Identity authorization access method and device, equipment and storage medium

Abstract

The invention discloses an identity authorization access method and device, equipment and a storage medium. The method comprises the following steps: receiving an identity authorization request sent by a supplier service website; determining a target visitor accessing the supplier service website based on the identity authorization request; determining virtual identity information corresponding to the target visitor based on the real identity information of the target visitor; and accessing the supplier service website based on the virtual identity information so as to access the supplier service website by using the virtual identity information, thereby ensuring employee identity verification and preventing company internal information leakage.

Description

Technical Field

[0001] The present invention relates to the technical field of software system application, and in particular to an identity authorization access method, device, equipment and storage medium. Background Art

[0002] Large group companies usually have their own internal private networks that can only be accessed by employees within the company. However, in some cases, companies need to purchase Internet service websites provided by some suppliers, which can only be accessed on the public Internet. In this case, employees within the company need internal identity authentication to use these websites, but these websites do not support the company's internal identity authentication method, so employees need to register a new account on these websites. Doing so will bring some problems, such as employees needing to remember multiple accounts and passwords, and may also leak the company's internal information to suppliers. Summary of the invention

[0003] The present invention provides an identity authorization access method, device, equipment and storage medium, so as to use virtual identity information to access a supplier service website, ensure employee identity verification, and prevent internal company information leakage.

[0004] According to one aspect of the present invention, a method for identity authorization access is provided. The method comprises:

[0005] Receive the identity authorization request sent by the supplier service website;

[0006] Based on the identity authorization request, determining a target visitor to access the supplier service website;

[0007] Based on the real identity information of the target visitor, determining the virtual identity information corresponding to the target visitor;

[0008] The supplier service website is accessed based on the virtual identity information.

[0009] According to another aspect of the present invention, an identity authorization access device is provided. The device comprises:

[0010] An authorization request receiving module, used to receive an identity authorization request sent by a supplier service website;

[0011] A visitor determination module, used to determine a target visitor who visits the supplier service website based on the identity authorization request;

[0012] A virtual information determination module, used to determine the virtual identity information corresponding to the target visitor based on the real identity information of the target visitor;

[0013] A service website access module is used to access the supplier service website based on the virtual identity information.

[0014] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0015] at least one processor; and

[0016] a memory communicatively connected to the at least one processor; wherein,

[0017] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the identity authorization access method described in any embodiment of the present invention.

[0018] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the identity authorization access method described in any embodiment of the present invention when executed.

[0019] The technical solution of the embodiment of the present invention receives an identity authorization request sent by a supplier service website. Based on the identity authorization request, a target visitor accessing the supplier service website is determined. Based on the real identity information of the target visitor, the virtual identity information corresponding to the target visitor is determined. The supplier service website is accessed based on the virtual identity information, so that the user accesses the supplier service website with the virtual identity information, which can ensure the identity of the employee for verification and prevent the leakage of internal company information.

[0020] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 is a flow chart of an identity authorization access method provided according to Embodiment 1 of the present invention;

[0023] Figure 2 is a flow chart of an identity authorization access method provided according to Embodiment 2 of the present invention;

[0024] Figure 3 is a structural diagram of an identity authorization access device provided according to Embodiment 3 of the present invention;

[0025] Figure 4 It is a structural diagram of an electronic device for implementing the identity authorization access method of an embodiment of the present invention. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0027] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0028] Embodiment 1

[0029] Figure 1 A flowchart of an identity authorization access method is provided for the first embodiment of the present invention. This embodiment is applicable to the case where the identity information of an enterprise intranet employee is used to access the supplier's extranet. The method can be executed by an identity authorization access device, which can be implemented in the form of hardware and / or software, and can be configured in an electronic device. Figure 1 As shown, the method includes:

[0030] S101. Receive an identity authorization request sent by a supplier service website.

[0031] It should be noted that before the supplier service website sends an identity authorization request to the access terminal, the visitor can access the supplier service website through the internal access link through the access terminal. When it is determined that the visitor accesses the supplier service website, the supplier service website sends an identity authorization request to the access terminal.

[0032] It is worth noting that the present invention provides an identity authorization access service in two different network environments, namely, an internal network environment and an Internet environment. In the Internet environment, visitors can directly access the Internet service website and access the internal identity authentication service through VPN. This method can ensure that visitors can also use the identity authentication service safely in the Internet environment without worrying about identity information security issues. In the internal network environment, visitors can directly access the internal identity authentication service and access the Internet service website through a network proxy. This method can ensure that visitors can also use Internet services safely in the internal network environment.

[0033] S102: Determine a target visitor who accesses the supplier service website based on the identity authorization request.

[0034] The target visitor may refer to an enterprise employee who accesses the supplier service website through the access terminal. Specifically, the target visitor using the access terminal may be determined according to the access terminal identification information included in the identity authorization request.

[0035] Exemplarily, determining the target visitor who visits the supplier service website based on the identity authorization request includes: sending an identity acquisition request to the access end based on the identity authorization request; and determining the target visitor based on the access account information and the account and identity comparison table fed back by the access end.

[0036] Specifically, an identity acquisition request is sent to the access end according to the identity authorization request, and the identity acquisition request is the real access account information of the enterprise employee. The access account information and the account and identity comparison table are matched and compared to determine the target visitor.

[0037] S103: Determine virtual identity information corresponding to the target visitor based on the real identity information of the target visitor.

[0038] Specifically, after determining the target visitor, the target visitor is assigned matching virtual identity information according to the real identity information of the target visitor. It should be noted that the present invention can also record the correspondence between the real identity information and the virtual identity information, as well as the start and end time of this assignment, so that the enterprise can adjust and update the virtual identity information assignment strategy internally.

[0039] S104: Access the supplier service website based on the virtual identity information.

[0040] Specifically, the target visitor asymmetrically encrypts the assigned virtual identity information into a SAMLResponse and returns it to the supplier service website, thereby completing the entire identity authentication process. It should be noted that the technical solution of the present invention accesses the supplier service website based on the SAML2.0 protocol and performs identity authentication services based on the OAuth2.0 protocol.

[0041] The technical solution of the embodiment of the present invention receives an identity authorization request sent by a supplier service website. Based on the identity authorization request, a target visitor accessing the supplier service website is determined. Based on the real identity information of the target visitor, the virtual identity information corresponding to the target visitor is determined. The supplier service website is accessed based on the virtual identity information, so that the user accesses the supplier service website with the virtual identity information, which can ensure the identity of the employee for verification and prevent the leakage of internal company information.

[0042] Embodiment 2

[0043] Figure 2 This is a flow chart of an identity authorization access method provided by Embodiment 2 of the present invention. Based on the above embodiments, this embodiment further refines the virtual identity information corresponding to the target visitor. Figure 2 As shown, the method includes:

[0044] S201. Receive an identity authorization request sent by a supplier service website.

[0045] S202: Determine a target visitor who accesses the supplier service website based on the identity authorization request.

[0046] S203: Based on the identity attribute information in the real identity information, determine a target virtual user group corresponding to the identity attribute information.

[0047] The identity attribute information may refer to the organizational sub-organization information to which the target visitor belongs, and the target virtual user group may refer to the virtual information group corresponding to the organizational sub-organization.

[0048] Specifically, the identity attribute information in the real identity information determines the target virtual user group that matches the identity attribute information.

[0049] Exemplarily, determining the target virtual user group corresponding to the identity attribute information based on the identity attribute information in the real identity information includes: when it is determined that there is no target virtual user group corresponding to the identity attribute information, creating a target virtual user group according to the identity attribute information.

[0050] That is, when it is determined that there is no target virtual user group matching the identity attribute information, a target virtual user group matching the identity attribute information is created, and at least one virtual identity information is created in the target virtual user group.

[0051] S204: Acquire unallocated virtual identity information from the target virtual user group.

[0052] Specifically, an allocated virtual identity information set and an unallocated virtual identity information set in the target virtual user group are determined, and an unallocated virtual identity information is obtained from the unallocated virtual identity information set.

[0053] Exemplarily, the acquiring unallocated virtual identity information from the target virtual user group includes: when it is determined that the target virtual user group does not have unallocated virtual identity information, creating virtual identity information, and determining the created virtual identity information as unallocated virtual identity information.

[0054] Similarly, after all virtual identity information has been allocated, at least one virtual identity information is continuously created in the target virtual user group.

[0055] S205: Associating the unallocated virtual identity information with the target visitor, and determining the unallocated virtual identity information as the virtual identity information corresponding to the target visitor.

[0056] Specifically, the obtained unallocated virtual identity information is associated with the target visitor, so that the unallocated virtual identity information becomes the virtual identity information of the target visitor.

[0057] Exemplarily, after determining the unallocated virtual identity information as the virtual identity information corresponding to the target visitor, the method further includes: updating the allocation state of the virtual identity information to an allocated state, and setting a usage time threshold of the virtual identity information.

[0058] That is to say, after the unallocated virtual identity information becomes the virtual identity information of the target visitor, it is necessary to set the allocation state of the unallocated virtual identity information to the allocated state, and set a usage time threshold for the virtual identity information, such as 2 hours, to avoid the virtual identity information being occupied for a long time, resulting in a waste of resources.

[0059] S206: Access the supplier service website based on the virtual identity information.

[0060] The technical solution of the embodiment of the present invention determines the target virtual user group corresponding to the identity attribute information based on the identity attribute information in the real identity information. Obtain unallocated virtual identity information from the target virtual user group. Associate the unallocated virtual identity information with the target visitor, and determine the unallocated virtual identity information as the virtual identity information corresponding to the target visitor. Allocating virtual identity information based on the target virtual user group can prevent the target visitor from occupying the virtual identity information of other sub-institutions. At the same time, setting the target virtual user group also provides the behavior information of the employees of each sub-institution visiting the supplier service website, which can realize the security authentication of the target visitor's identity and the tracing and analysis of the behavior, thereby improving the security and user experience of the Internet service website.

[0061] Embodiment 3

[0062] Figure 3 This is a schematic diagram of the structure of an identity authorization access device provided in Embodiment 3 of the present invention. Figure 3 As shown, the device comprises:

[0063] The authorization request receiving module 301 is used to receive the identity authorization request sent by the supplier service website;

[0064] A visitor determination module 302, for determining a target visitor who visits the supplier service website based on the identity authorization request;

[0065] A virtual information determination module 303, used to determine the virtual identity information corresponding to the target visitor based on the real identity information of the target visitor;

[0066] The service website access module 304 is used to access the supplier service website based on the virtual identity information.

[0067] The technical solution of the embodiment of the present invention receives an identity authorization request sent by a supplier service website. Based on the identity authorization request, a target visitor accessing the supplier service website is determined. Based on the real identity information of the target visitor, the virtual identity information corresponding to the target visitor is determined. The supplier service website is accessed based on the virtual identity information, so that the user accesses the supplier service website with the virtual identity information, which can ensure the identity of the employee for verification and prevent the leakage of internal company information.

[0068] Optionally, the visitor determination module 302 is specifically configured to:

[0069] Sending an identity acquisition request to the access terminal based on the identity authorization request;

[0070] The target visitor is determined based on the access account information fed back by the access terminal and the account and identity comparison table.

[0071] Optionally, the virtual information determination module 303 includes:

[0072] A virtual user group determination unit, configured to determine a target virtual user group corresponding to the identity attribute information based on the identity attribute information in the real identity information;

[0073] A virtual identity information acquisition unit, configured to acquire unallocated virtual identity information from the target virtual user group;

[0074] The virtual information determining unit is used to associate the unallocated virtual identity information with the target visitor, and determine the unallocated virtual identity information as the virtual identity information corresponding to the target visitor.

[0075] Optionally, the virtual user group determining unit is specifically configured to:

[0076] In the case where it is determined that there is no target virtual user group corresponding to the identity attribute information, a target virtual user group is created according to the identity attribute information.

[0077] Optionally, the virtual identity information obtaining unit is specifically used to:

[0078] In the case where it is determined that the target virtual user group does not have any unallocated virtual identity information, virtual identity information is created, and the created virtual identity information is determined as unallocated virtual identity information.

[0079] Optionally, the virtual information determination unit may also be used to:

[0080] The allocation state of the virtual identity information is updated to an allocated state, and a usage time threshold of the virtual identity information is set.

[0081] Optionally, the device further comprises:

[0082] The supplier service website is accessed based on the SAML2.0 protocol, and identity authentication services are performed based on the OAuth2.0 protocol.

[0083] The identity authorization access device provided in the embodiment of the present invention can execute the identity authorization access method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0084] Embodiment 4

[0085] Figure 4A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0086] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0087] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0088] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 11 executes the various methods and processes described above, such as method identity authorization access.

[0089] In some embodiments, the method identity authorization access may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the method identity authorization access described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the method identity authorization access in any other appropriate manner (e.g., by means of firmware).

[0090] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0091] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0092] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0093] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0094] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0095] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0096] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0097] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. An identity authorization access method, characterized in that: include: Receive the identity authorization request sent by the supplier service website; Based on the identity authorization request, determining a target visitor to access the supplier service website; Based on the real identity information of the target visitor, determining the virtual identity information corresponding to the target visitor; The supplier service website is accessed based on the virtual identity information.

2. The method according to claim 1, characterized in that The step of determining a target visitor who accesses the supplier service website based on the identity authorization request includes: Sending an identity acquisition request to the access terminal based on the identity authorization request; The target visitor is determined based on the access account information fed back by the access terminal and the account and identity comparison table.

3. The method according to claim 1, characterized in that The step of determining the virtual identity information corresponding to the target visitor based on the real identity information of the target visitor includes: Based on the identity attribute information in the real identity information, determining a target virtual user group corresponding to the identity attribute information; Acquire unassigned virtual identity information from the target virtual user group; The unallocated virtual identity information is associated with the target visitor, and the unallocated virtual identity information is determined as the virtual identity information corresponding to the target visitor.

4. The method according to claim 3, characterized in that The determining, based on the identity attribute information in the real identity information, a target virtual user group corresponding to the identity attribute information includes: In the case where it is determined that there is no target virtual user group corresponding to the identity attribute information, a target virtual user group is created according to the identity attribute information.

5. The method according to claim 3, characterized in that: The obtaining of unallocated virtual identity information from the target virtual user group includes: In the case where it is determined that the target virtual user group does not have any unallocated virtual identity information, virtual identity information is created, and the created virtual identity information is determined as unallocated virtual identity information.

6. The method according to claim 3, characterized in that After determining the unassigned virtual identity information as the virtual identity information corresponding to the target visitor, the method further includes: The allocation state of the virtual identity information is updated to an allocated state, and a usage time threshold of the virtual identity information is set.

7. The method according to claim 1, characterized in that The method further comprises: The supplier service website is accessed based on the SAML2.0 protocol, and identity authentication services are performed based on the OAuth2.0 protocol.

8. An identity authorization access device, characterized in that: include: An authorization request receiving module, used to receive an identity authorization request sent by a supplier service website; A visitor determination module, used to determine a target visitor who visits the supplier service website based on the identity authorization request; A virtual information determination module, used to determine the virtual identity information corresponding to the target visitor based on the real identity information of the target visitor; A service website access module is used to access the supplier service website based on the virtual identity information.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the identity authorization access method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the identity authorization access method according to any one of claims 1 to 7 when executed.

Images