Dynamic self-adaptive identity authentication integrated controller

Abstract

The invention discloses a dynamic self-adaptive identity authentication integrated controller, and relates to the technical field of identity authentication, a login entrance guard plug-in in the identity authentication integrated controller is matched with a system framework of a target information system and is in butt joint with the target information system, and a login request sent to the target information system is sent to the login entrance guard plug-in. And the login entrance guard plug-in sends the login account number to the login entrance guard plug-in when determining that the butted identity authentication system passes the verification of the to-be-authenticated identity identifier, determining that the to-be-logged-in account number is a legal login account number, and determining that a user client mapping table stored in the plug-in server contains a mapping relationship between the to-be-logged-in account number and the to-be-authenticated identity identifier. According to the identity authentication integrated controller, on the basis that a bottom layer login authentication framework of the target information system is not redesigned, a multi-factor identity authentication process is accessed to the target information system, and safe transformation and upgrading of the target information system can be rapidly achieved.

Description

Technical Field

[0001] The present application relates to the field of identity authentication technology, and in particular to a dynamic and adaptive identity authentication integrated controller. Background Art

[0002] With the development of information technology and network informatization, people's work, study and lifestyle are undergoing tremendous changes, with efficiency greatly improved and information resources shared to the greatest extent. At the same time, information security has gradually become one of the issues that people are most concerned about. The leakage of personal privacy information is becoming increasingly serious, and personal data in cyberspace also needs to be protected urgently.

[0003] In order to ensure the security of information, cryptography technology must be used to protect various sensitive data in information systems.

[0004] The traditional identity authentication method is that the user enters the username and password and transmits it to the information system. The information system verifies the legitimacy of the user's identity by comparing the consistency with the user's registered data. The traditional identity authentication method encapsulates the username and password in the data message, which is easy to be stolen and the security is not ideal. Therefore, information systems with higher security requirements will consider adding two-factor authentication methods such as digital certificates, but this requires the redesign of the login authentication framework of the information system, which is difficult to implement and therefore difficult to promote. Summary of the invention

[0005] In view of the above problems and technical requirements, this application proposes a dynamic adaptive identity authentication integrated controller. The technical solution of this application is as follows:

[0006] A dynamically adaptive identity authentication integrated controller, the identity authentication integrated controller comprises a login gatekeeper plug-in and a plug-in server, the login gatekeeper plug-in and the plug-in server establish a connection, the login gatekeeper plug-in matches the system framework of the target information system, and the identity authentication integrated controller connects to the target information system and the identity authentication system respectively through the login gatekeeper plug-in; the plug-in server stores a user client mapping table of the target information system, and the user client mapping table of the target information system records the mapping relationship between the legal login account of the target information system and its corresponding legal identity identifier;

[0007] The login gatekeeper plug-in obtains the account to be logged in from the login request sent to the target information system, and determines the identity identifier to be authenticated corresponding to the account to be logged in;

[0008] The login guard plug-in confirms that the identity authentication system has successfully verified the identity to be authenticated, and when it determines that the account to be logged in is a legitimate login account of the target information system based on the login response returned by the intercepted target information system, and when it determines that the user client mapping table of the target information system stored in the plug-in server contains a mapping relationship between the account to be logged in and the identity to be authenticated, it confirms that the identity authentication of the account to be logged in has succeeded.

[0009] A further technical solution is that the login gatekeeper plug-in obtains the identity currently used by the account to be logged in as the identity to be authenticated, and sends a mapping verification request including the identity to be authenticated and the account to be logged in to the plug-in server;

[0010] When the plug-in server finds that the user client mapping table of the target information system contains the mapping relationship between the identity identifier to be authenticated in the mapping verification request and the account to be logged in, it returns a mapping verification success response to the login gatekeeper plug-in;

[0011] When receiving the mapping verification success response, the login gatekeeper plug-in determines that the user client mapping table of the target information system stored in the plug-in server contains a mapping relationship between the account to be logged in and the identity to be authenticated.

[0012] Its further technical solution is that the login gatekeeper plug-in sends a mapping verification request containing the account to be logged in to the plug-in server;

[0013] When the plug-in server finds that the user client mapping table of the target information system contains the mapping relationship of the account to be logged in in the mapping verification request, it returns a mapping verification success response containing the legal identity identifier corresponding to the account to be logged in to the login gatekeeper plug-in;

[0014] The login gatekeeper plug-in obtains the identity currently used by the account to be logged in as the identity to be authenticated, and when it is detected that the identity to be authenticated is consistent with the legal identity in the received mapping verification response, it is determined that the user client mapping table of the target information system contains the mapping relationship between the account to be logged in and the identity to be authenticated.

[0015] Its further technical solution is that after obtaining the identity currently used by the account to be logged in as the identity to be authenticated, the login gatekeeper plug-in sends an identity verification request containing the identity to be authenticated to the identity authentication system, and receives a challenge code returned by the identity authentication system;

[0016] The login guard plugin returns the challenge code to the account to be logged in, and receives the signature result of the challenge code signed by the identity to be authenticated, which is sent by the account to be logged in;

[0017] The login gatekeeper plug-in sends the signature result to the identity authentication system, and upon receiving the identity authentication success response returned by the identity authentication system, determines that the identity authentication system has verified the identity authentication success according to the signature result.

[0018] Its further technical solution is that the login gatekeeper plug-in sends a mapping verification request containing the account to be logged in to the plug-in server;

[0019] When the plug-in server finds that the user client mapping table of the target information system contains the mapping relationship of the account to be logged in in the mapping verification request, it returns a mapping verification success response containing the legal identity identifier corresponding to the account to be logged in to the login gatekeeper plug-in;

[0020] When the login gatekeeper plug-in receives the mapping verification success response returned by the plug-in server, it determines that the user client mapping table of the target information system contains the mapping relationship between the account to be logged in and the identity to be authenticated, and uses the legal identity corresponding to the account to be logged in contained in the mapping verification success response as the identity to be authenticated.

[0021] Its further technical solution is that after receiving the mapping verification success response returned by the plug-in server and obtaining the legal identity identifier corresponding to the account to be logged in as the identity identifier to be authenticated, the login gatekeeper plug-in sends an identity verification request containing the identity identifier to be authenticated to the identity authentication system, and the identity verification request is used to instruct the identity authentication system to verify the identity identifier to be authenticated;

[0022] The login gatekeeper plug-in receives a successful identification verification response returned by the identity authentication system, and the successful identification verification response indicates to the identity authentication system that the identification verification of the identity to be authenticated has succeeded.

[0023] A further technical solution is that when the plug-in server finds that the user client mapping table of the target information system does not contain the mapping relationship of the account to be logged in, it returns a binding prompt response to the login gatekeeper plug-in;

[0024] When the login gatekeeper plug-in receives the binding prompt response returned by the plug-in server, it jumps to prompt the login account to bind a legal identity.

[0025] Its further technical solution is to log in to the gatekeeper plug-in to obtain an identity binding request, where the identity binding request includes the account to be bound and the identity identifier to be bound;

[0026] When the login gatekeeper plug-in determines that the identity authentication system has verified the identity identifier to be bound, and determines that the account to be bound is a legal login account of the target information system based on the intercepted login response returned by the target information system, and determines that the user client mapping table of the target information system stored in the plug-in server does not contain the mapping relationship between the account to be bound and other legal identity identifiers, it generates a mapping establishment request including the account to be bound and the identity identifier to be bound and sends it to the plug-in server;

[0027] The plug-in server establishes a mapping relationship between the account to be bound and the identity to be bound in the received mapping establishment request and stores the mapping relationship in the user client mapping table of the target information system.

[0028] Its further technical solution is that the target information system is a web application system, and the login gatekeeper plug-in is a network proxy module developed for the web application system;

[0029] Alternatively, the target information system is a Linux operating system, and the login gatekeeper plug-in is a Linux shared library developed for local or remote user login in the Linux operating system;

[0030] Alternatively, the target information system is a Windows operating system, and the Login Gatekeeper plug-in is a Windows dynamic link library developed for local users or domain users of the Windows operating system to perform local or remote login;

[0031] Alternatively, the target information system is a database, and the login gatekeeper plug-in is a database shared library developed for the database.

[0032] A further technical solution is that when the login guard plug-in detects that the target information system has been logged out, or detects that the login account has been logged out, or detects that the trusted session between the target information system and the login account has expired, it deletes the trusted session and redirects to the initialization page.

[0033] Its further technical solution is that the login guard plug-in intercepts the response value of the target interface returned by the target information system to the login account. When it is detected that the target interface has a corresponding modification policy, the response value of the target interface is modified according to the modification policy corresponding to the target interface and then returned to the login account; otherwise, the response value of the target interface is directly returned to the login account.

[0034] A further technical solution is that the login gatekeeper plug-in obtains the access request sent by the login account to the target information system from the target information system, and intercepts the redirect jump request returned by the target information system to the login account;

[0035] The login gatekeeper plug-in detects whether the URL path carried in the redirect jump request matches the URL path in the access request;

[0036] When the login gatekeeper plug-in detects that the URL path carried in the redirect jump request does not match the URL path in the access request, it rewrites and repairs the URL path carried in the redirect jump request according to the URL path in the access request and then jumps;

[0037] When the login gatekeeper plug-in detects that the URL path carried in the redirect jump request matches the URL path in the access request, it directly jumps according to the URL path carried in the redirect jump request.

[0038] The beneficial technical effects of this application are:

[0039] The present application discloses a dynamically adaptive identity authentication integrated controller, which includes a login gatekeeper plug-in adapted to the system framework of a target information system. The login gatekeeper plug-in is connected to the function of calling the identity authentication system, and combined with the user client mapping table maintained by the plug-in server, it can connect the multi-factor identity authentication process to the target information system without redesigning the underlying login authentication framework of the target information system, and provide a simple and effective systematic identity authentication solution for equipment and computing security as well as application and data security in the commercial cryptographic application security transformation vigorously promoted by the country.

[0040] The identity authentication integrated controller can be applied to various operating systems and application systems, including user login of various web application systems such as banking applications or medical and health application systems, user login of various databases, local or remote user login of various Windows systems, and user login of various Linux systems. It has a wide range of applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 It is a schematic diagram of the structural block diagram of the identity authentication integrated controller of this application.

[0042] Figure 2 It is a flowchart of the identity authentication process implemented by the identity authentication integrated controller in one embodiment of the present application.

[0043] Figure 3 It is a flowchart of the identity authentication process implemented by the identity authentication integrated controller in another embodiment of the present application.

[0044] Figure 4 It is a flowchart of the identity authentication process implemented by the identity authentication integrated controller in another embodiment of the present application.

[0045] Figure 5 It is a flowchart of an identity authentication integrated controller implementing a function of modifying an interface response in another embodiment of the present application.

[0046] Figure 6 This is a flow chart of an identity authentication integrated controller in one embodiment of the present application to implement the function of supporting external jump protection. DETAILED DESCRIPTION

[0047] The specific implementation of the present application is further described below in conjunction with the accompanying drawings.

[0048] This application discloses a dynamic and adaptive identity authentication integrated controller. Please refer to Figure 1 The identity authentication integrated controller 100 includes a login guard plug-in 110 and a plug-in server 120, wherein:

[0049] (1) The identity authentication integrated controller 100 is connected to the target information system 200 through the login gatekeeper plug-in 110, and the login gatekeeper plug-in 110 matches the system framework of the target information system 200. When the system framework of the target information system 200 is different, the specific implementation of the login gatekeeper plug-in 110 in the identity authentication integrated controller 100 is also different accordingly, so that the identity authentication integrated controller 100 can adapt to different target information systems 200 to achieve dynamic self-adaptation.

[0050] The target information system 200 in this application includes various operating systems and application systems. When the system framework of the target information system 200 is different, the implementation method of the login gatekeeper plug-in 110 is also different:

[0051] In one embodiment, the target information system 200 is a web application system, and the login gatekeeper plug-in 110 matching the system framework of the target information system 200 is a network proxy module or a web service plug-in developed for the web application system.

[0052] In one embodiment, the target information system 200 is a Linux operating system, and the login gatekeeper plug-in 110 matching the system framework of the target information system 200 is a Linux plug-and-play authentication module PAM, ie, a Linux shared library, developed for local or remote user login of the Linux operating system.

[0053] In another embodiment, the target information system 200 is a Windows operating system, and the login gatekeeper plug-in 110 matching the system framework of the target information system 200 is a Windows authentication module plug-in WAM, also known as a Windows dynamic link library, developed for local users or domain users of the Windows operating system to perform local or remote logins.

[0054] In another embodiment, the target information system 200 is a database, and the login gatekeeper plug-in 110 matching the system framework of the target information system 200 is a database plug-and-play authentication module DAM developed for the database, that is, a database shared library, such as a Mysql database shared library.

[0055] Regardless of the system framework used by the target information system 200, it is only necessary to ensure that the login gatekeeper plug-in 110 is compatible with the underlying framework of the target information system 200 and connected to the target information system 200. When the target information system 200 is a distributed information system, multiple login gatekeeper plug-ins 110 need to be deployed on the same target information system.

[0056] (2) In the identity authentication integrated controller 100, the login gatekeeper plug-in 110 establishes a connection with the plug-in server 120. In actual implementation, the identity authentication integrated controller 100 of the present application often includes multiple login gatekeeper plug-ins 110, which are respectively connected to different target information systems 200, and each login gatekeeper plug-in 110 is matched with the system framework of the target information system to which it is connected. Figure 1 For example, the identity authentication integrated controller 100 includes N login gatekeeper plug-ins 110. These N login gatekeeper plug-ins 110 are respectively connected to the target information system 1 to the target information system N. Each login gatekeeper plug-in 110 matches the system framework of the information system that is connected to it, and N is an integer parameter. Each login gatekeeper plug-in 110 is connected to the plug-in server 120, and the plug-in server 120 provides services to the login gatekeeper plug-ins 110 connected to different target information systems 200.

[0057] The plug-in server 120 in the identity authentication integrated controller 100 of the present application stores a user client mapping table of the target information system to which the login gatekeeper plug-in is connected. The user client mapping table of the target information system records the mapping relationship between the legal login account of the target information system and its corresponding legal identity identifier. The legal login account is the login account that has completed registration in the target information system. The mapping relationship between the legal login account and the legal identity identifier is established and added to the user client mapping table of the target information system after the legal login account and the legal identity identifier are bound in the target information system. The process of establishing the mapping relationship will be introduced later. When the identity authentication integrated controller 100 includes multiple login gatekeeper plug-ins that are connected to different target information systems, the plug-in server 120 stores the user client mapping tables of each target information system respectively, such as Figure 1 In the example of FIG. 1 , the plug-in server 120 stores respective user-client mapping tables of the target information systems 1 to N. FIG.

[0058] (3) The identity authentication integrated controller 100 also connects to the external identity authentication system 300 through the login gatekeeper plug-in 110. The legal identity identifier of the target information system 200 is carried in the identity authentication client containing the digital certificate. The identity authentication system 300 connected to the login gatekeeper plug-in 110 is a digital certificate management and verification system used to provide services to the identity authentication client carrying the legal identity identifier of the target information system 200, and the two need to match. For example, it is common that the identity authentication client carrying the legal identity identifier of the target information system 200 is ukey, and the corresponding identity authentication system 300 is a signature verification server. For another common example, the identity authentication client carrying the legal identity identifier of the target information system 200 is an application with a digital certificate installed, and the corresponding identity authentication system 300 is the self-developed identity authentication system 300 corresponding to the application. Regardless of which identity authentication system 300 is connected, after the identity authentication integrated controller 100 connects to the identity authentication system 300 through the login gatekeeper plug-in 110, the digital certificate management and verification functions provided by the identity authentication system 300 can be called. When the identity authentication integrated controller 100 includes multiple login gatekeeper plug-ins 110, the login gatekeeper plug-in 110 connected to each target information system 200 is connected to the identity authentication system 300 respectively, and the identity authentication systems 300 connected to any two login gatekeeper plug-ins 110 can be the same or different.

[0059] After the identity authentication integrated controller 100 is connected to the target information system 200 and the identity authentication system 300 through the login gatekeeper plug-in 110, the multi-factor identity authentication process can be connected to the target information system 200 without modifying the login authentication framework of the target information system 200, thereby improving the security of the target information system 200. When the identity authentication integrated controller 100 of the present application is not connected, the identity authentication process implemented by the target information system 200 according to its own login authentication framework is as follows: the information system client corresponding to the target information system 200 sends a login request to the target information system 200, and the login request includes the account to be logged in and the login password used. The target information system 200 detects whether the account to be logged in and the login password in the login request match. When it is determined that the account to be logged in matches the login password, that is, it is determined that the account to be logged in is a legal login account, a login response indicating that the account to be logged in is a legal login account is returned to the information system client, and the login is jumped. When it is determined that the account to be logged in does not match the login password, that is, it is determined that the account to be logged in is not a legal login account, a login response indicating that the account to be logged in is not a legal login account is returned to the information system client, and the login is rejected. However, this conventional approach to identity authentication has poor reliability.

[0060] After the identity authentication integrated controller 100 of the present application is connected to the target information system 200, the multi-factor identity authentication process of the target information system 200 implemented based on the identity authentication integrated controller 100 is as follows:

[0061] The login gatekeeper plug-in 110 obtains the account to be logged in from the login request sent to the target information system 200, and the login gatekeeper plug-in 110 also determines the identity identifier to be authenticated corresponding to the account to be logged in.

[0062] The login request will still be sent to the target information system 200 normally, and the target information system 200 will authenticate the login request according to its own login authentication framework and return the corresponding login response. While the target information system 200 authenticates the login request according to its own login authentication framework, the login gatekeeper plug-in 110 will call the identity authentication system 300 to verify the identity identifier to be authenticated corresponding to the login account, and the login gatekeeper plug-in 110 will also verify the mapping relationship between the login account and its corresponding identity identifier to be authenticated according to the user client mapping table of the target information system stored in the plug-in server 120.

[0063] When the target information system 200 completes the authentication of the login request according to its own login authentication framework and returns a login response, the login gatekeeper plug-in 110 will also intercept the login response returned by the target information system.

[0064] The login gatekeeper plug-in 110 finally determines that the identity authentication of the account to be logged in has passed when it is determined that the identity authentication system 300 has successfully verified the identity identifier to be authenticated corresponding to the account to be logged in, and when it is determined that the user client mapping table of the target information system stored in the plug-in server 120 contains the mapping relationship between the account to be logged in and the identity identifier to be authenticated, and when it is determined that the account to be logged in is a legitimate login account of the target information system 200 according to the login response returned by the intercepted target information system 200. This means that the account to be logged in is a legitimate login account of the target information system, and the identity identifier used by the account to be logged in is a legitimate identity identifier of the target information system 200, and the account to be logged in and the identity identifier used by the account to be logged in have a mapping relationship in advance, thereby realizing multi-factor identity authentication.

[0065] In the framework of the above identity authentication process, when the identity authentication client is different, there will be differences in the specific implementation methods, which can be mainly divided into two categories:

[0066] In the first case, the login guard plug-in 110 can directly obtain the identity currently used by the account to be logged in, such as when the identity used by the account to be logged in is carried in the ukey. In this case, the login guard plug-in 110 will directly use the identity currently used by the account to be logged in as the identity to be authenticated corresponding to the account to be logged in. The identity authentication system mainly verifies the legality of the authenticated identity, that is, verifies whether the identity to be authenticated is legal. In this case, the overall framework for multi-factor identity authentication is: first verify whether the identity currently used is a legal identity, and verify whether the account to be logged in is a legal login account, and then verify whether there is a mapping relationship between the account to be logged in and the identity currently used. Under this authentication framework:

[0067] 1. The method to verify whether the currently used identity is a legal identity is:

[0068] After obtaining the identity currently used by the account to be logged in as the identity to be authenticated, the login gatekeeper plug-in 110 sends an identity verification request including the identity to be authenticated to the identity authentication system 300. After receiving the identity verification request, the identity authentication system 300 returns a challenge code to the login gatekeeper plug-in 110. The login gatekeeper plug-in 110 receives the challenge code returned by the identity authentication system 300, and returns the challenge code to the account to be logged in. After receiving the challenge code, the account to be logged in will use the currently used identity, that is, use the identity to be authenticated to sign the challenge code and send it to the login gatekeeper plug-in 110. The login gatekeeper plug-in 110 receives the signature result of the challenge code sent by the account to be logged in after signing with the identity to be authenticated.

[0069] The login gatekeeper plug-in 110 sends the signature result to the identity authentication system 300, and the identity authentication system 300 verifies the signature result using the identity to be authenticated in the identity verification request. The identity authentication system 300 returns an identity verification success response to the login gatekeeper plug-in 110 if the identity to be authenticated is verified according to the signature result, otherwise it returns an identity verification failure response to the login gatekeeper plug-in 110.

[0070] When the login gatekeeper plug-in 110 receives the identity verification success response returned by the identity authentication system 300, it determines that the identity authentication system 300 has passed the authentication identity authentication according to the signature result, thereby determining that the identity authentication currently used by the account to be logged in is a legal identity authentication. When the login gatekeeper plug-in 110 receives the identity verification failure response returned by the identity authentication system 300, it determines that the identity authentication system 300 has failed the authentication identity authentication, thereby determining that the identity authentication currently used by the account to be logged in is not a legal identity authentication, and at this time, it can be directly determined that the identity authentication of the account to be logged in has failed.

[0071] 2. The method to verify whether the account to be logged in is a legitimate account is:

[0072] Determine whether the account to be logged in is a legitimate login account of the target information system 200 according to the intercepted login response returned by the target information system 200 .

[0073] 3. There are two different ways to verify whether there is a mapping relationship between the account to be logged in and the currently used identity:

[0074] (1) The plug-in server 120 verifies whether there is a mapping relationship between the account to be logged in and the currently used identity identifier:

[0075] After the login gatekeeper plug-in 110 determines that the identity authentication system 300 has successfully verified the identity to be authenticated, and determines that the account to be logged in is a legitimate login account of the target information system 200 based on the intercepted login response returned by the target information system 200, it sends a mapping verification request containing the identity to be authenticated and the account to be logged in to the plug-in server 120.

[0076] The plug-in server 120 will receive the mapping verification request and parse it to obtain the identity to be authenticated and the account to be logged in. Then the plug-in server 120 queries whether the user client mapping table of the target information system 200 connected to the login gatekeeper plug-in 110 contains the mapping relationship between the identity to be authenticated in the mapping verification request and the account to be logged in. When the plug-in server 120 determines that the user client mapping table of the target information system 200 contains the mapping relationship between the identity to be authenticated in the mapping verification request and the account to be logged in, it returns a mapping verification pass response to the login gatekeeper plug-in 110. When the plug-in server 120 determines that the user client mapping table of the target information system 200 contains the mapping relationship between the account to be logged in in the mapping verification request and other legal identity identifiers, it returns a mapping verification failure response to the login gatekeeper plug-in 110.

[0077] When the login gatekeeper plug-in 110 receives the mapping verification success response returned by the plug-in server 120, it determines that the user client mapping table of the target information system stored in the plug-in server 120 contains a mapping relationship between the account to be logged in and the identity to be authenticated, indicating that the account to be logged in is a legal login account at this time, and the identity currently used by the account to be logged in is the legal identity that has a binding relationship with the account to be logged in, thereby determining that the identity authentication of the account to be logged in is successful.

[0078] (2) The login guard plug-in 110 verifies whether there is a mapping relationship between the account to be logged in and the currently used identity identifier:

[0079] After the login gatekeeper plug-in 110 determines that the identity authentication system 300 has successfully authenticated the identity to be authenticated, and determines that the account to be logged in is a legitimate login account of the target information system 200 based on the login response returned by the intercepted target information system 200, the mapping verification request containing the account to be logged in is sent to the plug-in server 120.

[0080] The plug-in server 120 receives the mapping verification request and parses it to obtain the account to be logged in. Then the plug-in server 120 queries whether the user client mapping table of the target information system 200 connected to the login gatekeeper plug-in 110 contains the mapping relationship between the account to be logged in in the mapping verification request and its legal identity identifier. When the plug-in server 120 determines that the user client mapping table of the target information system 200 contains the mapping relationship of the account to be logged in in the mapping verification request, it returns a mapping verification pass response containing the legal identity identifier corresponding to the account to be logged in to the login gatekeeper plug-in 110.

[0081] On the other hand, the login guard plug-in 110 obtains the identity identifier currently used by the account to be logged in as the identity identifier to be authenticated, and when it is detected that the identity identifier to be authenticated is consistent with the legal identity identifier in the received mapping verification response, it is determined that the user client mapping table of the target information system 200 contains a mapping relationship between the account to be logged in and the identity identifier to be authenticated, indicating that the account to be logged in is a legal login account at this time, and the identity identifier currently used by the account to be logged in is the legal identity identifier that has a binding relationship with the account to be logged in, thereby determining that the identity authentication of the account to be logged in is passed.

[0082] Under this authentication framework, in business scenarios, there are different implementation methods for verifying whether the currently used identity is a legitimate identity and verifying whether the account to be logged in is a legitimate account. Two implementation examples are given below:

[0083] Example 1: First, obtain the identity currently used by the account to be logged in and verify whether it is a legal identity, then obtain the account to be logged in to verify whether it is a legal account. Please refer to Figure 2 The flowchart shown:

[0084] Step 201 , the login gatekeeper plug-in 110 establishes a session and obtains the identity currently used by the account to be logged in as the identity to be authenticated.

[0085] Step 202 : the login gatekeeper plug-in 110 sends an identity verification request including the identity to be authenticated to the identity authentication system 300 .

[0086] Step 203 : The identity authentication system 300 returns a challenge code to the login guard plug-in 110 .

[0087] Step 204 , the login gatekeeper plug-in 110 returns the challenge code to the account to be logged in, and the account to be logged in signs the challenge code using the identity to be authenticated and sends it to the login gatekeeper plug-in 110 .

[0088] Step 205 , the login gatekeeper plug-in 110 receives the signature result of the challenge code signed by the identity identifier to be authenticated and sent by the account to be logged in.

[0089] Step 206 , the login gatekeeper plug-in 110 sends the signature result to the identity authentication system 300 .

[0090] Step 207 , the identity authentication system 300 verifies the identity to be authenticated according to the signature result, and returns a verification success response or a verification failure response to the login gatekeeper plug-in 110 .

[0091] Step 208, after the login gatekeeper plug-in 110 receives the identity verification success response returned by the identity authentication system 300, it converts the session into a UK session and binds the identity to be authenticated, obtains the account to be logged in corresponding to the UK session from the login request sent to the target information system 200, and intercepts the login response returned by the target information system 200 for the login request.

[0092] After receiving the identity verification failure response returned by the identity authentication system 300, the login gatekeeper plug-in 110 determines that the identity authentication of the login account has failed.

[0093] Step 209, after determining that the account to be logged in is a legitimate account according to the intercepted login response, the login gatekeeper plug-in 110 sends a mapping verification request to the plug-in server 120, and the mapping verification request includes the account to be logged in corresponding to the UK session and the identity to be authenticated bound to the UK session.

[0094] Step 210 , the plug-in server 120 queries the user client mapping table of the target information system 200 to see whether it contains a mapping relationship between the identity identifier to be authenticated in the mapping verification request and the account to be logged in, and returns a mapping verification pass response or a mapping verification fail response to the login gatekeeper plug-in 110 .

[0095] Step 212, when the login gatekeeper plug-in 110 receives the mapping verification success response, it determines that the identity authentication of the login account is passed, and converts the UK session to a trusted session. When the login gatekeeper plug-in 110 receives the mapping verification failure response, it determines that the identity authentication of the login account is not passed.

[0096] Example 2: First, obtain the account to be logged in to verify whether it is a legitimate account, then obtain the identity identifier currently used by the account to be logged in and verify whether it is a legitimate identity identifier. Please refer to Figure 3 The flowchart shown:

[0097] Step 301, the login gatekeeper plug-in 110 establishes a session and obtains the account to be logged in from the login request sent to the target information system, and the target information system 200 verifies the login request and returns a login response.

[0098] Step 302: the login gatekeeper plug-in 110 intercepts the login response returned by the target information system 200 in response to the login request.

[0099] Step 303, when the login gatekeeper plug-in 110 determines that the account to be logged in is a legitimate login account of the target information system according to the intercepted login response returned by the target information system, it converts the session into an account session and saves the account to be logged in in the account session.

[0100] Step 304 , the login gatekeeper plug-in 110 obtains the identity identifier currently used by the account to be logged in as the identity identifier to be authenticated.

[0101] Step 305 : the login gatekeeper plug-in 110 sends an identification verification request including the identity identification to be authenticated to the identity authentication system 300 .

[0102] Step 306 : The identity authentication system 300 returns a challenge code to the login gatekeeper plug-in 110 .

[0103] Step 307 , the login gatekeeper plug-in 110 returns the challenge code to the account to be logged in, and the account to be logged in signs the challenge code using the identity to be authenticated and sends it to the login gatekeeper plug-in 110 .

[0104] Step 308, the login gatekeeper plug-in 110 receives the signature result of the challenge code signed by the identity to be authenticated, which is sent by the account to be logged in.

[0105] Step 309 , the login guard plug-in 110 sends the signature result to the identity authentication system 300 .

[0106] Step 310 , the identity authentication system 300 verifies the identity to be authenticated according to the signature result, and returns a verification success response or a verification failure response to the login gatekeeper plug-in 110 .

[0107] Step 311, after receiving the identity verification success response returned by the identity authentication system 300, the login gatekeeper plug-in 110 sends a mapping verification request of the account to be logged in in the account session to the plug-in server 120. When the login gatekeeper plug-in 110 receives the identity verification failure response returned by the identity authentication system 300, it directly determines that the identity authentication of the account to be logged in has failed.

[0108] Step 312, when the plug-in server 120 finds that the user client mapping table of the target information system 200 contains the mapping relationship between the account to be logged in and the legal identity identifier in the mapping verification request, it returns a mapping verification success response containing the legal identity identifier of the account to be logged in to the login gatekeeper plug-in 110.

[0109] Step 313, when the login gatekeeper plug-in 110 receives the mapping verification success response and determines that the legal identity in the mapping verification success response is consistent with the identity to be authenticated, it is determined that the identity authentication of the login account is passed, and the account session is converted to a trusted session. When the login gatekeeper plug-in 110 receives the mapping verification failure response, it is determined that the identity authentication of the login account is not passed.

[0110] In the second case, the login guard plug-in 110 will not directly obtain the identity identifier currently used by the account to be logged in, such as when the identity identifier used by the account to be logged in is carried in the application. In this case, the overall framework for multi-factor identity authentication is: first verify whether the account to be logged in is a legitimate login account, and determine whether there is a legitimate identity identifier with a mapping relationship with the account to be logged in, and then verify whether the legitimate identity identifier is the identity identifier currently used by the account to be logged in. In this case, the identity authentication system mainly verifies the authentication identity identifier for authorization, that is, verifies whether the identity identifier to be authenticated is the identity identifier currently used by the account to be logged in. Under this authentication framework, please refer to Figure 4 The flowchart shown:

[0111] When the login gatekeeper plug-in 110 determines that the account to be logged in is a legitimate login account of the target information system according to the intercepted login response returned by the target information system, it sends a mapping verification request containing the account to be logged in to the plug-in server 120 .

[0112] The plug-in server 120 receives the mapping verification request and parses it to obtain the account to be logged in. Then the plug-in server 120 queries whether the user client mapping table of the target information system 200 connected to the login gatekeeper plug-in 110 contains the mapping relationship between the account to be logged in in the mapping verification request and its legal identity identifier. When the plug-in server 120 determines that the user client mapping table of the target information system 200 contains the mapping relationship of the account to be logged in in the mapping verification request, it returns a mapping verification pass response containing the legal identity identifier corresponding to the account to be logged in to the login gatekeeper plug-in 110.

[0113] When the login gatekeeper plug-in 110 receives the mapping verification success response returned by the plug-in server, it determines that the user client mapping table of the target information system contains the mapping relationship between the account to be logged in and the identity to be authenticated, and uses the legal identity corresponding to the account to be logged in contained in the mapping verification success response as the identity to be authenticated.

[0114] After receiving the mapping verification response returned by the plug-in server 120 and obtaining the legal identity corresponding to the account to be logged in as the identity to be authenticated, the login gatekeeper plug-in 110 sends an identity verification request containing the identity to be authenticated to the identity authentication system 300, and the identity verification request is used to instruct the identity authentication system to verify the identity to be authenticated. After receiving the identity verification request, the identity authentication system 300 verifies the identity to be authenticated according to the adopted verification mechanism, including: the identity authentication system 300 sends a challenge code to the identity to be authenticated. When the identity currently used by the account to be logged in is the identity to be authenticated and the authorization is determined, the account to be logged in will use the identity to be authenticated to sign the challenge code to obtain the signature result and return it to the identity authentication system 300. The identity authentication system 300 verifies the signature result using the identity to be authenticated, and when the signature result is verified, it returns an identity verification pass response to the login gatekeeper plug-in 110. When the identity authentication system 300 fails to verify the signature result or does not receive the signature result after timeout, it returns an identity verification failure response to the login gatekeeper plug-in 110.

[0115] When the login gatekeeper plug-in 110 receives the identity verification success response returned by the identity authentication system, it determines that the identity authentication system 300 has passed the identity authentication, that is, it determines that the identity authentication is the identity currently used by the account to be logged in. When the login gatekeeper plug-in 110 receives the identity verification failure response returned by the identity authentication system 300, it determines that the identity authentication system 300 has failed to verify the identity authentication, indicating that the identity authentication is not the identity currently used by the account to be logged in. It may be that the identity authentication has timed out and has not responded or the account to be logged in is not authorized, and the login gatekeeper plug-in 110 determines that the identity authentication of the account to be logged in has failed.

[0116] Regardless of the above situation, when the plug-in server 120 queries the user client mapping table of the target information system, it may also appear that the user client mapping table does not contain the mapping relationship of the account to be logged in, that is, the account to be logged in as a legal login account has not been bound to the corresponding legal identity identifier. At this time, the plug-in server 120 will return a binding prompt response to the login gatekeeper plug-in 110. When the login gatekeeper plug-in 110 receives the binding prompt response returned by the plug-in server 120, it jumps to prompt the account to be logged in to enter the binding process to bind the legal identity identifier, thereby adding the corresponding mapping relationship in the user client mapping table.

[0117] In the binding process, the login gatekeeper plug-in 110 will obtain an identity binding request, which includes the account to be bound and the identity to be bound. The login gatekeeper plug-in 110 will generate a mapping establishment request including the account to be bound and the identity to be bound and send it to the plug-in server 120 when it determines that the identity authentication system 300 has passed the verification of the identity to be bound, and determines that the account to be bound is a legal login account of the target information system based on the login response returned by the intercepted target information system 200, and determines that the user client mapping table of the target information system stored in the plug-in server 120 does not contain the mapping relationship between the account to be bound and other legal identity identifiers. Then the plug-in server 120 establishes a mapping relationship between the account to be bound and the identity to be bound in the received mapping establishment request and stores it in the user client mapping table of the target information system, thereby establishing a binding relationship between the account to be bound and the identity to be bound. At this time, the account to be bound is a legal login account of the target information system, and the identity to be bound is a legal identity identifier that has a mapping relationship with the account to be bound. There are also different specific implementation methods in the above-mentioned first and second categories of situations:

[0118] In the above-mentioned first type of situation, the account to be bound initiates a login request as the account to be logged in, and the identity to be bound is used as the identity currently used by the account to be logged in. After the above-mentioned verification process, in step 210 of the above-mentioned instance 1 of the above-mentioned first type of situation, or step 312 of the above-mentioned instance 2 of the first type of situation, when the plug-in server 120 queries the user client mapping table of the target information system 200 and finds that the mapping relationship of the account to be logged in is not included, it will return a binding prompt response to the login gatekeeper plug-in 110. The login gatekeeper plug-in 110 receives the binding prompt response returned by the plug-in server 120 and jumps to prompt the account to be logged in to enter the binding process. When the account to be bound is determined to be bound to the identity to be bound, due to the verification mechanism of the first type of situation, it has been verified that the account to be logged in is a legal login account, and it has also been verified that the identity currently used by the account to be logged in is a legal identity, and it has been determined that the account to be logged in has not established a mapping relationship with other identity identifiers. Then, the login guard plug-in 110 will directly generate a mapping establishment request including the account to be bound and the identity to be bound and send it to the plug-in server 120 to establish a mapping relationship between the account to be logged in and its currently used identity identifier, and determine that the identity authentication of the account to be logged in is passed.

[0119] In the second case, when the account to be bound initiates a login request as the account to be logged in, when the plug-in server 120 finds that the mapping relationship of the account to be logged in is not included in the user client mapping table of the target information system 200, it will return a binding prompt response to the login gatekeeper plug-in 110. The login gatekeeper plug-in 110 receives the binding prompt response returned by the plug-in server 120 and jumps to prompt the account to be logged in to enter the binding process, and requests the identity authentication system 300 to send a challenge code to the account to be bound. The account to be bound signs the challenge code with the identity to be bound, and then sends the signature result to the identity authentication system 300. After the identity authentication system 300 verifies the signature result, it sends a verification response containing the identity to be bound to the login gatekeeper plug-in 110. When the login gatekeeper plug-in 110 receives the verification response containing the identity to be bound returned by the identity authentication system 300, it determines that the identity to be bound is a legal identity. Due to the verification mechanism of the second type of situation, it has been determined that the account to be logged in is a legal login account and it has not established a mapping relationship with other identity identifiers. Therefore, the login gatekeeper plug-in 110 will generate a mapping establishment request containing the account to be bound and the identity to be bound and send it to the plug-in server 120 to establish a mapping relationship between the account to be logged in and the identity identifier currently used by it.

[0120] In one embodiment, after the identity authentication integrated controller of the present application completes the above-mentioned multi-factor identity authentication process, the login gatekeeper plug-in 110 deletes the trusted session to exit the session when it detects that the target information system 200 has been logged out, or detects that the login account has been logged out, or detects that the trusted session between the target information system 200 and the login account has expired, and then redirects to the initialization page. The initialization page can be a customized page that does not require login.

[0121] In another embodiment, the login gatekeeper plug-in 110 of the identity authentication integrated controller also supports the function of modifying the interface response, please refer to Figure 5 , the login account normally accesses the target information system 200, and the target information system 200 returns its own web page to the login account for display. Now most websites obtain data through asynchronous interfaces to display page content. The login gatekeeper plug-in 110 intercepts the response value of the target interface returned by the target information system 200 to the login account. When it is detected that the target interface has a corresponding modification policy, the response value of the target interface is modified according to the modification policy corresponding to the target interface and returned to the login account, otherwise the response value of the target interface is directly returned to the login account. The modification policies corresponding to different interfaces can be customized.

[0122] There are three common implementation scenarios for the above-mentioned function of modifying the interface response:

[0123] Scenario 1: The current WEB application system development is relatively flexible. When some WEB application systems use websockets, there will be problems with cross-domain access of websockets. If the host connected to the websocket is returned through other interfaces, the function of modifying the interface response can be used to unify the host to avoid the problem of cross-domain access of websockets.

[0124] Scenario 2: The content and even the link address of the page rendering components of some application systems are also obtained from the interface. The application system itself knows that it is host_A, but the address proxied by the login gatekeeper plug-in 110 may be host_B. If the application system returns the link address through its own interface, it is very likely to be its own host_A, and host_A is internally forwarded to the login gatekeeper plug-in 110 and cannot be exposed. Therefore, the login gatekeeper plug-in 110 can modify host_A to host_B through this interface response modification function.

[0125] Scenario 3: Some application systems need to have personalized display after logging into the gatekeeper plug-in 110 agent, such as marking an identity authentication mark. At this time, this method can also be used to modify the interface to complete the personalized display content.

[0126] In another embodiment, the login guard plug-in 110 of the identity authentication integrated controller 100 also supports an external jump protection function, please refer to Figure 6 , the login account normally accesses the application system, manually enters the URL or records the URL in the browser, and the application system is correctly accessed but the request path is incorrect. For example, in most cases, the login account directly enters https: / / www.example.com, but the real address is https: / / www.example.com / console / admin. When the application system finds that the URL path entered by the login account is incorrect, it will send a redirection request (301 / 302 jump request) to the browser. At this time, the login gatekeeper plug-in 110 obtains the access request sent by the login account to the information system from the target information system 200, and intercepts the redirection jump request returned by the information system to the login account. Then the login gatekeeper plug-in 110 detects whether the URL path carried in the redirection jump request matches the URL path in the access request of the login account. When the login gatekeeper plug-in detects that the URL path carried in the redirection jump request does not match the URL path in the access request, it rewrites and repairs the URL path carried in the redirection jump request according to the URL path in the access request sent by the login account, and then jumps. When the login gatekeeper plug-in detects that the URL path carried in the redirect jump request matches the URL path in the access request, it directly jumps according to the URL path carried in the redirect jump request.

[0127] In another embodiment, the multi-factor authentication service provided by the identity authentication integrated controller 100 can also cooperate with a data integrity monitoring engine to monitor the key sensitive data of the information system. The identity authentication integrated controller 100 also connects to the data integrity monitoring engine through the login gatekeeper plug-in 110, and the user client mapping table of the target information system stored in the plug-in server 120 also stores the modification permissions of each legal login account. The login gatekeeper plug-in 110 obtains the data modification request sent by the legal login account from the target information system 200, and sends the legal login account and the data modification request to the plug-in server 120. The plug-in server 120 queries whether the data modification request matches the modification permission of the corresponding legal login account in the user client mapping table, and returns the modification permission query result to the login gatekeeper plug-in 110 and sends it to the data integrity monitoring engine via the login gatekeeper plug-in 110. The data integrity monitoring engine monitors and feedbacks the data modification operation of the login account according to the modification permission query result, so that it can prompt, warn, or even perform access blocking when the data is tampered with by certain login accounts, while supporting the legal modification of data by login accounts with specific authorization. This type of security protection is particularly meaningful for application data in scenarios such as banking application systems or medical application systems, because it can effectively protect the integrity of important financial or medical data, thereby effectively preventing fraud, ensuring compliance, supporting decision-making, and maintaining trust. It can also support data operation and maintenance under legal circumstances, and realize the demand for using hardware-level cryptographic security to safeguard the data security of important application systems that are important to the national economy and people's livelihood.

[0128] In another embodiment, the multi-factor authentication service provided by the authentication integrated controller 100 can also cooperate with a data encryption and decryption engine to protect key sensitive data from leakage. When the data is encrypted, normal users are allowed to use the data, while all unknown users are prohibited from using the data. For example, for database data, when a normal application system login account accesses the database data, a data decryption service is automatically provided, and for abnormal application system login accounts, such as only operating system users, even if they are super users of the operating system, no data decryption service is provided, thereby maximizing the protection of the confidentiality of the application system data without affecting the normal use of the data.

[0129] Although the above description provides an example of one or more processes or devices or systems, it should be understood that other processes or devices or systems may be within the scope of the appended claims. It should be understood that the embodiments described in this disclosure can be implemented in a variety of computing devices, including but not limited to servers, appropriately programmed general-purpose computers, cameras, sensors, audio / video encoding and playback devices, set-top box TV boxes, television broadcast equipment, mobile devices and self-driving cars. The embodiments described in this disclosure can be implemented by hardware or software including instructions for configuring one or more processors to perform the functions described herein. Software instructions can be stored on any suitable non-transient computer-readable memory, including CD, RAM, ROM, flash memory, etc.

[0130] It should be understood that the embodiments described in this application and the modules, routines, processes, threads or other software components that implement the described methods / processes / frameworks can be implemented using standard computer programming techniques and languages. The application is not limited to specific processors, computer languages, computer programming conventions, data structures, other such implementation details. Those skilled in the art will recognize that the described methods / processes can be implemented as a part of a computer executable code stored in a volatile or non-volatile memory, as a part of a special integrated chip (ASIC), etc. It is obvious to those skilled in the art that certain adaptations and modifications can be made to the described methods / processes / frameworks, and the embodiments discussed above should be considered to be illustrative rather than restrictive.

[0131] The above is only a preferred embodiment of the present application, and the present application is not limited to the above embodiments. It is understood that other improvements and changes directly derived or associated by those skilled in the art without departing from the spirit and concept of the present application should be considered to be included in the protection scope of the present application.

Claims

1. A dynamic and adaptive identity authentication integrated controller, characterized in that: The identity authentication integrated controller includes a login gatekeeper plug-in and a plug-in server, the login gatekeeper plug-in establishes a connection with the plug-in server, the login gatekeeper plug-in matches the system framework of the target information system, and the identity authentication integrated controller connects to the target information system and the identity authentication system respectively through the login gatekeeper plug-in; The plug-in server stores a user-client mapping table of the target information system, wherein the user-client mapping table of the target information system records a mapping relationship between a legal login account of the target information system and its corresponding legal identity identifier; The login gatekeeper plug-in obtains the account to be logged in from the login request sent to the target information system, and determines the identity identifier to be authenticated corresponding to the account to be logged in; The login gatekeeper plug-in confirms that the identity authentication system has successfully verified the identity to be authenticated, and determines that the account to be logged in is a legitimate login account of the target information system based on the intercepted login response returned by the target information system, and when it determines that the user client mapping table of the target information system stored in the plug-in server contains a mapping relationship between the account to be logged in and the identity to be authenticated, the identity authentication of the account to be logged in is successful.

2. The identity authentication integrated controller according to claim 1, characterized in that: The login gatekeeper plug-in obtains the identity currently used by the account to be logged in as the identity to be authenticated, and sends a mapping verification request including the identity to be authenticated and the account to be logged in to the plug-in server; When the plug-in server finds that the mapping relationship between the identity identifier to be authenticated in the mapping verification request and the account to be logged in is contained in the user client mapping table of the target information system, the plug-in server returns a mapping verification success response to the login gatekeeper plug-in; When receiving the mapping verification success response, the login gatekeeper plug-in determines that the user client mapping table of the target information system stored in the plug-in server contains a mapping relationship between the account to be logged in and the identity to be authenticated.

3. The identity authentication integrated controller according to claim 1, characterized in that: The login gatekeeper plug-in sends a mapping verification request containing the account to be logged in to the plug-in server; When the plug-in server finds that the mapping relationship of the account to be logged in in the mapping verification request is contained in the user client mapping table of the target information system, it returns a mapping verification success response containing the legal identity identifier corresponding to the account to be logged in to the login gatekeeper plug-in; The login gatekeeper plug-in obtains the identity identifier currently used by the account to be logged in as the identity identifier to be authenticated, and when it is detected that the identity identifier to be authenticated is consistent with the legal identity identifier in the received mapping verification response, it is determined that the user client mapping table of the target information system contains a mapping relationship between the account to be logged in and the identity identifier to be authenticated.

4. The identity authentication integrated controller according to claim 2 or 3, characterized in that: After obtaining the identity currently used by the account to be logged in as the identity to be authenticated, the login gatekeeper plug-in sends an identity verification request including the identity to be authenticated to the identity authentication system, and receives a challenge code returned by the identity authentication system; The login gatekeeper plug-in returns the challenge code to the account to be logged in, and receives the signature result sent by the account to be logged in after signing the challenge code using the identity to be authenticated; The login gatekeeper plug-in sends the signature result to the identity authentication system, and determines that the identity authentication system has passed the identity authentication based on the signature result when receiving the identity authentication success response returned by the identity authentication system.

5. The identity authentication integrated controller according to claim 1, characterized in that: The login gatekeeper plug-in sends a mapping verification request containing the account to be logged in to the plug-in server; When the plug-in server finds that the mapping relationship of the account to be logged in in the mapping verification request is contained in the user client mapping table of the target information system, it returns a mapping verification success response containing the legal identity identifier corresponding to the account to be logged in to the login gatekeeper plug-in; When the login gatekeeper plug-in receives the mapping verification success response returned by the plug-in server, it determines that the user client mapping table of the target information system contains a mapping relationship between the account to be logged in and the identity to be authenticated, and uses the legal identity corresponding to the account to be logged in contained in the mapping verification success response as the identity to be authenticated.

6. The identity authentication integrated controller according to claim 5, characterized in that: After receiving the mapping verification success response returned by the plug-in server and obtaining the legal identity identifier corresponding to the to-be-logged account as the to-be-authenticated identity identifier, the login gatekeeper plug-in sends an identity verification request containing the to-be-authenticated identity identifier to the identity authentication system, wherein the identity verification request is used to instruct the identity authentication system to verify the to-be-authenticated identity identifier; The login gatekeeper plug-in determines that the identity authentication system has successfully authenticated the identity to be authenticated upon receiving the identity authentication success response returned by the identity authentication system.

7. The identity authentication integrated controller according to claim 2, 3 or 5, characterized in that: When the plug-in server finds that the user client mapping table of the target information system does not contain the mapping relationship of the account to be logged in, the plug-in server returns a binding prompt response to the login gatekeeper plug-in; When the login gatekeeper plug-in receives the binding prompt response returned by the plug-in server, it jumps to prompt the account to be logged in to bind a legal identity identifier.

8. The identity authentication integrated controller according to claim 7, characterized in that: The login gatekeeper plug-in obtains an identity binding request, wherein the identity binding request includes an account to be bound and an identity identifier to be bound; When the login gatekeeper plug-in determines that the identity authentication system has verified the identity identifier to be bound, and determines that the account to be bound is a legal login account of the target information system based on the intercepted login response returned by the target information system, and determines that the user client mapping table of the target information system stored in the plug-in server does not contain the mapping relationship between the account to be bound and other legal identity identifiers, the login gatekeeper plug-in generates a mapping establishment request including the account to be bound and the identity identifier to be bound and sends it to the plug-in server; The plug-in server establishes a mapping relationship between the account to be bound and the identity to be bound in the received mapping establishment request and stores the mapping relationship in the user client mapping table of the target information system.

9. The identity authentication system according to claim 1, characterized in that: The target information system is a web application system, and the login gatekeeper plug-in is a network proxy module developed for the web application system; Alternatively, the target information system is a Linux operating system, and the login gatekeeper plug-in is a Linux shared library developed for local or remote user login of the Linux operating system; Alternatively, the target information system is a Windows operating system, and the login gatekeeper plug-in is a Windows dynamic link library developed for local users or domain users of the Windows operating system to perform local login or remote login; Alternatively, the target information system is a database, and the login gatekeeper plug-in is a database shared library developed for the database.

10. The identity authentication integrated controller according to claim 1, characterized in that: When the login gatekeeper plug-in detects that the target information system has been logged out, or detects that the login account has been logged out, or detects that the trusted session between the target information system and the login account has expired, the trusted session is deleted and redirected to the initialization page.

11. The identity authentication integrated controller according to claim 1, characterized in that: The login guard plug-in intercepts the response value of the target interface returned by the target information system to the login account. When it is detected that the target interface has a corresponding modification policy, the response value of the target interface is modified according to the modification policy corresponding to the target interface and then returned to the login account; otherwise, the response value of the target interface is directly returned to the login account.

12. The identity authentication integrated controller according to claim 1, characterized in that: The login gatekeeper plug-in obtains the access request sent by the login account to the target information system from the target information system, and intercepts the redirection jump request returned by the target information system to the login account; The login gatekeeper plug-in detects whether the URL path carried in the redirect jump request matches the URL path in the access request; When the login gatekeeper plug-in detects that the URL path carried in the redirect jump request does not match the URL path in the access request, it rewrites and repairs the URL path carried in the redirect jump request according to the URL path in the access request and then jumps; When the login gatekeeper plug-in detects that the URL path carried in the redirect jump request matches the URL path in the access request, it directly jumps according to the URL path carried in the redirect jump request.

Images