into the multi-information system in the railway industry, the problem of user identity consistency management is solved, operation and maintenance efficiency is improved, data consistency is ensured, and automated personnel information and permission synchronization is achieved.
Patent Information
- Application Number
- CN202411767077.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-04
- Publication Date
- 2025-02-18
AI Technical Summary
In the multi-information system in the railway industry, it is difficult for the existing technology to effectively manage and maintain user identity consistency, resulting in low system management operation and maintenance efficiency and inconsistent data.
The unified identity authentication platform is adopted, and the user login credentials are converted into identity identification information and passed to the information system in the request header to achieve user identity consistency authentication. The platform includes gateway services, authentication services, authentication services, management services and data synchronization services, and automatically synchronizes personnel information and permission adjustments.
Reduce manual operations of system management operation and maintenance personnel, improve operation and maintenance efficiency of information system user management, ensure the consistency of user information between various information systems, and solve the low efficiency of verification of the same user permissions and inconsistent data of different information systems. The problem.
Smart Images
Figure CN119484144A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of Internet technology, and in particular to an authentication method for maintaining identity consistency in a multi-information system. Background Art
[0002] At present, the railway is divided into the National Railway Group and 18 railway bureaus. The National Railway Group and the railway bureaus have built many information systems. The various information systems are independent of each other but have certain correlations. Especially in personnel management, the total number of people in the railway industry is as high as 2 million, which is centrally managed by the National Railway Information System. The personnel information in the railway bureau information system must refer to the data in the National Railway Information System. When employees join, leave, transfer, and other personnel changes, corresponding management operations need to be performed in the National Railway Information System, but the railway bureau construction system has the need to obtain the personnel changes of employees. At this time, the personnel department administrator of the station section needs to perform operation and maintenance operations in multiple systems, which is very inefficient and there is a risk of inconsistent data. In addition, employees will be involved in multiple information systems in their daily work. When employees access the information systems of the National Railway and the railway bureau, they need to perform permission verification based on the identity information of the employees to determine which pages the employees can access. Because of the requirements of the information system construction in the railway industry, the system is not built on the Internet, so it is impossible to use the existing platform system on the market to complete this work. In addition, the railway industry currently uses manual intervention to solve the problem of personnel information changes. When personnel changes occur, the railway bureau first learns the basic information of the changed personnel, then obtains the personnel change information from the national railway information system, and then manually maintains the personnel information and authority information in the railway bureau's self-built information system. Summary of the invention
[0003] The technical problem to be solved by the present invention is to overcome the existing defects and provide an authentication method for maintaining identity consistency in multiple information systems, reduce the manual operations of system management and operation and maintenance personnel, improve the operation and maintenance efficiency of information system user management, ensure the consistency of user information among various information systems, and at the same time solve the problems of low efficiency and inconsistent data when various information systems use different authority verification information for the same user, which can effectively solve the problems in the background technology.
[0004] To achieve the above object, the present invention provides the following technical solution: an authentication method for maintaining identity consistency in a multi-information system, characterized in that it comprises the following steps: S1: The user browses the information system page. When calling the data interface, the page sends a request to the unified identity authentication platform and carries the user login credentials and information system credentials; S2: When the unified identity authentication platform proxy requests, it converts the user login credentials into the user's identity information, and puts the identity information in the request header and passes it to the information system. The information system obtains the user's identity information to determine the user's specific identity and whether the user has access rights; S3: When the user browses different information system pages, the user login credentials remain unchanged, and the information system credentials corresponding to each information system are used to execute step S2.
[0005] Preferably, in step S1, the unified identity authentication platform creates accounts for all users and formulates unique identity identifiers for the users. The authentication service of the unified identity authentication platform provides a unified login authentication interface. Users use the accounts created by the unified identity authentication platform for identity authentication, and the unified identity authentication platform uniformly manages user information and user login credentials.
[0006] Preferably, in step S1, when a user accesses an information system, the login page of the information system calls a unified login authentication interface provided by a unified identity authentication platform, and obtains user login credentials through proxy authentication; each information system registers in the unified identity authentication platform to obtain corresponding information system credentials.
[0007] Preferably, the unified identity authentication platform includes: Gateway service is used to receive requests from various information systems, verify and judge the request information, and forward the request to the target IP according to the configuration information after the verification is completed; Authentication services are used for user login, identity verification, and issuance of user login credentials, providing login user identity information to the information system; Authentication service, used to verify the permissions of users and information systems, and use RBAC mode for permission management; Management services, which are used to manage and authorize users and complete credential management for various information systems; Data synchronization service is responsible for data interaction with various information systems.
[0008] Preferably, the gateway service calls the authentication service to perform identity recognition and verification on the token in the request.
[0009] Preferably, the data synchronization service comprises the following steps: a: The data synchronization service regularly synchronizes the latest personnel data from the human resources system; b: After receiving the personnel position or department transfer, the data synchronization service pushes the data to the unified identity authentication platform, and the unified identity authentication platform simultaneously modifies the identity information of the corresponding personnel; c: The organizational structure and job position information used by the information system are all obtained from the unified identity authentication platform. When the job information of personnel in the unified identity authentication platform changes, the information obtained by the information system will be changed synchronously; d: When personnel identity information changes, it is necessary to complete the registration in the personnel system. After operating the personnel system, the system administrator does not need to operate the information system again to complete the adjustment of personnel identity information.
[0010] Compared with the prior art, the beneficial effects of the present invention are: automatically connecting to the information system, receiving personnel transfer information, and automatically completing the position and department adjustments of employees on the platform, and completing the corresponding authority adjustments, which greatly reduces the maintenance cost; timely obtaining employee personnel changes and feedback on the account, and dynamically adjusting the employee's authority information according to the feedback results. When employees access the information system, the information system will entrust the platform to perform identity authentication and authority verification to ensure the consistency of user information between information systems, and at the same time solve the problem of data inconsistency when each information system uses different authority verification information for the same user. BRIEF DESCRIPTION OF THE DRAWINGS
[0011] Figure 1 It is a schematic diagram of the process of the present invention; Figure 2 It is a structural diagram of the unified identity authentication platform of the present invention. DETAILED DESCRIPTION
[0012] The present invention can be explained in detail through the following embodiments. The purpose of disclosing the present invention is to protect all technical improvements within the scope of the present invention. In the description of the present invention, it should be understood that if there are terms such as "upper", "lower", "front", "back", "left", "right", etc. indicating directions or positional relationships, they only correspond to the drawings of the present application for the convenience of describing the present invention, and do not indicate or imply that the device or element referred to must have a specific direction.
[0013] See also Figure 1 The present invention provides a technical solution: an authentication method for maintaining identity consistency in a multi-information system, comprising the following steps: S1: The user browses the information system page. When calling the data interface, the page sends a request to the unified identity authentication platform and carries the user login credentials and information system credentials; S2: When the unified identity authentication platform proxy requests, it converts the user login credentials into the user's identity information, and puts the identity information in the request header and passes it to the information system. The information system obtains the user's identity information to determine the user's specific identity and whether the user has access rights; S3: When the user browses different information system pages, the user login credentials remain unchanged, and the information system credentials corresponding to each information system are used to execute step S2; In step S1, the unified identity authentication platform creates accounts for all users and formulates unique user identities. The authentication service of the unified identity authentication platform provides a unified login authentication interface. Users use the accounts created by the unified identity authentication platform for identity authentication. The unified identity authentication platform manages user information and user login credentials in a unified manner. The unified identity authentication platform acts as an agent for all requests sent to the information system and converts user login credentials into user identities. In step S1, when a user accesses an information system, the login page of the information system calls the unified login authentication interface provided by the unified identity authentication platform, and obtains the user login credentials through proxy authentication; each information system registers in the unified identity authentication platform and obtains the corresponding information system credentials; By adopting the above steps, the identity consistency of the user in each information system can be maintained, and at the same time, the problem of data inconsistency that occurs when each information system uses different authority verification information for the same user can be solved.
[0014] Specifically, the unified identity authentication platform includes: As a key node of the platform, the gateway service is used to receive requests from various information systems and verify the request information. After the verification is completed, the request is forwarded to the target IP according to the configuration information; The authentication service provides a unified identity authentication solution. The platform has created accounts for 2 million employee users across the railway. These accounts need to use the authentication service to log in, identify identities, and issue user login credentials. At the same time, the authentication service also provides the information system with the function of obtaining the identity information of the logged-in user. The gateway service will call the authentication service to identify and verify the token in the request; Authentication service, used to verify the permissions of users and information systems, and use RBAC mode for permission management; RBAC model: Role-Based Access Control (RBAC) has received widespread attention as a promising alternative to traditional access control (self-directed access, mandatory access). In RBAC, permissions are associated with roles, and users obtain the permissions of these roles by becoming members of appropriate roles, which greatly simplifies the management of permissions. In an organization, roles are created to complete various tasks, and users are assigned to corresponding roles based on their responsibilities and qualifications. Users can be easily assigned from one role to another. Roles can be given new permissions based on new needs and system mergers, and permissions can also be withdrawn from a role as needed. The relationship between roles can be established to cover a wider range of objective conditions; Management services, which are used to manage and authorize users and complete credential management for various information systems; The data synchronization service is responsible for data interaction with various information systems, mainly responsible for data interaction with the national railway information system. When there are personnel changes in the national railway information system, the data synchronization service can monitor the changes and complete the synchronous update in the platform. The platform also automatically completes operations such as authority allocation based on employee information.
[0015] The data synchronization service includes the following steps: a: The data synchronization service regularly synchronizes the latest personnel data from the human resources system; b: After receiving the personnel position or department transfer, the data synchronization service pushes the data to the unified identity authentication platform, and the unified identity authentication platform simultaneously modifies the identity information of the corresponding personnel; c: The organizational structure and job position information used by the information system are all obtained from the unified identity authentication platform. When the job information of personnel in the unified identity authentication platform changes, the information obtained by the information system will be changed synchronously; d: When personnel identity information changes, it needs to be registered in the personnel system. After operating the personnel system, the system administrator can complete the adjustment of personnel identity information without having to operate the information system again; The above steps can automate operations such as user account creation, deactivation, and permission changes when employees join, leave, or transfer to other positions, reduce manual operations by system management and maintenance personnel, and improve the operation and maintenance efficiency of information system user management.
[0016] The parts of the present invention that are not described in detail are prior art. It is obvious to those skilled in the art that the present invention is not limited to the details of the above-mentioned exemplary embodiments, and the present invention can be implemented in other specific forms without departing from the spirit or basic characteristics of the present invention; therefore, no matter from which point of view, the embodiments should be regarded as exemplary and non-restrictive, and it is intended that all changes that fall within the meaning and scope of equivalent elements are included in the content of the present invention.
Claims
1. An authentication method for maintaining identity consistency in a multi-information system, characterized in that: The following steps are involved: S1: The user browses the information system page. When calling the data interface, the page sends a request to the unified identity authentication platform and carries the user login credentials and information system credentials; S2: When the unified identity authentication platform proxy requests, it converts the user login credentials into the user's identity information, and puts the identity information in the request header and passes it to the information system. The information system obtains the user's identity information to determine the user's specific identity and whether the user has access rights; S3: When the user browses different information system pages, the user login credentials remain unchanged, and the information system credentials corresponding to each information system are used to execute step S2.
2. The authentication method for maintaining identity consistency in multiple systems according to claim 1, characterized in that: In step S1, the unified identity authentication platform creates accounts for all users and formulates unique user identities. The authentication service of the unified identity authentication platform provides a unified login authentication interface. Users use the accounts created by the unified identity authentication platform to perform identity authentication. The unified identity authentication platform uniformly manages user information and user login credentials.
3. The authentication method for maintaining identity consistency in multiple systems according to claim 1, characterized in that: In step S1, when a user accesses an information system, the login page of the information system calls the unified login authentication interface provided by the unified identity authentication platform, and obtains the user login credentials through proxy authentication; each information system registers in the unified identity authentication platform to obtain the corresponding information system credentials.
4. The authentication method for maintaining identity consistency in multiple systems according to claim 1, characterized in that: The unified identity authentication platform includes: Gateway service is used to receive requests from various information systems, verify and judge the request information, and forward the request to the target IP according to the configuration information after the verification is completed; Authentication services are used for user login, identity verification, and issuance of user login credentials, providing login user identity information to the information system; Authentication service, used to verify the permissions of users and information systems, and use RBAC mode for permission management; Management services, which are used to manage and authorize users and complete credential management for various information systems; Data synchronization service is responsible for data interaction with various information systems.
5. The authentication method for maintaining identity consistency in multiple systems according to claim 4, characterized in that: The gateway service calls the authentication service to identify and verify the token in the request.
6. The authentication method for maintaining identity consistency in multiple systems according to claim 4, characterized in that: The data synchronization service includes the following steps: a: The data synchronization service regularly synchronizes the latest personnel data from the human resources system; b: After receiving the personnel position or department transfer, the data synchronization service pushes the data to the unified identity authentication platform, and the unified identity authentication platform simultaneously modifies the identity information of the corresponding personnel; c: The organizational structure and job position information used by the information system are all obtained from the unified identity authentication platform. When the job information of personnel in the unified identity authentication platform changes, the information obtained by the information system will be changed synchronously; d: When personnel identity information changes, it is necessary to complete the registration in the personnel system. After operating the personnel system, the system administrator does not need to operate the information system again to complete the adjustment of personnel identity information.