IAM component authentication method and IAM component

Abstract

The invention relates to an authentication method of an IAM component and the IAM component, and the method comprises a first component which is used for generating a universal unique identification code, associating a corresponding access authority for the universal unique identification code, and removing the access authority associated with the universal unique identification code; wherein the access permission represents resources accessed by the target equipment; the second component is used for receiving the resource and the universal unique identification code requested by the target equipment, and sending the resource and the universal unique identification code requested by the target process to the first component; the first component is used for authenticating the universal unique identification code and sending an authentication result to the second component; and the second component is also used for sending the authentication result to the target equipment, so that the target equipment determines whether to call the requested resource or not according to the authentication result. Through the method and the device, the problems of high maintenance cost and poor expansibility caused by authentication of the IAM component based on the white list in the prior art are solved.

Description

Technical Field

[0001] The present application relates to the field of IAM component authentication, and in particular to an IAM component authentication method and an IAM component. Background Art

[0002] With the continuous development of modern automobile technology, the application of in-vehicle electronic software in vehicles is becoming more and more extensive, the interaction and interconnection between software are becoming more and more frequent, and the security threats inside and outside the system are also increasing. In order to meet the challenges of increasing complexity and security requirements of vehicle electronic systems, more security and permission control mechanisms are needed to protect vehicle systems from malicious attacks and unauthorized access. As a result, the identity authentication and access management component (IAM) is generated as an important part of AUTOSAR AP (Automotive Open System Architecture). The IAM (Identity and Access Management) component provides a way to centrally manage user identities and permissions, which can ensure that only authorized users can access specific functions and data of vehicle systems. By using the IAM component, automobile manufacturers can better protect sensitive data and functions in vehicle systems and improve the overall security and reliability of the system. In existing AUTOSAR AP, the IAM module usually adopts a whitelist-based authentication method. However, this method requires the maintenance of a whitelist list, which has high management complexity and may require more resources to maintain a large number of whitelists in large-scale systems. Summary of the invention

[0003] The present application provides an authentication method and an IAM component for an IAM component, so as to solve the problem in the prior art that the IAM component performs authentication based on a whitelist, resulting in high maintenance costs and poor scalability.

[0004] In the first aspect, the present application provides an identity identification and access management IAM component, which includes a first component and a second component; the first component is used to generate a universal unique identification code, and associate corresponding access rights with the universal unique identification code, and release the access rights associated with the universal unique identification code; wherein the access rights represent the resources accessed by the target device; the second component is used to receive the resources and universal unique identification code requested by the target device, and send them to the first component based on the resources and universal unique identification code requested by the target process; the first component is used to authenticate the universal unique identification code and send the authentication result to the second component; the second component is also used to send the authentication result to the target device, so that the target device determines whether to call the requested resource based on the authentication result.

[0005] In a second aspect, the present application provides an authentication method based on the IAM component described in the first aspect, the method comprising: the first component generates a universal unique identification code, associates corresponding access rights with the universal unique identification code, and releases the access rights associated with the universal unique identification code; wherein the access rights represent the resources accessed by the target device; the second component receives the resources and universal unique identification code requested by the target device, and sends them to the first component based on the resources and universal unique identification code requested by the target process; the first component authenticates the universal unique identification code and sends the authentication result to the first component; the second component sends the authentication result to the target device, so that the target device determines whether to call the requested resources based on the authentication result.

[0006] In a third aspect, the present application provides an electronic device comprising: at least one communication interface; at least one bus connected to the at least one communication interface; at least one processor connected to the at least one bus; and at least one memory connected to the at least one bus, wherein the processor is configured to execute the authentication method of the IAM component described in the above second aspect of the present application.

[0007] In a fourth aspect, the present application further provides a computer storage medium storing computer executable instructions, wherein the computer executable instructions are used to execute the authentication method of the IAM component described in the above second aspect of the present application.

[0008] The above technical solution provided by the embodiment of the present application has the following advantages compared with the prior art: In the embodiment of the present application, the first component in the IAM component first generates a universal unique identification code and associates the corresponding access rights for the universal unique identification code, and releases the access rights associated with the universal unique identification code. Thereafter, the second component in the IAM component receives the resources and universal unique identification code requested by the target device, and sends the resources and universal unique identification code requested by the target device to the first component. The first component authenticates the universal unique identification code and sends the authentication result to the second component. The second component sends the authentication result to the target device so that the target device determines whether to call the requested resource based on the authentication result. It can be seen that in the embodiment of the present application, the IAM component uses a universal unique identification code to authenticate the target device. Due to the uniqueness of the universal unique identification code, the security of the authentication is improved, and the universal unique identification code can be better expanded. Compared with the white list in the prior art, it can be better maintained and managed, thereby solving the problem that the IAM component in the prior art performs authentication based on the white list, resulting in high maintenance cost and poor scalability. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0010] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0011] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0012] Figure 1 A schematic diagram of the structure of an IAM component provided in an embodiment of the present application;

[0013] Figure 2 A schematic diagram of an optional structure of an IAM component provided in an embodiment of the present application;

[0014] Figure 3 This is a schematic diagram of UUID-based authentication in a specific example of this application;

[0015] Figure 4 A flowchart for generating a UUID provided in an embodiment of the present application;

[0016] Figure 5 A flowchart of an authentication method for an IAM component provided in an embodiment of the present application;

[0017] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0018] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0019] The disclosure below provides many different embodiments or examples to implement different structures of the present invention. In order to simplify the disclosure of the present invention, the parts and settings of specific examples are described below. Of course, they are only examples, and the purpose is not to limit the present invention. In addition, the present invention can repeat reference numbers and / or letters in different examples. This repetition is for the purpose of simplification and clarity, and does not itself indicate the relationship between the various embodiments and / or settings discussed.

[0020] In the prior art, the IAM module usually adopts a whitelist-based authentication method, which has the following problems:

[0021] 1) High maintenance cost: As the number of system users or devices increases, the whitelist will become larger and larger, requiring regular updates and maintenance, which will increase the complexity and cost of management. 2) Poor scalability: When new users or devices need to access the system, they must be manually added to the whitelist. This approach is feasible when the number of users or devices is small, but in large-scale systems, the scalability of this approach is poor. 3) Insufficient flexibility: Whitelist-based authentication mechanisms are usually relatively fixed and not adaptable to rapidly changing environments. When rapid response to changes is required, timely authentication services may not be provided. 4) Security risks: If the whitelist is accessed or tampered with without authorization, the security of the entire system may be threatened. In addition, whitelist-based authentication may rely on identifiable user information, which may expose user privacy. 5) Human error: The management of whitelists often involves manual operations, which may result in unauthorized users or devices being mistakenly added to the whitelist due to negligence or error, or forgetting to remove users or devices that no longer need access from the whitelist. 6) Lack of dynamism: Whitelist-based authentication mechanisms are not easy to implement dynamic access control, such as adjusting access permissions based on current environmental conditions or system status. 7) Performance issues: In systems with a large number of users or devices, each access control decision may require checking a large whitelist, which may have a negative impact on system performance.

[0022] In this regard, the present application embodiment provides an identity recognition and access management IAM component, such as Figure 1 As shown, the IAM component in the embodiment of the present application includes a second component and a first component. Further, the first component is used to generate a universal unique identification code, associate a corresponding access right with the universal unique identification code, and release the access right associated with the universal unique identification code; wherein the access right represents the resources accessed by the target device;

[0023] The universally unique identifier refers to UUID (Universally Unique Identifier). In a specific example, the first component in the IAM component may be PDP (Policy Decision Point), and the second component may be PEP (Policy Enforcement Point). PEP is the second component of the IAM component. On the one hand, its function is to execute access control policies and monitor access requests in the system. On the other hand, PEP communicates with PDP to obtain access control policies and decide whether to allow or deny specific access requests based on these policies. Figure 2 As shown in the specific example, PEP consists of an authorization instance module, an asynchronous processing algorithm module, and an IPC (inter-process communication) second component. PDP is the first component of the IAM component, and its function is to determine whether to allow a specific operation or access request based on the access policy associated with the UUID, such as Figure 2 As shown, PDP consists of a UUID generation and registration module, an access policy definition module, a resource association module, an authentication module, a data management module, and an IPC first component.

[0024] In addition, in a specific example, the UUID in the embodiment of the present application can be a 128-bit number, usually represented by 32 hexadecimal digits, divided into several groups and separated by hyphens, such as 123e4567-e89b-12d3-a456-426614174000. Since the UUID is unique, when authentication is performed through the UUID, it is not only highly secure, but also does not need to be maintained like a whitelist.

[0025] Furthermore, in the embodiments of the present application, the setting of accessible resources can be accessed through service ID: instance ID, or service ID: instance ID: method, that is, one service corresponds to one instance, but one instance can correspond to multiple methods, that is, resources can be accessed through multiple methods under the instance, or through one method under the instance.

[0026] Based on this, the second component in the embodiment of the present application receives the resources and universal unique identification code requested by the target device, and sends them to the first component based on the resources and universal unique identification code requested by the target process.

[0027] Furthermore, the first component in the embodiment of the present application can authenticate the universal unique identifier and send the authentication result to the second component. And the second component can send the authentication result to the target device, so that the target device determines whether to call the requested resource according to the authentication result.

[0028] It can be seen that the first component in the IAM component first generates a universal unique identification code and associates the corresponding access rights for the universal unique identification code, and releases the access rights associated with the universal unique identification code. Thereafter, the second component in the IAM component receives the resources and universal unique identification code requested by the target device, and sends the resources and universal unique identification code requested by the target device to the first component. The first component authenticates the universal unique identification code and sends the authentication result to the second component. The second component sends the authentication result to the target device so that the target device determines whether to call the requested resource based on the authentication result. It can be seen that in the embodiment of the present application, the IAM component uses a universal unique identification code to authenticate the target device. Due to the uniqueness of the universal unique identification code, the security of the authentication is improved, and the universal unique identification code can be better expanded. Compared with the whitelist in the prior art, it can be better maintained and managed, thereby solving the problem that the IAM component in the prior art performs authentication based on the whitelist, resulting in high maintenance costs and poor scalability.

[0029] In an optional implementation manner of an embodiment of the present application, with respect to a specific method of generating a universally unique identification code, the first component in an embodiment of the present application is also used to generate an initial universally unique identification code based on a random number after receiving a request sent by a target device for requesting the generation of a universally unique identification code, and to associate the universally unique identification code with corresponding access rights.

[0030] In this regard, in a specific example, the APP of the target device may send a request for generating a UUID to the first component in the IAM component, and then the first component in the IAM component generates a UUID using a cryptographically secure random number generator, formats the generated UUID data into a standard UUID format, such as 32 characters of 8-4-4-4-12, and finally outputs the formatted UUID for use by the app.

[0031] In addition, the specific process of the target device requesting the required resources from the IAM component in the embodiment of the present application can be: after the target device calls the second component to generate an authorization instance, the second component writes the authorization instance, the process ID of the second component, and the universal unique identification code requested by the target device into a serialized object, and formats the serialized object and sends it to the first component; wherein the authorization instance includes the requested resources; then, the first component authenticates the process ID and the universal unique identification code requested by the target device, and sends the authentication result to the second component; thereafter, the second component sends the authentication result to the target device, so that the target device determines whether to call the requested resources based on the authentication result.

[0032] It can be seen that in the embodiment of the present application, not only the universal unique identifier needs to be authenticated to determine whether there is a universal unique identifier corresponding to the target device in the IAM component, but also the process ID of the second component needs to be authenticated to determine whether the universal unique identifier currently sent to the first component is sent by the second component. It can be seen that when the IAM component calls its resources to the target device, multiple authentications are required to ensure the accuracy of the called resources.

[0033] In an optional implementation of an embodiment of the present application, the first component may predefine the access rights corresponding to the universal unique identifier, that is, which resources the corresponding target device can request. In addition, the first component may also define the operations performed on the accessible resources and the conditions for adjusting the access rights. It can be seen that the first component in the embodiment of the present application is also used to define the access rights as the resources accessible to the target device and the operations performed on the resources, as well as to set the conditions for dynamically adjusting the access rights.

[0034] That is, in the embodiment of the present application, the first component will define access rights for each universal unique identifier. These rights specify which resources the APP corresponding to the universal unique identifier can access and which operations it can perform. Furthermore, the resource can be presented in the form of service ID: instance ID, or service ID: instance ID: method. Taking service ID: instance ID as an example, the current service is to call the music function of the vehicle, and the instance is which song to play or which type of song to search for, etc. The content of the song is sent to the IAM component in the form of service ID: instance ID. After the IAM component obtains the service ID: instance ID, it authenticates it according to the requested UUID. If the authentication is successful, the music function of the vehicle is started according to the service ID: instance ID, and the corresponding music content is played. Furthermore, the access rights can also be dynamically adjusted according to specific conditions or triggers. For example, a target device previously had the permission to play music, but it can be adjusted in real time to restrict it from having the vehicle music playback function.

[0035] Further, in a specific example, the first component may be a resource that is adjustable in real time according to at least one of the following preset conditions: time, location, target event. Further, the adjustment of resources based on time as a preset condition may be, in a specific example, that when the vehicle is regularly maintained, all ECUs need to undergo comprehensive diagnostic and debugging operations. During the maintenance period, all ECUs should have the authority to read and write diagnostic data, but during normal operation, these permissions should be restricted to prevent unauthorized access and operation. Based on the location or target events occurring in the system, in a specific example, it may mean that the vehicle requires different operating permissions in different environments. For example, in a high-risk environment (such as a mountainous area), additional safety check permissions are required. When the vehicle enters a high-risk environment, additional safety check permissions are automatically enabled; when the vehicle is in a normal environment, these permissions should be disabled to avoid unnecessary operations.

[0036] In this regard, in a specific example, time-based can refer to the time period of a certain event, or it can refer to a preset time period. For example, when the vehicle undergoes regular maintenance, all computer control modules (Electronic Control Unit, ECU) need to undergo comprehensive diagnosis and debugging operations. During the maintenance period, all ECUs should have the authority to read and write diagnostic data, but during normal operation, these permissions should be restricted to prevent unauthorized access and operation. Based on the location or target events occurring in the system, the vehicle requires different operating permissions in different environments. For example, in high-risk environments (such as mountainous areas), additional safety check permissions are required. When the vehicle enters a high-risk environment, additional safety check permissions are automatically enabled; when the vehicle is in a normal environment, these permissions should be disabled to avoid unnecessary operations.

[0037] It should be noted that before authentication, the first component can generate corresponding authorization rules, that is, authentication and resource calls can be performed according to the authorization rules. Based on this, the first component in the embodiment of the present application is also used to associate access rights with universal unique identification codes, and generate corresponding authorization rules based on universal unique identification codes, processes and resources, wherein the authorization rules represent the authentication of the target device based on the universal unique identification code, process and resource in the process of the target device requesting to call resources.

[0038] Therefore, during the authentication process of the first component, the second component sends the process ID and the universal unique identifier of the second component that needs to be authenticated to the first component in a specific way. Specifically, the second component writes the authorization instance, the process ID of the second component, and the universal unique identifier of the request into the serialized object and performs format conversion, so that the authorization instance, the process ID of the second component, and the request ID of the request are arranged into byte sequence according to a fixed format, and the byte sequence is sent to the deserialization in the first component. It can be seen that in an embodiment of the present application, the second component can write the authorization instance information, the process ID (PID) of the second component of the IAM, and the request ID into the serialized object together and perform format conversion, so that the data is arranged into byte sequence according to a fixed format, and the data is transmitted on the network. In a specific example, the formatted serialized object can be sent to the first component by connecting the Domain Socket (domain name socket). Compared with traditional socket communication, the Domain Socket does not need to go through the network protocol stack, does not need to pack and unpack, calculate checksums, maintain sequence numbers and responses, etc., but only copies the application layer data from one process to another, which improves the communication efficiency and indirectly improves the operation efficiency of the IAM component.

[0039] After generating the authorization rules in advance and receiving the process ID of the second component and the requested universal unique identifier sent by the second component, the first component is also used to authenticate the process ID and universal unique identifier read from the deserialization based on the authorization rules. Specifically, the authentication process performed by the first component based on the authorization rules, that is, authenticating the target device based on the universal unique identifier, process and resource, includes the following steps:

[0040] Step 11, the first component compares the process ID read from the deserialization with the process ID in the serialized object;

[0041] Step 12: If the process ID read by the first component is inconsistent with the process ID in the serialized object, the first component returns a result of authentication failure to the second component;

[0042] Step 13, when the process ID read by the first component is consistent with the process ID in the serialized object, the first component verifies the universal unique identifier;

[0043] Step 14, when the verification universal unique identifier is invalid, the first component returns a result of authentication failure to the second component;

[0044] Step 15: When the UUID is verified to be valid, the first component checks whether the target device has the authority to access the access rights corresponding to the UUID.

[0045] For the above steps 11 to 15, in a specific example, it can be: if the process ID of the second IAM component read from the deserialization is consistent with the process ID read through the socket, the authentication initialization is successful, and further verification is made whether the universal unique identifier provided in the request is valid, that is, checking whether the universal unique identifier exists in the system's registration list. If the universal unique identifier is valid, the permission verification continues. If the universal unique identifier is invalid, the authentication result is directly returned to the second component. After the universal unique identifier is verified to be valid, a permission check will be performed to check whether the universal unique identifier in the request has the authority to access the requested resources, which includes verifying whether the universal unique identifier is in the access control list that allows access to the APP, or whether the universal unique identifier belongs to a role that has the right to access the APP. If the verification is successful, the IAM component will authorize the access request and allow the APP in the target device to access the resource. If the verification fails, access will be denied.

[0046] Based on this, when the second component receives the verification success sent by the first component, it determines that the authentication of the target device is successful, and sends the resources requested by the target device to the target device through an asynchronous call.

[0047] In the embodiments of the present application, accessible resources are called by asynchronous calls, which can not only execute time-consuming operations in the background without blocking the main thread, thereby improving the response speed and performance of the program, but also realize the simultaneous execution of multiple tasks, thereby improving the concurrency performance of the system. At the same time, system resources can be effectively managed to avoid waste and redundancy of resources, thereby improving the operating efficiency of the IAM component.

[0048] The present application is further explained below in conjunction with the specific implementation of the embodiment of the present application. The specific implementation provides an IAM component optimization design method based on UUID authentication. Figure 3 , the method steps in this specific implementation include:

[0049] Step 301, APP calls the UUID registration and generation module. When a process creates a service for the first time, it generates a UUID by calling the UUID registration and generation module. This UUID will be registered in the PDP of the IAM component as the unique identifier of the process.

[0050] Furthermore, if Figure 4 As shown, the steps of generating UUID method include:

[0051] Step 401, the APP requests to generate a new UUID;

[0052] Step 402: Generate a UUID using a cryptographically secure random number generator through a UUID generation and registration module.

[0053] Step 403, formatting the generated UUID data into a standard UUID format (such as 32 characters of 8-4-4-4-12);

[0054] Step 404: Output the formatted UUID for use by the APP.

[0055] It can be seen from the above steps 401 to 404 that in the embodiment of the present application, a UUID can be generated based on a random number generator. The UUID based on random numbers ensures uniqueness by generating a sufficiently large random number, thereby ensuring its anonymity, unpredictability, and untraceability. Therefore, no information such as a MAC address or other identifiers can be obtained from the UUID, which can fully protect user privacy. Therefore, a UUID version based on random numbers is adopted in the embodiment of the present application.

[0056] Step 302: The UUID generation and registration module calls the access policy definition module.

[0057] The automation policy defined in the access policy definition module defines access rights for each UUID. The rights specify which resources (service ID: instance ID or service ID: instance ID: method) the APP corresponding to the UUID can access and which operations it can perform. If necessary, the automation policy definition module can dynamically adjust access rights based on specific conditions or triggers.

[0058] For example, a user's permissions may change based on time, location, or specific events that occur in the system. Further, based on time: When the vehicle undergoes regular maintenance, comprehensive diagnostic and debugging operations are required on all ECUs. During the maintenance period, all ECUs should have permissions to read and write diagnostic data, but during normal operation, these permissions should be restricted to prevent unauthorized access and operation. Based on location or specific events that occur in the system: The vehicle requires different operating permissions in different environments. For example, in high-risk environments (such as mountainous areas), additional safety check permissions are required. When the vehicle enters a high-risk environment, additional safety check permissions are automatically enabled; when the vehicle is in a normal environment, these permissions should be disabled to avoid unnecessary operations.

[0059] Step 303: The access policy definition module calls the resource association module.

[0060] Among them, the resource association module automatically applies the defined access control policy to each UUID, associates the UUID with the permissions defined in these policies, and parses it into an authorization rule in the form of UUID, process and resource (service ID: instance ID or service ID: instance ID: method), and stores each authorization rule in the module.

[0061] Step 304, the APP calls the authorization instance module interface;

[0062] Among them, the object of the authorization instance is generated by means of process name and resources (service ID: instance ID or service ID: instance ID: method). At the same time, the APP passes the generated authorization instance to the asynchronous processing algorithm module to realize the asynchronous call of the authorization result. The following is a specific asynchronous processing algorithm flow, in which Promise is usually used to set the result of the asynchronous operation. In the embodiment of the present application, Promise is used to set the authorization result of the asynchronous operation, and future is used to obtain the result of the asynchronous operation. In the embodiment of the present application, Future is used to set the authorization result of the asynchronous operation. When the asynchronous processing function performs asynchronous operations, it does not affect the processing of other logics, that is, there is no need to continue waiting for the authorization result to continue to send new authorization objects to the first IAM component for processing.

[0063] Step 305, write the authorization instance information, the process ID (PID) of the second IAM component, and the request ID into the serialized object and perform format conversion, so that the data is arranged into byte sequence according to a fixed format to realize data transmission on the network. The second IPC component sends the formatted serialized object to the first IPC component by connecting to the Domain Socket.

[0064] In this regard, compared with traditional socket communication, UNIX Domain Socket does not need to go through the network protocol stack, does not need to pack and unpack, calculate checksums, maintain sequence numbers and responses, etc. It only copies application layer data from one process to another, which improves communication efficiency and indirectly improves the operating efficiency of IAM components.

[0065] Step 306, after receiving the data through the Domain Socket bound to the second component, the IPC first component passes it into the deserialized object, and reads the process ID and resources (service ID: instance ID or service ID: instance ID: method) of the IAM second component in the deserialized object to construct temporary authorization instance information, and stores it in the data management module.

[0066] Step 307, PDP performs authentication;

[0067] Among them, if the process ID of the second IAM component read from the deserialization is consistent with the process ID read through the socket, the authentication module is initialized successfully. At this time, the authentication module will verify whether the UUID provided in the request is valid, that is, check whether the UUID exists in the system's registration list. If the UUID is valid, the permission verification will continue. If the UUID is invalid, the authentication result will be directly returned to the second component. After the UUID verification is valid, the authentication module will perform a permission check to check whether the UUID in the request has permission to access the requested resources, which includes verifying whether the UUID is in the access control list that allows access to the APP, or whether the UUID belongs to a role that has permission to access the APP. If the verification is successful, the IAM module will authorize the access request and allow the APP to access the resources. If the verification fails, access will be denied.

[0068] Step 308: put the authentication result into a serialized object, format it, and send it to the asynchronous processing algorithm module of the second IAM component.

[0069] Step 309: After receiving the authentication result, the asynchronous processing algorithm module will deserialize it and assign the result to the Promise object. At this time, the APP obtains the authentication result of the asynchronous call through the Future object.

[0070] It can be seen from step 301 to step 309 in the above-mentioned embodiment of the present application that UUID provides a globally unique identifier for each APP and resource, which reduces the risk of identity conflicts. The UUID generated based on random numbers as used in this patent provides unpredictability and increases the security of the IAM component authentication process. In addition, UUID allows more dynamic access control because permissions can be instantly associated or disassociated with any UUID without updating the entire whitelist. And using UUID authentication can reduce management complexity because it is simpler to manage a single identifier than to maintain and review a long whitelist. As the number of users and resources increases, the UUID authentication mechanism can be better expanded, while traditional whitelists may become difficult to manage and maintain. In addition, since the UUID is automatically generated, the possibility of human input errors is reduced, but the probability of occurrence is higher when manually managing whitelists in the prior art.

[0071] Corresponding to the above Figure 1 , the embodiment of the present application provides an authentication method based on an IAM component, the IAM component includes a second component and a first component, such as Figure 5 As shown, the steps of the method include:

[0072] Step 501, the first component generates a universal unique identifier, associates a corresponding access right with the universal unique identifier, and releases the access right associated with the universal unique identifier; wherein the access right represents the resources accessed by the target device;

[0073] Step 502, the second component receives the resource and the universal unique identifier requested by the target device, and sends the resource and the universal unique identifier requested by the target process to the first component;

[0074] Step 503, the first component authenticates the universal unique identifier and sends the authentication result to the first component;

[0075] Step 504: The second component sends the authentication result to the target device, so that the target device determines whether to call the requested resource according to the authentication result.

[0076] Through the above steps 501 to 504, the first component in the IAM component first generates a universal unique identifier and associates the corresponding access rights for the universal unique identifier, and releases the access rights associated with the universal unique identifier. Thereafter, the second component in the IAM component receives the resources and universal unique identifier requested by the target device, and sends the resources and universal unique identifier requested by the target device to the first component. The first component authenticates the universal unique identifier and sends the authentication result to the second component. The second component sends the authentication result to the target device so that the target device determines whether to call the requested resource based on the authentication result. It can be seen that in the embodiment of the present application, the IAM component uses a universal unique identifier to authenticate the target device. Due to the uniqueness of the universal unique identifier, the security of the authentication is improved, and the universal unique identifier can be better expanded. Compared with the whitelist in the prior art, it can be better maintained and managed, thereby solving the problem that the IAM component in the prior art performs authentication based on the whitelist, resulting in high maintenance costs and poor scalability.

[0077] Further, in an optional implementation of the embodiment of the present application, the method of the first component generating a universal unique identification code involved in the above step 501 and associating the universal unique identification code with the corresponding access rights may further include: after receiving the request sent by the target device for requesting to generate a universal unique identification code, the first component generates an initial UUID based on a random number, and associates the universal unique identification code with the corresponding access rights;

[0078] The method in which the second component involved in the above step 502 receives the resources and universal unique identification code requested by the target device, and sends the resources and universal unique identification code requested by the target device to the first component, can further include: after the target device calls the second component to generate an authorization instance, the second component serializes the authorization instance, the process ID of the second component and the universal unique identification code requested by the target device and sends them to the first component.

[0079] like Figure 6 As shown, an embodiment of the present application provides an electronic device, including a processor 611, a communication interface 612, a memory 613 and a communication bus 614, wherein the processor 611, the communication interface 612, and the memory 613 communicate with each other through the communication bus 614.

[0080] Memory 613, used for storing computer programs;

[0081] In one embodiment of the present application, the processor 611 is used to execute the program stored in the memory 613 to implement the authentication method of the IAM component provided by any of the aforementioned method embodiments, and the role it plays is similar and will not be repeated here.

[0082] An embodiment of the present application also provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the authentication method of the IAM component provided in any of the aforementioned method embodiments are implemented.

[0083] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0084] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a general hardware platform, and of course, by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the relevant technology can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0085] It should be understood that the terms used herein are only for the purpose of describing specific example embodiments and are not intended to be limiting. Unless the context clearly indicates otherwise, the singular forms "one", "an" and "said" as used herein may also be meant to include plural forms. The terms "include", "comprise", "contain", and "have" are inclusive, and therefore specify the existence of stated features, steps, operations, elements and / or parts, but do not exclude the existence or addition of one or more other features, steps, operations, elements, parts, and / or combinations thereof. The method steps, processes, and operations described herein are not interpreted as necessarily requiring them to be performed in the specific order described or illustrated, unless the execution order is clearly indicated. It should also be understood that additional or alternative steps may be used.

[0086] The foregoing is merely a specific embodiment of the present invention, which enables those skilled in the art to understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features claimed herein.

Claims

1. An identity and access management (IAM) component, characterized in that: The IAM component includes a first component and a second component; The first component is used to generate a universal unique identifier, associate a corresponding access right with the universal unique identifier, and release the access right associated with the universal unique identifier; wherein the access right represents a resource accessed by the target device; The second component is used to receive the resource and the universal unique identifier requested by the target device, and send the requested resource and the universal unique identifier to the first component based on the target process; The first component is used to authenticate the universal unique identifier and send the authentication result to the second component; The second component is further configured to send the authentication result to the target device, so that the target device determines whether to call the requested resource according to the authentication result.

2. The IAM component according to claim 1, characterized in that: The first component is further configured to generate an initial universal unique identification code based on a random number after receiving a request for generating a universal unique identification code from a target device, and associate the universal unique identification code with a corresponding access right; The second component is further configured to, after the target device calls the second component to generate an authorization instance, serialize the authorization instance, the process ID of the second component, and the universal unique identifier requested by the target device and send them to the first component; wherein the authorization instance includes the requested resource; The first component is further used to authenticate the process ID and the universal unique identifier requested by the target device, and send the authentication result to the second component; The second component is further configured to send the authentication result to the target device, so that the target device determines whether to call the requested resource according to the authentication result.

3. The IAM component according to claim 2, characterized in that: The first component is further used to define the access rights as resources accessible to the target device and operations performed on the resources, and to set conditions for dynamically adjusting the access rights.

4. The IAM component according to claim 2, characterized in that: The first component is also used to associate the access permission with the universal unique identifier, and generate corresponding authorization rules based on the universal unique identifier, process and resource, wherein the authorization rule represents the authentication of the target device based on the universal unique identifier, process and resource when the target device requests to call a resource.

5. The IAM component according to claim 4, characterized in that: The second component is used to write the authorization instance, the process ID of the second component and the requested universal unique identifier into the serialized object and arrange them into byte sequence according to a fixed format, and send the byte sequence to the deserialization in the first component.

6. The IAM component according to claim 5, characterized in that: The first component is also used to authenticate the process ID and universal unique identifier read from the deserialization based on the authorization rule.

7. The IAM component according to claim 6, characterized in that: The first component compares the process ID read from the deserialization with the process ID in the serialized object, and returns a result of authentication failure to the second component when the process ID read by the first component is inconsistent with the process ID in the serialized object; and verifies the universal unique identifier when the process ID read by the first component is consistent with the process ID in the serialized object; The first component is also used to return an authentication failure result to the second component when it is verified that the universal unique identification code is invalid; when it is verified that the universal unique identification code is valid, check whether the target device has the authority to access the access rights corresponding to the universal unique identification code, and when it is determined that the target device has the authority to access the access rights corresponding to the universal unique identification code, return the verification result to the second component.

8. The IAM component according to claim 7, characterized in that: The second component is further used to determine that the authentication of the target device is successful when receiving the verification passed sent by the first component, and send the resources requested by the target device to the target device through an asynchronous call.

9. An authentication method based on the IAM component according to any one of claims 1 to 8, characterized in that: The method comprises: The first component generates a universal unique identifier, associates a corresponding access right with the universal unique identifier, and releases the access right associated with the universal unique identifier; wherein the access right represents a resource accessed by the target device; The second component receives the resource and the universal unique identifier requested by the target device, and sends the resource and the universal unique identifier requested by the target process to the first component based on the resource and the universal unique identifier; The first component authenticates the universal unique identifier and sends the authentication result to the first component; The second component sends the authentication result to the target device, so that the target device determines whether to call the requested resource according to the authentication result.

10. The method according to claim 9, characterized in that The first component generates a universal unique identification code and associates the universal unique identification code with corresponding access rights, including: after receiving a request for generating a universal unique identification code sent by a target device, the first component generates an initial UUID based on a random number, and associates the universal unique identification code with corresponding access rights; The second component receives the resources and universal unique identification code requested by the target device, and sends the resources and universal unique identification code requested by the target device to the first component, including: after the target device calls the second component to generate an authorization instance, the second component serializes the authorization instance, the process ID of the second component and the universal unique identification code requested by the target device and sends them to the first component.

Images