Unified authentication system access method and device, computer equipment and storage medium

Abstract

The embodiment of the invention provides a unified authentication system access method and device, computer equipment, a storage medium and a computer program product, and relates to the technical field of Internet. The method comprises the following steps: receiving a data access request triggered by an access user through a data access terminal, and determining a target access platform corresponding to the data access request according to the data access request; if the user account of the access user meets the regional access permission and the platform access permission of the target access platform, initiating an agent request for the data access request to the target access platform; the target access platform is used for acquiring a data providing packet according to the proxy request and returning the data providing packet to the authentication server; receiving a data providing packet sent by the target access platform, and sending the data providing packet to the data access terminal; and the data access terminal is used for analyzing and displaying the data providing packet. According to the method, the security and efficiency of data access are improved.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, and in particular to a unified authentication system access method, apparatus, computer equipment, storage medium and computer program product. Background Art

[0002] In a multi-platform system environment, the businesses of different platform systems are relatively independent. Based on the different business processing needs of users, users may need to register and log in to platform accounts of different platforms. When users log in to different platforms, they need to use different user accounts and user passwords, which will bring cumbersome account management problems to users and will also cause certain security risks. Therefore, there will be a problem of low security. Summary of the invention

[0003] Based on this, it is necessary to provide a unified authentication system access method, device, computer equipment, storage medium and computer program product to address the above technical issues.

[0004] In a first aspect, the present application provides a unified authentication system access method, which is applied to an authentication server of the unified authentication system. The method comprises:

[0005] Receiving a data access request triggered by an access user through a data access terminal, and determining a target access platform corresponding to the data access request according to the data access request;

[0006] If the user account of the accessing user satisfies the regional access rights and platform access rights of the target access platform, a proxy request for the data access request is initiated to the target access platform; the target access platform is used to obtain a data provision package according to the proxy request, and return the data provision package to the authentication server;

[0007] The data providing package sent by the target access platform is received, and the data providing package is sent to the data access terminal; the data access terminal is used to parse and display the data providing package.

[0008] In one of the embodiments, before receiving the data access request triggered by the accessing user through the data access terminal, it also includes: receiving a login request triggered by the accessing user through the data access terminal, and obtaining the user identification information of the accessing user contained in the login request; obtaining the area permission list of the accessing user based on the user identification information; the area permission list includes area permission information of multiple areas, and platform permission information of multiple platforms within each of the areas; sending the area permission list to the data access terminal; the data access terminal is used to display the area permission list, and in response to the accessing user's selection operation on the target access area and the target access platform in the area permission list, send the data access request to the authentication server.

[0009] In one of the embodiments, after determining the target access platform corresponding to the data access request based on the data access request, the method further includes: obtaining user identification information and user account information of the accessing user; obtaining an identity authentication result of the accessing user based on the user identification information and the user account information; and obtaining user credentials of the accessing user when the identity authentication result indicates that the identity authentication of the accessing user is successful, and carrying the user credentials in the proxy request.

[0010] In one of the embodiments, after determining the target access platform corresponding to the data access request based on the data access request, the method further includes: obtaining access permission information of the user account of the access user for the target access platform; obtaining access permission review results of the user account of the access user based on the access permission information; the access permission review results are used to characterize whether the user account of the access user meets the regional access permission and the platform access permission of the target access platform.

[0011] In one of the embodiments, determining the target access platform corresponding to the data access request based on the data access request includes: obtaining the platform address information of the target access platform based on the access address information contained in the data acquisition request; and determining the target access platform corresponding to the data access request based on a pre-built platform-address mapping table and the platform address information.

[0012] In one of the embodiments, the method further includes: obtaining access authorization information of the access user contained in the data provision package; the access authorization information is used to complete the authorization authentication of the access user on the target access platform; based on the user account information of the access user, the platform information of the target access platform and the access authorization information, generating associated storage information for the access user, and storing the associated storage information.

[0013] In a second aspect, the present application provides a unified authentication system access device, which is applied to an authentication server of the unified authentication system. The device includes:

[0014] A receiving module, configured to receive a data access request triggered by an access user through a data access terminal, and determine a target access platform corresponding to the data access request according to the data access request;

[0015] A request initiation module, configured to initiate a proxy request for the data access request to the target access platform if the user account of the access user satisfies the regional access rights and platform access rights of the target access platform; the target access platform is configured to obtain a data provision package according to the proxy request, and return the data provision package to the authentication server;

[0016] The sending module is used to receive the data providing package sent by the target access platform, and send the data providing package to the data access terminal; the data access terminal is used to parse and display the data providing package.

[0017] In a third aspect, the present application further provides a computer device. The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0018] Receiving a data access request triggered by an access user through a data access terminal, and determining a target access platform corresponding to the data access request according to the data access request;

[0019] If the user account of the accessing user satisfies the regional access rights and platform access rights of the target access platform, a proxy request for the data access request is initiated to the target access platform; the target access platform is used to obtain a data provision package according to the proxy request, and return the data provision package to the authentication server;

[0020] The data providing package sent by the target access platform is received, and the data providing package is sent to the data access terminal; the data access terminal is used to parse and display the data providing package.

[0021] In a fourth aspect, the present application further provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0022] Receiving a data access request triggered by an access user through a data access terminal, and determining a target access platform corresponding to the data access request according to the data access request;

[0023] If the user account of the accessing user satisfies the regional access rights and platform access rights of the target access platform, a proxy request for the data access request is initiated to the target access platform; the target access platform is used to obtain a data provision package according to the proxy request, and return the data provision package to the authentication server;

[0024] The data providing package sent by the target access platform is received, and the data providing package is sent to the data access terminal; the data access terminal is used to parse and display the data providing package.

[0025] In a fifth aspect, the present application further provides a computer program product. The computer program product includes a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0026] Receiving a data access request triggered by an access user through a data access terminal, and determining a target access platform corresponding to the data access request according to the data access request;

[0027] If the user account of the accessing user satisfies the regional access rights and platform access rights of the target access platform, a proxy request for the data access request is initiated to the target access platform; the target access platform is used to obtain a data provision package according to the proxy request, and return the data provision package to the authentication server;

[0028] The data providing package sent by the target access platform is received, and the data providing package is sent to the data access terminal; the data access terminal is used to parse and display the data providing package.

[0029] In the above-mentioned unified authentication system access method, apparatus, computer equipment, storage medium and computer program product, a data access request triggered by an access user through a data access terminal is received, and according to the data access request, a target access platform corresponding to the data access request is determined; if the user account of the access user meets the regional access rights and platform access rights of the target access platform, a proxy request for the data access request is initiated to the target access platform; the target access platform is used to obtain a data provision package according to the proxy request, and return the data provision package to the authentication server; the data provision package sent by the target access platform is received, and the data provision package is sent to the data access terminal; the data access terminal is used to parse and display the data provision package. In the method provided in the embodiment of the present application, a unified authentication system can be introduced. When the access user needs to access different platforms, the unified authentication system can be used to perform unified authentication authorization and proxy forwarding of access requests, thereby improving the security of authentication authorization and the efficiency of data access. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0031] FIG1 is a schematic diagram of a flow chart of a unified authentication system access method provided in an embodiment of the present application;

[0032] FIG2 is a schematic diagram of a process for obtaining a regional permission list of an access user provided in an embodiment of the present application;

[0033] FIG3 is a schematic diagram of a process for obtaining user credentials of an accessing user provided in an embodiment of the present application;

[0034] FIG4 is a structural block diagram of a unified authentication system access device provided in an embodiment of the present application;

[0035] FIG5 is a diagram of the internal structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0036] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0037] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0038] Glossary

[0039] CN2: China Net Next Carrying Network (CN2), in the embodiment of the present application, refers to the network channel opened between the content center and each region.

[0040] IPTVCDN: An interactive Internet Protocol Television (IPTV) platform based on Content Delivery Network (CDN) services and architecture.

[0041] In an exemplary embodiment, as shown in FIG1 , a unified authentication system access method is provided. This embodiment is illustrated by applying the method to a server. It is understandable that the method can also be applied to a terminal, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0042] Step 102: receiving a data access request triggered by an access user through a data access terminal, and determining a target access platform corresponding to the data access request according to the data access request.

[0043] Among them, the unified authentication system access method provided in the embodiment of the present application can be applied to the IPTVCDN management platform, which covers integrated management functions such as resources, scheduling, configuration, and distribution. In a possible implementation method, the IPTVCDN management platform can be sunk to each region. In order to facilitate the access user (for example, cloud company personnel or cloud platform operation and maintenance personnel) to quickly log in to the IPTVCDN management platform after sinking in each province, the back-end service of the Menggui National Center jumps to the target provincial center through the CN2 network for proxy access, so as to realize the proxy forwarding capability of the Menggui National Center management platform to access the corresponding regional management platform after clicking on a certain area. Among them, the unified authentication system can be the Menggui National Center, and the access user can be a cloud company personnel or a cloud platform operation and maintenance personnel. The access user can access the unified authentication system at the login entrance of the data acquisition terminal, that is, enter the necessary login credentials such as the user name and password on the login page to trigger the login request. After the back end of the central platform receives the login request, it will first perform a preliminary verification of the credentials entered by the access user (for example, check whether the access username and password format is correct, etc.). If the preliminary verification is passed, the access user logs in successfully. After that, the data access terminal requests the access user's permission list interface for the first time. The request of the permission list interface is mainly used for login audit. The central backend will obtain the header information in the request, especially Gap - Auth - Email (which may contain identification information such as the access user's mailbox) and G*p - One - T**en (token information related to the access user's login session). Then, Gap - One - Token is encrypted with md5 to obtain gws****onid_md5. Next, the central platform backend will query the database and determine whether the login record already exists based on plat = ipt**cm (platform identification related), account = Gap - Auth -Email and gws****nid_md5. This step is mainly to prevent repeated logins. If the record exists, it means that the access user is already logged in or there is a record of the same login session before; if it does not exist, the login information of the access user is recorded to complete the access user login audit process.After completing the login audit, the backend of the central platform will obtain the regional authority list (for example, regional authority list) possessed by the current logged-in access user and the platform list of the access user's access rights in each region (area) according to the access user's identity information and system configuration, and will also generate a corresponding Uniform Resource Locator (URL) (its format is such as https: / / domain name / platform key?code=region code, which is used to construct a jump link for subsequent access to the target access platform). The regional authority list contains regional authority information for multiple regions and platform authority information for multiple platforms within each region. The backend of the central platform, that is, the authentication server of the unified authentication system, can send the regional authority list to the data access terminal. The access user can trigger the selection operation for the target access area and the target access platform through the data access terminal. The data access terminal can respond to the access user's selection operation for the target access area and the target access platform in the regional authority list and send a data access request to the authentication server of the unified authentication system. The data access request may include user identification information, user account information, central platform domain name, routing, and data to be obtained. This data access request is used to indicate that the access user wishes to access the target access platform corresponding to the target access area (assuming that "axe" represents a specific business platform). For example, the access user enters a specific central platform domain name and route in the data access terminal (such as a browser) (for example, by entering the address "https: / / i***nc-console-dev.ct***n.cn / axe?code=11" in the browser address bar, where "ip***c-console-dev.c***n.cn" is the central platform domain name, that is, the unified authentication system domain name, " / axe" is the route, and "code=11" represents the target access area).

[0044] Step 104 : If the user account of the accessing user satisfies the regional access rights and platform access rights of the target access platform, a proxy request for the data access request is initiated to the target access platform.

[0045] Among them, after the central platform backend, that is, the authentication server of the unified authentication system receives the data access request from the data access terminal, it will make another permission judgment. This judgment is mainly to prevent illegal access through the construction of URL. That is, to verify whether the current access user really has the access rights to the target access area and the target access platform. If the second permission judgment is passed, the central platform backend will perform identity authentication and access management system login authentication according to the configured user name and password. The specific operation is to call the / iam / gw / auth / Login interface for authentication. If the authentication is successful, an id (that is, the user's cookie credential) will be obtained. The user credential will be used for identity authentication when accessing the target access platform in the future, representing the user's legal identity in the session.

[0046] Further, after receiving the data access request from the data access terminal, the backend of the central platform, i.e., the authentication server of the unified authentication system, identifies the target access area and target access platform (i.e., the "axe" platform of ** Province) corresponding to the data access request according to the pre-defined correspondence between the route and the provincial platform homepage, which can be called the platform-address mapping table. Then, the backend of the central platform will initiate a proxy request to the homepage of the target access platform through the CN2 network in its own identity, which can be understood as the central platform replacing the access user to obtain data from the target access platform. In this process, the central platform may configure some request header information (such as Cookies set in certain steps, etc.) as needed, so that it can pass the authentication or meet the specific requirements of the target access platform when requesting to the target access platform. For example, according to the code carried in the data access request (such as code=11 for ** Province), the backend of the central platform obtains the axe platform homepage address corresponding to the area from the configuration. Then, the header information is set, where Cookie:cdn_tgc=user's cookie credentials, to prepare for the upcoming proxy request to the axe platform homepage. The target access platform is used to obtain the data provision package according to the proxy request and return the data provision package to the authentication server. In addition, the central platform backend can store the user credentials of the accessing user, which can be saved in the redis cache in the form of {md5+platform+region code of the user devopsone platform Gap-One-Token} as the key, value="cdn_tgc=cookie", and the validity period can be set. This process can facilitate the subsequent jump to the axe platform. Each time a request must pass through the central platform, the credential can be used directly without the need to go through the tedious username and password authentication process again, thereby improving the access efficiency of the system and enhancing security. This is because the credentials in the redis cache are time-sensitive and encrypted, and are not easily illegally obtained and used.

[0047] Step 106, receiving the data providing package sent by the target access platform, and sending the data providing package to the data access terminal.

[0048] Among them, the backend of the central platform uses the configured header information (including cookie credentials, i.e. user credentials) to initiate a proxy request to the homepage of the target access platform (axe platform in ** province) through the CN2 network. After receiving the proxy request, the target access platform will verify whether the user cookie credentials sent by the central platform are valid according to its own authentication and authorization mechanism. If the user cookie credentials are valid, the target access platform can integrate the data to be obtained included in the data access request, which includes the homepage data (including page content, resource files, etc.), and generate an access authorization information token corresponding to the access rights of the access user in the target access area and the target access platform. The token contains key information such as the identity information, scope of authority, and validity period of the access user in the target access area and the target access platform, and is an important authorization identifier for the subsequent access user to perform various operations in the target access area and the target access platform. Furthermore, a data provision package can be generated based on the data to be obtained and the access authorization information token, and the data provision package can be returned to the central platform. After the central platform receives the homepage data and access authorization information token returned by the target access platform, it will associate the token with the user's current access and the corresponding area and platform information (it may be stored in memory or other suitable data storage structures for subsequent quick retrieval), and return the homepage data to the browser of the data access terminal for interface rendering. At this point, the access user has completed the unified authentication login process through the IPTVCDN central platform and obtained the token corresponding to the target access area and target access platform. The subsequent operations of the access user in the target access area and target access platform will be authorized and verified based on this token.

[0049] In addition, when the access user initiates a request in the data access terminal browser (such as accessing a target access platform page by entering the central platform domain name and related routes, such as https: / / iptvnc-console-dev.ctcdn.cn / axe?code=11), the browser will automatically add the reffer field in the request header. For the URL request embedded in the platform homepage, the value of reffer is the request address of the homepage, that is, https: / / iptvnc-console-dev.ctcdn.cn / axe?code=11. After the central platform backend receives the request, it can obtain the value of reffer from the request header. Then, by parsing this reffer address, the region and platform corresponding to the request are determined according to pre-set rules (such as specific parameters, path structure, etc.). For example, from the above reffer address, according to "code=11", it can be determined that the region is ** Province (assuming that 11 corresponds to the code of ** Province), and according to "axe", it can be determined that the platform is the axe platform (assuming that this is a pre-defined platform identifier). After the homepage is rendered in the data access terminal browser, the situation is different when the links embedded in the page (such as secondary page links, static file requests, etc.) initiate requests. For requests initiated by the request URL embedded in the secondary request static files (such as .css / .js, etc.), the browser's reffer will become the URL of the parent page, not the original homepage URL. This results in the backend being unable to directly determine the region and platform information when obtaining the reffer in the usual way. In response to this situation, the backend needs to perform regular matching processing on the embedded paths of the secondary requests. For example, set a regular expression to match these embedded paths (assuming the regular expression is / (\ / .*?\.(css|js)) / , which is used to match paths ending with .css or .js). After matching these paths, process them and uniformly add the { / prefix platform / region code} flag. For example, for a static file path of a secondary request, https: / / iptvnc-console-dev.ctcdn.cn / static / css / chunk-0159db68.482b471d.css, it may become https: / / iptvnc-console-dev.ctcdn.cn / { / prefix / axe / 11} / static / css / chunk-0159db68.482b471d.css after processing (here, axe is assumed to be the platform and 11 is the region code). When the central platform backend receives the request with the added flag, it matches the { / prefix / } path and obtains the region and platform information from the flag according to the pre-set parsing rules.For example, from the above processed path, the central platform backend can parse that the platform is axe and the region is ** province (corresponding code 11).

[0050] In the method of this embodiment, a data access request triggered by an access user through a data access terminal is received, and the target access platform corresponding to the data access request is determined according to the data access request; if the user account of the access user meets the regional access rights and platform access rights of the target access platform, a proxy request for the data access request is initiated to the target access platform; the target access platform is used to obtain a data provision package according to the proxy request, and return the data provision package to the authentication server; the data provision package sent by the target access platform is received, and the data provision package is sent to the data access terminal; the data access terminal is used to parse and display the data provision package. In the method provided in the embodiment of the present application, a unified authentication system can be introduced. When the access user needs to access different platforms, the unified authentication system can be used to perform unified authentication authorization and proxy forwarding of access requests, thereby improving the security of authentication authorization and improving the efficiency of data access.

[0051] In an exemplary embodiment, as shown in FIG2 , before receiving the data access request triggered by the access user through the data access terminal in step 102 , steps 202 to 206 may be included. Among them:

[0052] Step 202: receiving a login request triggered by an access user through a data access terminal, and obtaining user identification information of the access user contained in the login request.

[0053] The user identification information may be information used to identify the identity information of the accessing user, such as a user name or a user account.

[0054] Step 204: Obtain the area authority list of the access user according to the user identification information.

[0055] The regional authority list includes regional authority information of multiple regions and platform authority information of multiple platforms within each region.

[0056] Step 206: Send the area authority list to the data access terminal.

[0057] The data access terminal is used to display the area authority list, and in response to the access user's selection operation on the target access area and the target access platform in the area authority list, send a data access request to the authentication server.

[0058] Among them, after completing the login audit, the backend of the central platform will obtain the regional authority list (for example, regional authority list) possessed by the current logged-in access user and the platform list of the access user's access rights under each area (region) according to the access user's identity information and system configuration, and will also generate a corresponding Uniform Resource Locator (URL) (its format is such as https: / / domain name / platform key?code=region code, which is used to construct a jump link for subsequent access to the target access platform). The regional authority list contains regional authority information for multiple regions and platform authority information for multiple platforms within each region. The backend of the central platform, that is, the authentication server of the unified authentication system, can send the regional authority list to the data access terminal, and the access user can trigger the selection operation for the target access area and the target access platform through the data access terminal. The data access terminal can respond to the access user's selection operation for the target access area and the target access platform in the regional authority list and send a data access request to the authentication server of the unified authentication system.

[0059] In the method of this embodiment, after receiving a login request triggered by an accessing user, the central platform, i.e., the unified authentication system, can perform a login audit, and after the login audit, determine the access rights of the accessing user, thereby improving the security of system access and data access.

[0060] In an exemplary embodiment, as shown in FIG3 , after determining the target access platform corresponding to the data access request according to the data access request in step 102 , steps 302 to 306 may be included. Among them:

[0061] Step 302: Obtain the user identification information and user account information of the accessing user.

[0062] Step 304: Obtain the identity authentication result of the accessing user according to the user identification information and the user account information.

[0063] Step 306: When the identity authentication result indicates that the identity authentication of the accessing user is successful, the user credentials of the accessing user are obtained and carried in the proxy request.

[0064] After the central platform backend, that is, the authentication server of the unified authentication system, receives the data access request from the data access terminal, it will make another permission judgment. This judgment is mainly to prevent illegal access through the construction of URL. That is, to verify whether the current access user really has the access rights to the target access area and the target access platform. If the second permission judgment is passed, the central platform backend will perform identity authentication and access management system login authentication according to the configured user name and password. The specific operation is to call the / iam / gw / auth / Login interface for authentication. If the authentication is successful, an id (that is, the user's cookie credential) will be obtained. The user credential will be used for identity authentication when accessing the target access platform in the future, representing the user's legal identity in the session.

[0065] In the method of this embodiment, the central platform can perform a second verification on the permissions of the accessing user and can generate user credentials for the accessing user. The user credentials will be used for identity authentication when subsequently accessing the target access platform, representing the user's legitimate identity in the session, thereby improving the security of system access and data access, and improving the efficiency of user access.

[0066] In an exemplary embodiment, after determining the target access platform corresponding to the data access request according to the data access request in step 102, the following may be included:

[0067] Obtain access permission information of the user account of the accessing user for the target access platform; obtain access permission review results of the user account of the accessing user based on the access permission information; the access permission review results are used to indicate whether the user account of the accessing user meets the regional access permission and platform access permission of the target access platform.

[0068] After receiving the data access request from the data access terminal, the authentication server of the central platform, i.e. the unified authentication system, will make another permission judgment. This judgment is mainly to prevent illegal access through the construction of URLs. That is, to verify whether the current access user actually has the access rights to the target access area and target access platform.

[0069] In the method of this embodiment, the central platform can perform secondary verification on the access rights of the accessing user, thereby improving the security of system access and data access.

[0070] In an exemplary embodiment, determining the target access platform corresponding to the data access request according to the data access request in step 102 may include:

[0071] According to the access address information included in the data acquisition request, the platform address information of the target access platform is acquired; according to the pre-built platform-address mapping table and the platform address information, the target access platform corresponding to the data access request is determined.

[0072] Among them, after the central platform backend, that is, the authentication server of the unified authentication system, receives the data access request from the data access terminal, it identifies the target access area and target access platform (i.e., the "axe" platform of ** Province) corresponding to the data access request based on the pre-defined routing and the correspondence between the provincial platform homepage, which can be called the platform-address mapping table. Then, the central platform backend will initiate a proxy request to the homepage of the target access platform through the CN2 network in its own identity, which can be understood as the central platform replacing the access user to obtain data from the target access platform. In this process, the central platform may configure some request header information (such as Cookies set in certain steps, etc.) as needed, so that it can pass the authentication or meet the specific requirements of the target access platform when requesting to the target access platform. For example, according to the code carried in the data access request (such as code=11 for ** Province), the central platform backend obtains the axe platform homepage address corresponding to the area from the configuration. Then, the header information is set, where Cookie:cdn_tgc=user's cookie credentials, to prepare for the upcoming proxy request to the axe platform homepage.

[0073] In the method of this embodiment, the central platform can use the platform-address mapping table to identify the target access area and target access platform corresponding to the data access request, thereby improving the efficiency of user access.

[0074] In an exemplary embodiment, the embodiment of the present application further includes the following steps, which are specifically used to provide the target access platform with access authorization information for the access user, and may include:

[0075] Obtain the access authorization information of the access user contained in the data provision package; the access authorization information is used to complete the authorization authentication of the access user on the target access platform; generate the associated storage information for the access user based on the user account information of the access user, the platform information of the target access platform and the access authorization information, and store the associated storage information.

[0076] If the user's cookie credentials are valid, the target access platform can integrate the data to be obtained included in the data access request, which includes homepage data (including page content, resource files, etc.), and generate an access authorization information token corresponding to the access rights of the access user in the target access area and the target access platform. The token contains key information such as the identity information, scope of authority, and validity period of the access user in the target access area and the target access platform, and is an important authorization identifier for the access user to perform various operations in the target access area and the target access platform. Furthermore, a data provision package can be generated based on the data to be obtained and the access authorization information token, and the data provision package is returned to the central platform. After the central platform receives the homepage data and access authorization information token returned by the target access platform, it will associate the token with the user's current access and the corresponding area and platform information for storage (possibly stored in memory or other suitable data storage structures for subsequent rapid acquisition), and return the homepage data to the browser of the data access terminal for interface rendering.

[0077] In the method of this embodiment, the central platform can store the associated storage information of the accessing user for subsequent quick acquisition and quick access, thereby improving the efficiency of user access.

[0078] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0079] Based on the same inventive concept, the embodiment of the present application also provides a unified authentication system access device for implementing the unified authentication system access method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more unified authentication system access device embodiments provided below can refer to the limitations on the unified authentication system access method above, and will not be repeated here.

[0080] In one embodiment, as shown in FIG. 4 , a unified authentication system access device is provided, including: a receiving module 402 , a request initiating module 404 , and a sending module 406 , wherein:

[0081] The receiving module 402 is used to receive a data access request triggered by an access user through a data access terminal, and determine a target access platform corresponding to the data access request according to the data access request;

[0082] The request initiation module 404 is used to initiate a proxy request for the data access request to the target access platform if the user account of the access user meets the regional access rights and platform access rights of the target access platform; the target access platform is used to obtain a data provision package according to the proxy request, and return the data provision package to the authentication server;

[0083] The sending module 406 is used to receive the data providing package sent by the target access platform, and send the data providing package to the data access terminal; the data access terminal is used to parse and display the data providing package.

[0084] In one embodiment, the receiving module 402 is further used to: receive a login request triggered by the accessing user through the data access terminal, and obtain the user identification information of the accessing user contained in the login request; obtain the area permission list of the accessing user based on the user identification information; the area permission list includes area permission information of multiple areas, and platform permission information of multiple platforms within each of the areas; send the area permission list to the data access terminal; the data access terminal is used to display the area permission list, and in response to the accessing user's selection operation for the target access area and the target access platform in the area permission list, send the data access request to the authentication server.

[0085] In one embodiment, the receiving module 402 is also used to: obtain user identification information and user account information of the accessing user; obtain the identity authentication result of the accessing user based on the user identification information and the user account information; and obtain the user credentials of the accessing user when the identity authentication result indicates that the identity authentication of the accessing user is successful, and carry the user credentials in the proxy request.

[0086] In one embodiment, the receiving module 402 is also used to: obtain the access permission information of the user account of the accessing user for the target access platform; obtain the access permission review result of the user account of the accessing user based on the access permission information; the access permission review result is used to characterize whether the user account of the accessing user meets the regional access permission and the platform access permission of the target access platform.

[0087] In one embodiment, the receiving module 402 is further used to: obtain the platform address information of the target access platform according to the access address information included in the data acquisition request; and determine the target access platform corresponding to the data access request according to a pre-built platform-address mapping table and the platform address information.

[0088] In one embodiment, the request initiation module 404 is also used to: obtain the access authorization information of the access user contained in the data provision package; the access authorization information is used to complete the authorization authentication of the access user on the target access platform; generate associated storage information for the access user based on the user account information of the access user, the platform information of the target access platform and the access authorization information, and store the associated storage information.

[0089] Each module in the unified authentication system access device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0090] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be shown in FIG5 . The computer device includes a processor, a memory, and a network interface connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store unified authentication system access related data. The network interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, a unified authentication system access method is implemented.

[0091] Those skilled in the art will understand that the structure shown in FIG. 5 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0092] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0093] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0094] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0095] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0096] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0097] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be construed as limiting the scope of the present application. It should be noted that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A unified authentication system access method, characterized in that: Applied to an authentication server of a unified authentication system, the method comprises: Receiving a data access request triggered by an access user through a data access terminal, and determining a target access platform corresponding to the data access request according to the data access request; If the user account of the accessing user satisfies the regional access rights and platform access rights of the target access platform, a proxy request for the data access request is initiated to the target access platform; the target access platform is used to obtain a data provision package according to the proxy request, and return the data provision package to the authentication server; The data providing package sent by the target access platform is received, and the data providing package is sent to the data access terminal; the data access terminal is used to parse and display the data providing package.

2. The method according to claim 1, characterized in that Before receiving the data access request triggered by the access user through the data access terminal, the method further includes: Receiving a login request triggered by the access user through the data access terminal, and acquiring user identification information of the access user contained in the login request; According to the user identification information, a regional authority list of the access user is obtained; the regional authority list includes regional authority information of multiple regions and platform authority information of multiple platforms within the scope of each of the regions; The area permission list is sent to the data access terminal; the data access terminal is used to display the area permission list, and in response to the access user's selection operation on the target access area and the target access platform in the area permission list, send the data access request to the authentication server.

3. The method according to claim 2, characterized in that After determining the target access platform corresponding to the data access request according to the data access request, the method further includes: Obtaining user identification information and user account information of the accessing user; Obtaining the identity authentication result of the accessing user according to the user identification information and the user account information; When the identity authentication result indicates that the identity authentication of the accessing user is successful, the user credentials of the accessing user are obtained and carried in the proxy request.

4. The method according to claim 2, characterized in that: After determining the target access platform corresponding to the data access request according to the data access request, the method further includes: Obtaining access permission information of the user account of the access user for the target access platform; According to the access permission information, the access permission review result of the user account of the accessing user is obtained; the access permission review result is used to indicate whether the user account of the accessing user meets the regional access permission and the platform access permission of the target access platform.

5. The method according to claim 1, characterized in that The determining, according to the data access request, a target access platform corresponding to the data access request includes: Acquire the platform address information of the target access platform according to the access address information included in the data acquisition request; The target access platform corresponding to the data access request is determined according to a pre-constructed platform-address mapping table and the platform address information.

6. The method according to any one of claims 1 to 5, characterized in that: The method further comprises: Acquire the access authorization information of the access user contained in the data provision package; the access authorization information is used to complete the authorization authentication of the access user on the target access platform; According to the user account information of the access user, the platform information of the target access platform and the access authorization information, associated storage information for the access user is generated, and the associated storage information is stored.

7. A unified authentication system access device, characterized in that: An authentication server applied to a unified authentication system, the device comprising: A receiving module, configured to receive a data access request triggered by an access user through a data access terminal, and determine a target access platform corresponding to the data access request according to the data access request; A request initiation module, configured to initiate a proxy request for the data access request to the target access platform if the user account of the access user satisfies the regional access rights and platform access rights of the target access platform; the target access platform is configured to obtain a data provision package according to the proxy request, and return the data provision package to the authentication server; The sending module is used to receive the data providing package sent by the target access platform, and send the data providing package to the data access terminal; the data access terminal is used to parse and display the data providing package.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images