Unified authentication system access method and apparatus, computer device, and storage medium

Abstract

Embodiments of the present application provide a unified authentication system access method and device, computer equipment, storage medium and computer program product, and relate to the technical field of Internet. The method comprises the following steps: receiving a data access request triggered by an access user through a data access terminal, determining a target access platform corresponding to the data access request according to the data access request; if the user account of the access user meets the regional access permission and the platform access permission of the target access platform, initiating a proxy request for the data access request to the target access platform; the target access platform is used for obtaining a data providing package according to the proxy request, and returning the data providing package to an authentication server; receiving the data providing package sent by the target access platform, and sending the data providing package to the data access terminal; the data access terminal is used for analyzing and displaying the data providing package. The method improves the security and efficiency of data access.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of Internet, in particular to a unified authentication system access method and device, computer equipment, storage medium and computer program product. BACKGROUND

[0002] In a multi-platform system environment, the services of different platform systems are relatively independent. Based on different service handling needs of a user, the user may need to register and log in to platform accounts of different platforms. The user needs to use different user accounts and user passwords when logging in to different platforms, which brings cumbersome account management problems to the user and also causes certain security risks. Therefore, there is a problem of low security. SUMMARY

[0003] Therefore, it is necessary to provide a unified authentication system access method and device, computer equipment, storage medium and computer program product in view of the above technical problems.

[0004] In a first aspect, the present application provides a unified authentication system access method applied to an authentication server of a unified authentication system. The method comprises the following steps:

[0005] receiving a data access request triggered by an access user through a data access terminal, and determining a target access platform corresponding to the data access request according to the data access request;

[0006] If the user account of the access user meets the regional access permission and the platform access permission of the target access platform, initiating a proxy request for the data access request to the target access platform; the target access platform is configured to obtain a data providing package according to the proxy request, and return the data providing package to the authentication server;

[0007] receiving the data providing package sent by the target access platform, and sending the data providing package to the data access terminal; the data access terminal is configured to analyze and display the data providing package.

[0008] In one of the embodiments, before the receiving of the data access request triggered by the access user through the data access terminal, the method further comprises: receiving a login request triggered by the access user through the data access terminal, and obtaining user identification information of the access user contained in the login request; obtaining a regional permission list of the access user according to the user identification information; the regional permission list contains regional permission information of multiple regions and platform permission information of multiple platforms within each region; sending the regional permission list to the data access terminal; the data access terminal is configured to display the regional permission list, and in response to a selection operation of the access user on a target access region and a target access platform in the regional permission list, send the data access request to the authentication server.

[0009] In one of the embodiments, after the determining of the target access platform corresponding to the data access request according to the data access request, the method further comprises: obtaining user identification information and user account information of the access user; obtaining an identity authentication result of the access user according to the user identification information and the user account information; in the case that the identity authentication result indicates that the identity authentication of the access user is successful, obtaining user credentials of the access user, and carrying the user credentials in the proxy request.

[0010] In one of the embodiments, after the determining of the target access platform corresponding to the data access request according to the data access request, the method further comprises: obtaining access permission information of the user account of the access user for the target access platform; obtaining an access permission audit result of the user account of the access user according to the access permission information; the access permission audit result is used to represent whether the user account of the access user meets the regional access permission and the platform access permission of the target access platform.

[0011] In one of the embodiments, the determining of the target access platform corresponding to the data access request according to the data access request comprises: obtaining platform address information of the target access platform according to access address information contained in the data access request; determining the target access platform corresponding to the data access request according to a pre-constructed platform-address mapping table and the platform address information.

[0012] In one of the embodiments, the method further comprises: obtaining access authorization information of the access user contained in the data provision package; the access authorization information is used to complete authorization authentication of the access user on the target access platform; generating associated storage information for the access user according to user account information of the access user, platform information of the target access platform, and the access authorization information, and storing the associated storage information.

[0013] In a second aspect, the present application provides a unified authentication system access device, applied to an authentication server of a unified authentication system. The device comprises:

[0014] a receiving module, configured to receive a data access request triggered by an access user through a data access terminal, and determine a target access platform corresponding to the data access request according to the data access request;

[0015] a request initiating module, configured to initiate a proxy request for the data access request to the target access platform if a user account of the access user meets regional access permissions and platform access permissions of the target access platform; the target access platform is configured to obtain a data providing package according to the proxy request, and return the data providing package to the authentication server;

[0016] a sending module, configured to receive the data providing package sent by the target access platform, and send the data providing package to the data access terminal; the data access terminal is configured to parse and display the data providing package.

[0017] In a third aspect, the present application further provides a computer device. The computer device comprises a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0018] receiving a data access request triggered by an access user through a data access terminal, and determining a target access platform corresponding to the data access request according to the data access request;

[0019] if a user account of the access user meets regional access permissions and platform access permissions of the target access platform, initiating a proxy request for the data access request to the target access platform; the target access platform is configured to obtain a data providing package according to the proxy request, and return the data providing package to the authentication server;

[0020] receiving the data providing package sent by the target access platform, and sending the data providing package to the data access terminal; the data access terminal is configured to parse and display the data providing package.

[0021] In a fourth aspect, the present application further provides a computer readable storage medium. The computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement the following steps:

[0022] receiving a data access request triggered by an access user through a data access terminal, and determining a target access platform corresponding to the data access request according to the data access request;

[0023] if the user account of the access user satisfies the regional access permission and the platform access permission of the target access platform, initiating a proxy request for the data access request to the target access platform; the target access platform is configured to obtain a data providing package according to the proxy request, and return the data providing package to the authentication server;

[0024] receiving the data providing package sent by the target access platform, and sending the data providing package to the data access terminal; the data access terminal is configured to parse and display the data providing package.

[0025] In a fifth aspect, the present application further provides a computer program product. The computer program product comprises a computer program which, when executed by a processor, implements the following steps:

[0026] receiving a data access request triggered by an access user through a data access terminal, and determining a target access platform corresponding to the data access request according to the data access request;

[0027] if the user account of the access user satisfies the regional access permission and the platform access permission of the target access platform, initiating a proxy request for the data access request to the target access platform; the target access platform is configured to obtain a data providing package according to the proxy request, and return the data providing package to the authentication server;

[0028] receiving the data providing package sent by the target access platform, and sending the data providing package to the data access terminal; the data access terminal is configured to parse and display the data providing package.

[0029] In the unified authentication system access method, device, computer equipment, storage medium and computer program product, a data access request triggered by an access user through a data access terminal is received, and a target access platform corresponding to the data access request is determined according to the data access request. If the user account of the access user satisfies the regional access permission and the platform access permission of the target access platform, a proxy request for the data access request is initiated to the target access platform. The target access platform is configured to obtain a data providing package according to the proxy request, and return the data providing package to the authentication server. The data providing package sent by the target access platform is received, and the data providing package is sent to the data access terminal. The data access terminal is configured to parse and display the data providing package. In the method provided by the present application, a unified authentication system can be introduced. When an access user needs to access different platforms, unified authentication authorization and proxy forwarding of an access request can be performed through the unified authentication system, thereby improving the security of authentication authorization and the efficiency of data access. BRIEF DESCRIPTION OF DRAWINGS

[0030] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related art, the following will briefly introduce the drawings needed to be used in the description of the embodiments of the present application or the related art. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other related drawings can also be obtained from these drawings without creative labor.

[0031] Figure 1 A flowchart of a unified authentication system access method provided by the embodiments of the present application;

[0032] Figure 2 A flowchart of a method for obtaining a regional permission list of an access user provided by the embodiments of the present application;

[0033] Figure 3 A flowchart of a method for obtaining a user credential of an access user provided by the embodiments of the present application;

[0034] Figure 4 A structural block diagram of a unified authentication system access device provided by the embodiments of the present application;

[0035] Figure 5 An internal structure diagram of a computer device provided by the embodiments of the present application. DETAILED DESCRIPTION

[0036] In order to make the purpose, technical solutions and advantages of the present application more clear, the following will further describe the present application in combination with the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application, and are not used to limit the present application.

[0037] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties.

[0038] Glossary

[0039] CN2: Next Generation Carrying Network (China Net Next Carrying Network, CN2), in the embodiments of the present application, refers to a network channel opened between the content center and each region.

[0040] IPTV CDN: Interactive Network Television (Internet Protocol Television, IPTV) platform based on Content Delivery Network (Content Delivery Network, CDN) service and architecture.

[0041] In one exemplary embodiment, as shown in Figure 1 A unified authentication system access method is provided, and the embodiment is exemplified by the application of the method to a server. It can be understood that the method can also be applied to a terminal, and can also be applied to a system including a terminal and a server, and is implemented through the interaction of the terminal and the server. In the embodiment, the method includes the following steps:

[0042] In step 102, a data access request triggered by an access user through a data access terminal is received, and a target access platform corresponding to the data access request is determined according to the data access request.

[0043] In the embodiments of the present application, the unified authentication system access method can be applied to an IPTV CDN management platform, which covers integrated management functions of resources, scheduling, configuration, distribution, etc. In a possible implementation manner, the IPTV CDN management platform can be sunk to each region, in order to facilitate a user (for example, a cloud company personnel or a cloud platform operation and maintenance personnel) to quickly log in to the IPTV CDN management platform of each province after sinking. The background service of the Mongolian and Guizhou national center jumps to the target provincial center through a CN2 network to realize proxy access, so as to realize the proxy forwarding capability of the Mongolian and Guizhou national center management platform to access the corresponding regional management platform after clicking a certain region. The unified authentication system can be the Mongolian and Guizhou national center, and the access user can be a cloud company personnel or a cloud platform operation and maintenance personnel. The access user can access the unified authentication system at a login entry of a data acquisition terminal, that is, inputs a username and a password and other necessary login credentials at a login page, triggers a login request, and the center platform backend receives the login request. First, the credentials input by the access user are preliminarily verified (for example, whether the format of the access username and the password is correct is checked). If the preliminary verification is passed, the access user logs in successfully, and then the data access terminal first requests a permission list interface of the access user. The request of the permission list interface is mainly used for login auditing. The center backend obtains header information in the request, especially Gap-Auth-Email (which can include identification information such as an access user mailbox) and Gap-One-Ten (token information related to the login session of the access user). Then, the Gap-One-Ten is md5 encrypted to obtain gws****nid_md5. Next, the center platform backend queries a database with plat=iptcm (platform identification related), account=Gap-Auth-Email and gws****nid_md5 as conditions, to determine whether the login record exists. This step is mainly to prevent repeated login. If the record exists, it indicates that the access user is in a login state or has a record of the same login session before. If the record does not exist, the information of the login of the access user is recorded, and the login auditing process of the access user is completed.After completing the login audit, the center platform backend obtains the regional permission list (for example, the regional permission list) that the current login access user has according to the identity information of the access user and the system configuration, and the platform list that the access user can access in each region (region), and also generates the corresponding uniform resource locator (Uniform Resource Locator, url) (the format is https: / / domain / platformkey?code=region code, which is used for subsequent access to the target access platform Jump link construction), the regional permission list contains regional permission information of multiple regions and platform permission information of multiple platforms in each region. The center platform backend, that is, the authentication server of the unified authentication system, can send the regional permission list to the data access terminal. The access user can trigger the selection operation for the target access region and the target access platform through the data access terminal. The data access terminal can send a data access request to the authentication server of the unified authentication system in response to the selection operation of the access user in the regional permission list for the target access region and the target access platform. The data access request can include user identification information, user account information, center platform domain name, route and data to be obtained. The data access request is used to indicate that the access user wants to access the target access platform corresponding to the target access region (assuming that "axe" represents a certain business platform). For example, the access user inputs a specific center platform domain name and route in the data access terminal (such as a browser) (for example, by inputting the address "https: / / i***nc-console-dev.ct***n.cn / axe?code=11" in the browser address bar, where "ip***c-console-dev.c***n.cn" is the center platform domain name, that is, the unified authentication system domain name, " / axe" is the route, and "code=11" represents the target access region).

[0044] Step 104, if the user account of the access user meets the regional access permission and the platform access permission of the target access platform, a proxy request for the data access request is initiated to the target access platform.

[0045] The center platform backend, i.e. the authentication server of the unified authentication system, receives the data access request of the data access terminal and judges the authority again. This time, the judgment is mainly to prevent illegal access by constructing a URL. That is, to verify whether the current access user truly has the access authority of the target access area and the target access platform. If the secondary authority judgment is passed, the center platform backend will perform identity authentication and access management system login authentication according to the configured username and password. The specific operation is to call the / iam / gw / auth / Login interface for authentication. If the authentication is successful, an id (i.e. the cookie credential of the user) will be obtained. The user credential will be used for identity verification when accessing the target access platform subsequently, representing the legal identity of the user in the session.

[0046] Further, the center platform backend, i.e. the authentication server of the unified authentication system, receives the data access request of the data access terminal and judges the authority again. This time, the judgment is mainly to prevent illegal access by constructing a URL. That is, to verify whether the current access user truly has the access authority of the target access area and the target access platform. If the secondary authority judgment is passed, the center platform backend will perform identity authentication and access management system login authentication according to the configured username and password. The specific operation is to call the / iam / gw / auth / Login interface for authentication. If the authentication is successful, an id (i.e. the cookie credential of the user) will be obtained. The user credential will be used for identity verification when accessing the target access platform subsequently, representing the legal identity of the user in the session.

[0047] Step 106, receiving the data providing package sent by the target access platform, and sending the data providing package to the data access terminal.

[0048] The header information configured by the center platform backend (including cookie credentials, i.e. user credentials) is used to initiate a proxy request to the homepage of the target access platform (the axe platform in the province) through the CN2 network. After receiving the proxy request, the target access platform verifies whether the user cookie credentials transmitted by the center platform are valid according to its own authentication and authorization mechanism. If the user cookie credentials are valid, the target access platform can integrate the data to be obtained included in the data access request, which includes homepage data (including page content, resource files, etc.), and generate an access authorization information token corresponding to the access user's access authority in the target access area and the target access platform. The token contains the identity information, authority range, and validity period of the access user in the target access area and the target access platform, and is an important authorization identifier for subsequent operations of the access user in the target access area and the target access platform. Further, a data providing package can be generated according to the data to be obtained and the access authorization information token, and the data providing package is returned to the center platform. After receiving the homepage data and the access authorization information token returned by the target access platform, the center platform stores the token in association with the current access of the user and the corresponding area and platform information (which can be stored in the memory or other suitable data storage structure for subsequent quick access), and returns the homepage data to the browser of the data access terminal for interface rendering. At this point, the access user has completed the unified authentication login process through the IPTV CDN center platform, and has obtained the token corresponding to the target access area and the target access platform. Subsequent operations of the access user in the target access area and the target access platform will be authorized and verified based on the token.

[0049] In addition, when the access user initiates a request in the data access terminal browser (such as by inputting the center platform domain name and the relevant route to access a target access platform page, such as https: / / iptvnc-console-dev.ctcdn.cn / axe?code=11), the browser will automatically add a reffer field in the request header. For the url request embedded in the platform homepage, the value of reffer is the request address of the homepage, that is, https: / / iptvnc-console-dev.ctcdn.cn / axe?code=11. After the center platform backend receives the request, the value of reffer can be obtained from the request header. Then, by parsing the reffer address, the corresponding area and platform of the request are judged according to the pre-set rules (for example, according to specific parameters, path structure, etc.). For example, from the above reffer address, according to "code=11", it can be judged that the area is ** province (assuming that 11 corresponds to the encoding of ** province), and according to "axe", it can be judged that the platform is the axe platform (assuming that this is a pre-defined platform identifier). When the homepage is rendered in the data access terminal browser, the situation is different when the embedded link in the page (such as the secondary page link, static file request, etc.) initiates a request. For the request initiated by the request url embedded in the secondary request static file (such as.css / .js, etc.), the reffer of the browser will change to the url of the upper page, rather than the original homepage url. Thus, it is impossible to directly judge the area and platform information according to the conventional way of obtaining reffer by the backend. In view of this situation, the backend needs to perform regular matching processing on the embedded path of the secondary request. For example, a regular expression is set to match these embedded paths (assuming that the regular expression is / (\ / .*?\.(css|js)) / , which is used to match the path ending with.css or.js). When these paths are matched, they are processed and the{ / prefix platform / area code} flag is uniformly added. For example, for a static file path of a secondary request https: / / iptvnc-console-dev.ctcdn.cn / static / css / chunk-0159db68.482b471d.css, after processing, it may become https: / / iptvnc-console-dev.ctcdn.cn / { / prefix / axe / 11} / static / css / chunk-0159db68.482b471d.css (assuming that axe is the platform and 11 is the area code). When the center platform backend receives the request after adding the flag, the area and platform information are obtained from the flag according to the pre-set parsing rules by matching the{ / prefix / } path.For example, from the above processed path, the center platform backend can parse that the platform is axe and the region is ** province (corresponding to code 11).

[0050] In the method of the embodiment, a data access request triggered by an access user through a data access terminal is received, and a target access platform corresponding to the data access request is determined according to the data access request. If a user account of the access user meets a regional access permission and a platform access permission of the target access platform, a proxy request for the data access request is initiated to the target access platform. The target access platform is configured to acquire a data providing package according to the proxy request and return the data providing package to an authentication server. The data providing package sent by the target access platform is received, and the data providing package is sent to the data access terminal. The data access terminal is configured to parse and display the data providing package. In the method provided in the embodiment, a unified authentication system can be introduced. When the access user needs to access different platforms, the unified authentication system can be used for unified authentication authorization and proxy forwarding of an access request, thereby improving the security of authentication authorization and improving the efficiency of data access.

[0051] In one exemplary embodiment, as shown in Figure 2 Before the step 102 of receiving the data access request triggered by the access user through the data access terminal, steps 202 to 206 can be included. Among them:

[0052] In step 202, a login request triggered by the access user through the data access terminal is received, and user identification information of the access user contained in the login request is acquired.

[0053] The user identification information can be information for identifying the identity information of the access user, for example, a user name, a user account.

[0054] In step 204, a regional permission list of the access user is acquired according to the user identification information.

[0055] The regional permission list contains regional permission information of multiple regions and platform permission information of multiple platforms within the range of each region.

[0056] In step 206, the regional permission list is sent to the data access terminal.

[0057] The data access terminal is configured to display the regional permission list and send the data access request to the authentication server in response to a selection operation of the access user in the regional permission list for a target access region and a target access platform.

[0058] Wherein, after completing the login audit, the center platform backend will obtain the regional permission list (for example, the regional permission list) possessed by the current login access user according to the identity information of the access user and the system configuration, and the platform list in which the access user can access the permission under each region (region), and also generate the corresponding constructed uniform resource locator (Uniform Resource Locator, url) (its format is https: / / domain / Platformkey?code=region code, which is used for subsequent access to the target access platform Jump link construction), the regional permission list contains regional permission information of multiple regions and platform permission information of multiple platforms within the scope of each region. The center platform backend, that is, the authentication server of the unified authentication system, can send the regional permission list to the data access terminal. The access user can trigger the selection operation for the target access region and the target access platform through the data access terminal. The data access terminal can send a data access request to the authentication server of the unified authentication system in response to the selection operation of the access user in the regional permission list for the target access region and the target access platform.

[0059] In the method of the embodiment, after receiving the login request triggered by the access user, the center platform, that is, the unified authentication system, can perform login audit and judge the access permission of the access user after the login audit, which can improve the security of system access and data access.

[0060] In an exemplary embodiment, as shown in Figure 3 After determining the target access platform corresponding to the data access request in step 102, step 302 to step 306 can be included. Wherein:

[0061] Step 302, obtaining the user identification information and user account information of the access user.

[0062] Step 304, obtaining the identity authentication result of the access user according to the user identification information and the user account information.

[0063] Step 306, in the case that the identity authentication result indicates that the identity authentication of the access user is successful, obtaining the user credential of the access user and carrying the user credential in the proxy request.

[0064] The center platform backend, that is, the authentication server of the unified authentication system, receives the data access request of the data access terminal, and performs permission judgment again. This time, the judgment is mainly to prevent illegal access by constructing a URL. That is, it is verified whether the current access user truly has the access permission of the target access area and the target access platform. If the second permission judgment passes, the center platform backend performs identity authentication and access management system login authentication according to the configured username and password. The specific operation is to call the / iam / gw / auth / Login interface for authentication. If the authentication is successful, an id (that is, a cookie credential of the user) is obtained. The user credential will be used for identity verification when subsequently accessing the target access platform, representing the legal identity of the user in the session.

[0065] In the method of the embodiment, the center platform can perform second verification on the permission of the access user, and can generate a user credential of the access user, which will be used for identity verification when subsequently accessing the target access platform, representing the legal identity of the user in the session, thereby improving the security of system access and data access, and improving the efficiency of user access.

[0066] In an exemplary embodiment, after determining the target access platform corresponding to the data access request according to the data access request in step 102, the following can be included:

[0067] Accessing the access permission information of the user account of the access user for the target access platform; obtaining the access permission audit result of the user account of the access user according to the access permission information; and the access permission audit result is used to represent whether the user account of the access user meets the regional access permission and the platform access permission of the target access platform.

[0068] The center platform backend, that is, the authentication server of the unified authentication system, receives the data access request of the data access terminal, and performs permission judgment again. This time, the judgment is mainly to prevent illegal access by constructing a URL. That is, it is verified whether the current access user truly has the access permission of the target access area and the target access platform.

[0069] In the method of the embodiment, the center platform can perform second verification on the permission of the access user, thereby improving the security of system access and data access.

[0070] In an exemplary embodiment, after determining the target access platform corresponding to the data access request according to the data access request in step 102, the following can be included:

[0071] According to the access address information contained in the data access request, obtaining the platform address information of the target access platform; and determining the target access platform corresponding to the data access request according to the pre-constructed platform-address mapping table and the platform address information.

[0072] The center platform backend, i.e., the authentication server of the unified authentication system, receives the data access request of the data access terminal, and according to the pre-defined routing and the corresponding relationship of the province platform homepage, which can be called a platform-address mapping table, identifies the target access area and the target access platform (i.e., the "axe" platform of the province) corresponding to the data access request. Then, the center platform backend initiates a proxy request to the homepage of the target access platform through the CN2 network with its own identity, which can be understood as the center platform accessing the data of the target access platform on behalf of the access user. In this process, the center platform may configure some request header information (such as Cookie set in some steps) as needed, so as to pass the authentication or meet the specific requirements of the target access platform when requesting the target access platform. For example, according to the code (such as code=11 representing the province) carried in the data access request, the center platform backend obtains the homepage address of the axe platform corresponding to the region from the configuration. Then, the header information is set, in which Cookie:cdn_tgc=the cookie credential of the user, to prepare for the proxy request to the homepage of the axe platform.

[0073] In the method of the embodiment, the center platform can identify the target access area and the target access platform corresponding to the data access request by using the platform-address mapping table, thereby improving the efficiency of user access.

[0074] In an exemplary embodiment, the embodiments of the present application further include the following steps, which are specifically used to provide the target access platform with access authorization information for the access user, and can include:

[0075] Obtaining the access authorization information of the access user included in the data providing package; the access authorization information is used to complete the authorization authentication of the access user on the target access platform; generating the associated storage information for the access user according to the user account information of the access user, the platform information of the target access platform, and the access authorization information, and storing the associated storage information.

[0076] If the user cookie credential is valid, the target access platform can integrate the to-be-acquired data included in the data access request, the to-be-acquired data including homepage data (including page content, resource files, etc.), and generate an access authorization information token corresponding to the access authority of the access user in the target access region and the target access platform. The token contains the identity information, authority range, validity period, and other key information of the access user in the target access region and the target access platform, and is an important authorization identifier for subsequent operations of the access user in the target access region and the target access platform. Further, the data providing package can be generated according to the to-be-acquired data and the access authorization information token, and the data providing package is returned to the central platform. After the central platform receives the homepage data and the access authorization information token returned by the target access platform, the token is stored in association with the current access of the user and the corresponding region and platform information (which can be stored in the memory or other suitable data storage structure for subsequent quick access), and the homepage data is returned to the browser of the data access terminal for interface rendering.

[0077] In the method of the embodiment, the central platform can store the association storage information of the access user for subsequent quick access, thereby improving the efficiency of user access.

[0078] It should be understood that, although each step in the flowchart involved in each embodiment as described above is displayed in sequence according to the arrow, these steps are not necessarily executed in sequence according to the arrow. Unless otherwise specified herein, the execution of these steps is not strictly limited in sequence, and these steps can be executed in other sequences. Moreover, at least part of the steps in the flowchart involved in each embodiment as described above can include multiple steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution sequence of these steps or stages is not necessarily sequential, but can be executed in rotation or alternation with at least part of other steps or steps or stages in other steps.

[0079] Based on the same inventive concept, the embodiments of the present application also provide a unified authentication system access device for implementing the above-mentioned unified authentication system access method. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme described in the above method, and therefore the specific limitations in one or more unified authentication system access device embodiments provided below can refer to the limitations of the unified authentication system access method described above, which will not be repeated here.

[0080] In one embodiment, as Figure 4As shown, a unified authentication system access device is provided, comprising: a receiving module 402, a request initiation module 404 and a sending module 406, wherein:

[0081] The receiving module 402 is configured to receive a data access request triggered by an access user through a data access terminal, and determine a target access platform corresponding to the data access request according to the data access request.

[0082] The request initiation module 404 is configured to initiate a proxy request for the data access request to the target access platform if a user account of the access user meets regional access permissions and platform access permissions of the target access platform; and the target access platform is configured to obtain a data providing package according to the proxy request and return the data providing package to the authentication server.

[0083] The sending module 406 is configured to receive the data providing package sent by the target access platform, and send the data providing package to the data access terminal; and the data access terminal is configured to parse and display the data providing package.

[0084] In one embodiment, the receiving module 402 is further configured to receive a login request triggered by the access user through the data access terminal, obtain user identification information of the access user contained in the login request, obtain a regional permission list of the access user according to the user identification information, wherein the regional permission list contains regional permission information of multiple regions and platform permission information of multiple platforms within each regional range, send the regional permission list to the data access terminal, and the data access terminal is configured to display the regional permission list and send the data access request to the authentication server in response to a selection operation of the access user on a target access region and a target access platform in the regional permission list.

[0085] In one embodiment, the receiving module 402 is further configured to obtain user identification information and user account information of the access user, obtain an identity authentication result of the access user according to the user identification information and the user account information, obtain a user credential of the access user in a case where the identity authentication result indicates that the identity authentication of the access user is successful, and carry the user credential in the proxy request.

[0086] In one embodiment, the receiving module 402 is further configured to: obtain access permission information of the user account of the accessing user for the target access platform; obtain the access permission review result of the user account of the accessing user based on the access permission information; the access permission review result is used to characterize whether the user account of the accessing user meets the regional access permission and the platform access permission of the target access platform.

[0087] In one embodiment, the receiving module 402 is further configured to: obtain the platform address information of the target access platform based on the access address information contained in the data acquisition request; and determine the target access platform corresponding to the data access request based on a pre-built platform-address mapping table and the platform address information.

[0088] In one embodiment, the request initiating module 404 is further configured to: obtain the access authorization information of the accessing user contained in the data providing package; the access authorization information is used to complete the authorization authentication of the accessing user on the target access platform; generate associated storage information for the accessing user based on the user account information of the accessing user, the platform information of the target access platform and the access authorization information, and store the associated storage information.

[0089] The modules in the aforementioned unified authentication system access device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0090] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 5 As shown, the computer device includes a processor, memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores data related to unified authentication system access. The network interface communicates with external terminals via a network connection. When executed by the processor, the computer program implements a unified authentication system access method.

[0091] Those skilled in the art will understand that Figure 5The structure shown in the figure is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0092] In an embodiment, a computer device is also provided, including a memory and a processor, the memory storing a computer program, and the processor implementing the steps in the above method embodiments when executing the computer program.

[0093] In an embodiment, a computer readable storage medium is provided, storing a computer program, and the computer program implementing the steps in the above method embodiments when executed by a processor.

[0094] In an embodiment, a computer program product is provided, including a computer program, and the computer program implementing the steps in the above method embodiments when executed by a processor.

[0095] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when the computer program is executed, the processes of the above-mentioned embodiments of the methods can be included. Any reference to memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration but not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc. The database involved in the embodiments provided in the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided in the present application can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., without being limited thereto.

[0096] Any combination of the technical features of the above embodiments can be made. In order to make the description simple, all possible combinations of the technical features in the above embodiments are not described, however, as long as the combination of the technical features does not exist, it should be considered as the scope of the present application.

[0097] The above embodiments only express several implementation manners of the present application, and the description is more specific and detailed, but it should not be understood as a limitation on the scope of the patent of the present application. It should be pointed out that for ordinary skilled in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are all within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the appended claims.

Claims

1. A method for uniform authentication system access, the method comprising: The application discloses an authentication server applied to a unified authentication system, and a method thereof. Receiving a login request triggered by an access user through a data access terminal, and obtaining user identification information of the access user contained in the login request; According to the user identification information, obtaining a regional permission list of the access user; the regional permission list contains regional permission information of multiple regions and platform permission information of multiple platforms within the range of each region; Sending the regional permission list to the data access terminal; the data access terminal is used for displaying the regional permission list, and sending a data access request to the authentication server in response to a selection operation of the access user on a target access region and a target access platform in the regional permission list; Receiving the data access request triggered by the access user through the data access terminal, and determining the target access platform corresponding to the data access request according to the data access request; Obtaining user identification information and user account information of the access user; According to the user identification information and the user account information, obtaining an identity authentication result of the access user; In the case that the identity authentication result indicates that the identity authentication of the access user is successful, obtaining user credentials of the access user, and carrying the user credentials in a proxy request; Obtaining access permission information of the user account of the access user for the target access platform; According to the access permission information, obtaining an access permission audit result of the user account of the access user; the access permission audit result is used for representing whether the user account of the access user meets regional access permission and platform access permission of the target access platform; If the user account of the access user meets the regional access permission and the platform access permission of the target access platform, initiating the proxy request for the data access request to the target access platform; the target access platform is used for obtaining a data providing package according to the proxy request, and returning the data providing package to the authentication server; Receiving the data providing package sent by the target access platform, and sending the data providing package to the data access terminal; the data access terminal is used for analyzing and displaying the data providing package.

2. The method of claim 1, wherein, According to the data access request, determining the target access platform corresponding to the data access request, comprising: According to access address information contained in the data access request, obtaining platform address information of the target access platform; According to a pre-constructed platform-address mapping table and the platform address information, determining the target access platform corresponding to the data access request.

3. The method according to any of claims 1-2, characterized in that, The method further comprises: Obtaining access authorization information of the access user contained in the data providing package; the access authorization information is used for completing authorization authentication of the access user on the target access platform; According to the user account information of the access user, platform information of the target access platform and the access authorization information, generating associated storage information for the access user, and storing the associated storage information.

4. A uniform authentication system access device, characterized by, An authentication server applied to a unified authentication system, the device comprising: A receiving module configured to receive a login request triggered by an access user through a data access terminal, obtain user identification information of the access user contained in the login request, obtain a regional permission list of the access user according to the user identification information, wherein the regional permission list contains regional permission information of multiple regions and platform permission information of multiple platforms within the range of each region, and send the regional permission list to the data access terminal; the data access terminal is configured to display the regional permission list and send a data access request to the authentication server in response to a selection operation of the access user on a target access region and a target access platform in the regional permission list; the receiving module is further configured to receive the data access request triggered by the access user through the data access terminal, determine the target access platform corresponding to the data access request according to the data access request, obtain user identification information and user account information of the access user, obtain an identity authentication result of the access user according to the user identification information and the user account information, obtain user credentials of the access user and carry the user credentials in a proxy request in a case where the identity authentication result indicates that the identity authentication of the access user is successful, obtain access permission information of the user account of the access user for the target access platform, and obtain an access permission audit result of the user account of the access user according to the access permission information, wherein the access permission audit result is used to represent whether the user account of the access user meets regional access permission and platform access permission of the target access platform; A request initiation module configured to initiate the proxy request for the data access request to the target access platform in a case where the user account of the access user meets the regional access permission and the platform access permission of the target access platform; the target access platform is configured to obtain a data providing package according to the proxy request and return the data providing package to the authentication server; A sending module configured to receive the data providing package sent by the target access platform and send the data providing package to the data access terminal; the data access terminal is configured to parse and display the data providing package. 5.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is configured to perform the method according to any one of claims 1-4 when the computer program is executed by the processor. The processor executes the computer program to realize the steps of the method of any one of claims 1-3.

6. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to realize the steps of the method of any one of claims 1-3.

7. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to realize the steps of the method of any one of claims 1-3.

Images