A method and device for identification resolution and authentication

Abstract

The embodiment of the present invention provides an identity resolution authentication method for improving the security of accessed data to achieve cross-enterprise data interaction under the premise of data security. The method of the embodiment of the present invention includes: receiving a target enterprise's access request to metadata in an industrial Internet identity resolution system, the access request carries the target enterprise's industrial Internet identity and the type of operation on the metadata; according to the target enterprise's industrial Internet identity, obtaining an authentication template associated with the target enterprise's industrial Internet identity and target enterprise attributes associated with the target enterprise's industrial Internet identity, wherein the authentication template includes metadata, operation permissions for metadata, and enterprise attributes associated with the metadata operation permissions; matching the target enterprise attributes with the enterprise attributes associated with the metadata operation permissions to obtain a matching result; if the matching results are the same, receiving the target enterprise's access request.

Description

Technical Field

[0001] The present invention relates to an industrial Internet identity resolution system, and in particular to an identity resolution authentication method and related devices. Background Art

[0002] For the industrial identification system, how to ensure data security to eliminate enterprise access concerns while ensuring the effective circulation of data across enterprises is one of the elements for the effective promotion and integration of the system.

[0003] In application scenarios such as product quality information traceability and omni-channel management, companies hope to allow only specific types of partners to obtain specific data during cross-enterprise data interaction and collaboration, rather than placing the data directly in a publicly accessible scenario.

[0004] While existing technologies realize cross-enterprise data flow in industrial identification systems, they generally set metadata permissions for business object data to either be parsable (that is, all metadata data is open to the public) or not parsable, making it impossible to ensure the security of cross-enterprise data interaction. Summary of the invention

[0005] The embodiment of the present invention provides an identity resolution authentication method for authenticating the access request of a target enterprise based on the attributes of the target enterprise and an authentication template, thereby improving the security of the accessed data and realizing cross-enterprise data interaction under the premise of data security.

[0006] A first aspect of an embodiment of the present application provides an identity resolution authentication method, including:

[0007] Receive a target enterprise's access request to metadata in the industrial Internet identity resolution system, wherein the access request carries the target enterprise's industrial Internet identity and an operation type for the metadata;

[0008] According to the industrial Internet identifier of the target enterprise, obtaining an authentication template associated with the industrial Internet identifier of the target enterprise and target enterprise attributes associated with the industrial Internet identifier of the target enterprise, wherein the authentication template includes metadata, operation permissions for the metadata, and enterprise attributes associated with the operation permissions for the metadata;

[0009] Matching the target enterprise attribute with the enterprise attribute associated with the operation authority of the metadata to obtain a matching result;

[0010] If the matching result is the same, then the access request of the target enterprise is received.

[0011] Preferably, the operation types for the metadata include read operations and write operations;

[0012] The operation authority for the metadata includes: a read operation authority for the metadata and a write operation authority for the metadata; the enterprise attribute associated with the operation authority for the metadata includes: a first enterprise attribute associated with the read operation authority for the metadata and a second enterprise attribute associated with the write operation authority for the metadata;

[0013] Matching the target enterprise attribute with the enterprise attribute associated with the operation authority of the metadata to obtain a matching result includes:

[0014] The target enterprise attribute is matched with a first enterprise attribute associated with the read operation permission of the metadata, and / or the target enterprise attribute is matched with a second enterprise attribute associated with the write operation permission of the metadata to obtain a matching result.

[0015] Preferably, the target enterprise attribute includes at least one of the region where the target enterprise is located, the level of the target enterprise, and the type of the target enterprise;

[0016] The first enterprise attribute includes a single enterprise attribute or multiple enterprise attributes, the second enterprise attribute includes a single enterprise attribute and multiple enterprise attributes, and the multiple enterprise attributes are connected by a logical operator;

[0017] Matching the target enterprise attribute with a first enterprise attribute associated with the read operation permission of the metadata includes:

[0018] Matching the target enterprise attribute with a single enterprise attribute or a logical operation result of multiple enterprise attributes associated with the read operation permission of the metadata;

[0019] Matching the target enterprise attribute with a second enterprise attribute associated with the write operation permission of the metadata includes:

[0020] The target enterprise attribute is matched with a single enterprise attribute or a logical operation result of multiple enterprise attributes associated with the write operation permission of the metadata.

[0021] Preferably, the authentication template further includes: environmental attributes associated with the operation authority of the metadata;

[0022] Matching the target enterprise attribute with the enterprise attribute associated with the operation authority of the metadata includes:

[0023] Obtaining environmental attributes of the target enterprise in the current environment;

[0024] The target enterprise attributes and the environment attributes of the target enterprise are matched with the enterprise attributes and the environment attributes associated with the operation authority of the metadata.

[0025] Preferably, the access request also carries an industrial query identifier, and the industrial query identifier carries the enterprise identifier of the enterprise to which the metadata belongs;

[0026] After receiving the access request of the target enterprise, the method further includes:

[0027] Parsing the industrial query identifier to obtain the enterprise identifier of the enterprise to which the metadata belongs from the industrial query identifier;

[0028] Determine the visited enterprise according to the enterprise identifier of the enterprise to which the metadata belongs;

[0029] Calling the data interface of the visited enterprise to obtain the value of the metadata;

[0030] splicing the metadata and the value of the metadata to obtain spliced ​​data;

[0031] The stitched data is returned to the target enterprise.

[0032] Preferably, the industrial query identifier carries multiple enterprise identifiers of multiple enterprises to which the multiple metadata belong;

[0033] Determine the visited enterprise according to the enterprise identifier of the enterprise to which the metadata belongs, including:

[0034] Determine a plurality of visited enterprises according to a plurality of enterprise identifiers of the plurality of enterprises to which the plurality of metadata belong;

[0035] Calling the data interface of the visited enterprise to obtain the value of the metadata includes:

[0036] Calling respective data interfaces of the plurality of visited enterprises to obtain a plurality of values ​​of the plurality of metadata;

[0037] The metadata and the value of the metadata are concatenated to obtain concatenated data, including:

[0038] The multiple metadata, the multiple values ​​of the multiple metadata and the enterprise identifications of the multiple visited enterprises are spliced ​​together to obtain spliced ​​data.

[0039] A second aspect of an embodiment of the present application provides an identity resolution and authentication device, including:

[0040] A receiving unit, configured to receive a target enterprise's access request to metadata in an industrial Internet identity resolution system, wherein the access request carries the target enterprise's industrial Internet identity and an operation type for the metadata;

[0041] an acquisition unit, configured to acquire, according to the industrial Internet identifier of the target enterprise, an authentication template associated with the industrial Internet identifier of the target enterprise and target enterprise attributes associated with the industrial Internet identifier of the target enterprise, wherein the authentication template includes metadata, operation permissions for the metadata, and enterprise attributes associated with the operation permissions for the metadata;

[0042] A matching unit, used for matching the target enterprise attribute with the enterprise attribute associated with the operation authority of the metadata to obtain a matching result;

[0043] The receiving unit is further configured to receive an access request from the target enterprise when the matching results are the same.

[0044] A third aspect of an embodiment of the present application provides a computer device, including a processor, which, when executing a computer program stored in a memory, is used to implement the identification resolution and authentication method provided in the first aspect of the embodiment of the present application.

[0045] A fourth aspect of an embodiment of the present application provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, it is used to implement the identification resolution and authentication method provided in the first aspect of the embodiment of the present application.

[0046] A fifth aspect of an embodiment of the present application provides a computer program product on which a computer program is stored. When the computer program is executed by a processor, it is used to implement the identification resolution and authentication method provided in the first aspect of the embodiment of the present application.

[0047] It can be seen from the above technical solutions that the embodiments of the present invention have the following advantages:

[0048] In an embodiment of the present application, when a target enterprise's access request to metadata in an industrial Internet identity resolution system is received, an authentication template and target enterprise attributes associated with the target enterprise are obtained based on the target enterprise's industrial Internet identity, and then the target enterprise attributes are matched with the enterprise attributes in the authentication template. If the matching results are the same, the target enterprise's access request is received, so that a permission relationship between the enterprise attributes and the accessed data can be established through the authentication template, so that the corresponding data operation permissions can be obtained by authenticating the attributes of the target enterprise, thereby ensuring the data security in the industrial Internet identity resolution system and correspondingly realizing secure interaction of cross-enterprise data. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 This is a schematic diagram of the architecture of the identity resolution and authentication system in the embodiment of the present application;

[0050] Figure 2 A schematic diagram of an embodiment of the identity resolution authentication method in the embodiment of the present application;

[0051] Figure 3 This is another schematic diagram of an embodiment of the identity resolution authentication method in the embodiment of the present application;

[0052] Figure 4 A schematic diagram of an embodiment of an identity resolution and authentication device in an embodiment of the present application. DETAILED DESCRIPTION

[0053] The embodiment of the present invention provides an identity resolution authentication method for authenticating the access request of a target enterprise based on the attributes of the target enterprise and an authentication template, thereby improving the security of the accessed data and realizing cross-enterprise data interaction under the premise of data security.

[0054] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0055] The terms "first", "second", "third", "fourth", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0056] An embodiment of the present application provides an identification resolution authentication method, the general principle of which is: when a target enterprise needs to access metadata in an industrial Internet identification resolution system, an access request is sent to the industrial Internet, wherein the access request carries the industrial Internet identification of the target enterprise and the operation type for the metadata; then, based on the industrial Internet identification of the target enterprise, an authentication template associated with the industrial Internet identification of the target enterprise and target enterprise attributes associated with the target enterprise identification are obtained, wherein the authentication template includes metadata, operation permissions for metadata, and enterprise attributes associated with the operation permissions for metadata; the target enterprise attributes are matched with the enterprise attributes associated with the operation permissions for metadata to obtain a matching result; if the matching result is the same, the access request of the target enterprise is received, thereby realizing secure access to metadata based on enterprise attributes, thereby ensuring the security of data in the industrial Internet identification resolution system, and correspondingly realizing cross-enterprise data interaction under the premise of data security.

[0057] In order to better implement the above authentication scheme, the present application embodiment provides an identification resolution authentication system, please refer to Figure 1 , Figure 1 A schematic diagram of the architecture of an identity resolution and authentication system provided for an embodiment of the present application. The identity resolution and authentication system may include at least one terminal device 101 and a server 102; different types of applications and office systems may be installed on the terminal device 101, for example, instant messaging applications, conference communication applications, ERP systems, and production management systems, etc. may be installed on the terminal device 101; the terminal device 101 may be a smart phone, tablet computer, laptop computer, desktop computer, smart car, etc. Server 102 may be used to receive access requests from terminal devices. Server 102 may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDN), and basic cloud computing services such as big data and artificial intelligence platforms, etc.

[0058] In which, the above-mentioned authentication scheme is executed by the terminal device 101 or the server 102. When the authentication scheme is executed by the server 102, the server 102 receives an access request for metadata in the industrial Internet identity resolution system sent by the terminal device 101, wherein the access request carries the industrial Internet identity of the target enterprise and the operation type for the metadata. Then, the server 102 obtains the authentication template associated with the industrial Internet identity of the target enterprise and the target enterprise attributes associated with the industrial Internet identity of the target enterprise based on the industrial Internet identity of the target enterprise, wherein the authentication template includes metadata, operation permissions for metadata, and enterprise attributes associated with the operation permissions for metadata; the target enterprise attributes and the enterprise attributes associated with the operation permissions for metadata are matched to obtain a matching result; if the matching result is the same, the access request of the target enterprise is received.

[0059] For ease of understanding, the following describes the identity resolution and authentication method in the embodiment of the present application. Figure 2 , an embodiment of the identity resolution authentication method in the embodiment of the present application includes:

[0060] 201. Receive a request from a target enterprise to access metadata in the industrial Internet identification resolution system, where the access request carries the industrial Internet identification of the target enterprise and the type of operation on the metadata;

[0061] Specifically, when the target enterprise needs to access the metadata in the Industrial Internet identity resolution system, it can send a metadata access request to the Industrial Internet identity resolution system, where the target enterprise here is any enterprise that can access the Industrial Internet, and the metadata here can be any data associated with the business scenario. For example, when the business scenario is an outbound delivery scenario, the metadata here can be the material identification, outbound delivery date and receipt date; when the business scenario is an inbound delivery scenario, the metadata here can be the inbound date, inbound quantity and material identification. That is, the metadata here is the business data associated with the specific business scenario, and there is no specific restriction on the content of the metadata here.

[0062] Among them, the access request in the embodiment of the present application carries the industrial Internet identifier of the target enterprise and the operation type of the target enterprise on the metadata. The industrial Internet identifier of the target enterprise here can be a text identifier (such as the enterprise name or a string combination representing the enterprise identifier, etc.), or a graphic identifier (such as a barcode or QR code representing the enterprise identifier, etc.). There is no specific restriction on the content of the industrial Internet identifier of the target enterprise. Furthermore, the operation type for metadata here can be a read operation or a write operation, and the write operation can be divided into adding data, deleting data or modifying data, etc.

[0063] 202. According to the industrial Internet identifier of the target enterprise, obtain an authentication template associated with the industrial Internet identifier of the target enterprise and target enterprise attributes associated with the industrial Internet identifier of the target enterprise, wherein the authentication template includes metadata, operation permissions for the metadata, and enterprise attributes associated with the operation permissions for the metadata;

[0064] After obtaining the industrial Internet identifier of the target enterprise in step 201, the authentication template associated with the industrial Internet identifier of the target enterprise and the target enterprise attributes associated with the industrial Internet identifier of the target enterprise are obtained based on the industrial Internet identifier of the enterprise.

[0065] Specifically, in the industrial Internet, because there are various types of enterprises, each enterprise has a different business type, and the business type is the same as the type of metadata. Therefore, different types of authentication templates are stored in the industrial Internet of the embodiment of the present application, and each authentication template is applicable to one enterprise, or to a type of enterprise. That is, the relationship between the industrial Internet identifier of the target enterprise and the authentication template in the embodiment of the present application can be one-to-one or one-to-many. There is no specific restriction on the correspondence between the industrial Internet identifier of the target enterprise and the authentication template. The association relationship between the industrial Internet identifier of the target enterprise and the authentication template can be pre-stored in a mapping table. After the industrial Internet identifier of the target enterprise is obtained, the authentication template associated with the industrial Internet identifier of the target enterprise is queried according to the mapping table.

[0066] Furthermore, in the embodiments of the present application, the enterprise attributes may include the region where the enterprise is located, the level of the enterprise or the type of the enterprise, etc. For example, the regional information to which the enterprise belongs may be South China, North China or Central China, etc., the enterprise level information may be that the enterprise is a first-tier supplier, a first-tier store or a first-tier agent, etc., and the enterprise type information may be a distributor, a store or an agent, etc. Of course, the above examples are examples of enterprise attributes rather than limitations.

[0067] Furthermore, the authentication template in the embodiment of the present application includes metadata, operation permissions for metadata, and enterprise attributes associated with the operation permissions for metadata. For ease of understanding, Table 1 provides a schematic diagram of the authentication template.

[0068] Table 1

[0069]

[0070] 203. Match the target enterprise attribute with the enterprise attribute associated with the operation authority of the metadata to obtain a matching result;

[0071] After obtaining the enterprise attributes of the target enterprise, the enterprise attributes of the target enterprise are matched with corresponding attributes in the authentication template to obtain corresponding matching results.

[0072] As shown in Table 1, if the target enterprise has attribute A and attribute F, the target enterprise can obtain the read permission for metadata 1 and the write permission for metadata 3.

[0073] 204. If the matching result is the same, then receive the access request of the target enterprise.

[0074] Specifically, after obtaining the matching result, if the matching result is the same, that is, the target enterprise has the corresponding attribute in the authentication template, then the access request of the target enterprise is received.

[0075] In an embodiment of the present application, when a request for access to metadata in the industrial Internet is received from a target enterprise, an authentication template and target enterprise attributes associated with the target enterprise's industrial Internet are obtained based on the target enterprise's industrial Internet identifier, and then the target enterprise attributes are matched with the enterprise attributes in the authentication template. If the matching results are the same, the access request of the target enterprise is received, so that a permission relationship between the enterprise attributes and the accessed data can be established through the authentication template, so that the corresponding data operation permissions can be obtained by authenticating the attributes of the target enterprise, thereby ensuring the data security in the industrial Internet identification resolution system and correspondingly realizing secure interaction of cross-enterprise data.

[0076] based on Figure 2 In the embodiment described above, step 203 is further described in detail below:

[0077] As an optional embodiment, the operation permission for metadata includes a write operation for metadata or a read operation for metadata, and the operation permission for metadata in the authentication template also correspondingly includes: a read operation and a write operation for metadata. If the enterprise attributes associated with the operation permission for metadata are brand new, the enterprise attributes associated with the first enterprise attribute associated with the read operation permission for metadata and the second enterprise attribute associated with the write operation permission for metadata. Accordingly, when matching the target enterprise attribute with the enterprise attribute associated with the operation permission for metadata, the target enterprise attribute is matched with the first enterprise attribute associated with the read operation permission for metadata, and the target enterprise attribute is matched with the second enterprise attribute associated with the write operation permission for metadata.

[0078] For easier understanding, the following example is given:

[0079] Specifically in Table 1, if the first enterprise attribute associated with the read operation permission associated with metadata 1 is attribute A, and the second enterprise attribute associated with the write operation permission associated with metadata 1 is attribute B, the target enterprise attribute is matched with the first enterprise attribute (attribute A), and the target enterprise attribute is matched with the second enterprise attribute (attribute B). If the matching results are the same, the target enterprise can obtain the read operation permission of metadata 1 and the write operation permission of metadata 1 accordingly. If the matching results are not the same, the target enterprise cannot obtain the read operation permission of metadata 1 and the write operation permission of metadata 1 accordingly.

[0080] The matching process of the enterprise attributes of the corresponding permissions of other metadata in Table 1 is the same as the above process type and will not be repeated here.

[0081] In the embodiment of the present application, the operation permission of the metadata is divided into read operation permission and write operation permission, and the enterprise attributes associated with the operation permission of the metadata are further divided into first enterprise attributes and second enterprise attributes, thereby realizing the subdivision of permissions for different target enterprises in different authentication scenarios, and also realizing more fine-grained permission management, thereby improving the adaptability of the authentication scheme to multiple authentication scenarios.

[0082] It should be noted here that, for write operation permissions, the write operation permissions can also be divided into modify data permissions and delete data permissions to further enhance the diversity of authentication scenarios and the freedom of authentication.

[0083] As an optional embodiment, the embodiment of the present application can also divide the first enterprise attribute and the second enterprise data associated with the metadata into a single enterprise attribute or multiple enterprise attributes, and connect the multiple enterprise attributes through logical operators to further enhance the degree of freedom of the authentication scenario.

[0084] Accordingly, when matching the target enterprise attribute with the first enterprise attribute associated with the read operation permission of the metadata, the target enterprise attribute and the logical operation result of the single enterprise attribute or multiple enterprise attributes associated with the read operation permission of the metadata are matched, and when matching the target enterprise attribute with the second enterprise attribute associated with the write operation permission of the metadata, the target enterprise attribute and the logical operation result of the single enterprise attribute or multiple enterprise attributes associated with the write operation permission of the metadata are matched.

[0085] For ease of understanding, Table 2 shows a schematic diagram in which the first enterprise attribute and the second enterprise attribute in the authentication template include a single enterprise attribute and multiple enterprise attributes, respectively, and multiple enterprise attributes are connected through a logical operator.

[0086] Table 2

[0087]

[0088] As shown in Table 2, only when the target enterprise's corporate attribute is a dealer does it have the read permission for the delivery date, and only when the target enterprise's corporate attribute is a dealer in East China does it have the write permission for the delivery date.

[0089] In the embodiment of the present application, the first enterprise attribute and the second enterprise attribute are further subdivided into a single enterprise attribute or a logical operation relationship of multiple enterprise attributes, thereby further improving the diversity of authentication scenarios for target enterprise permissions and further improving the degree of freedom of the authentication dimension.

[0090] As another optional embodiment, the embodiment of the present application may also add environmental attributes associated with the metadata operation authority, such as date and time, to the authentication template. Accordingly, when matching the target enterprise attributes with the enterprise attributes associated with the metadata operation authority, it is also necessary to obtain the environmental attributes of the target enterprise in the current environment, and match the enterprise attributes and environmental attributes of the target enterprise with the enterprise attributes and environmental attributes associated with the metadata operation authority.

[0091] For easier understanding, the following example is given:

[0092] Assume that in Table 2, for the read permission of the delivery date, you can also add access time such as 8:00-11:00 on weekdays. Then, only when the target enterprise is a dealer and sends an access request between 8:00-11:00, will it have the read permission of the delivery date.

[0093] In the embodiment of the present application, environmental attributes are further added to the authentication template, thereby further improving the diversity of authentication scenarios for target enterprise permissions and further improving the degree of freedom of the authentication dimension.

[0094] based on Figure 2 In the embodiment described above, the access request sent by the target enterprise may also carry an industrial query identifier, wherein the industrial query identifier carries the enterprise identifier to which the metadata belongs. The following describes the process of returning metadata to the target enterprise after receiving the access request. Figure 3 :

[0095] 301. Parse the industrial query identifier to obtain the enterprise identifier of the enterprise to which the metadata belongs from the industrial query identifier;

[0096] Specifically, in the industrial Internet identity resolution system, each enterprise can exchange data with each other. Therefore, in the embodiment of the present application, if the target enterprise wants to access the metadata of enterprise X, the target enterprise's access request also carries the enterprise identifier to which the metadata belongs, such as enterprise X, and further obtains the value of the metadata from enterprise X on the premise that it is determined that the target enterprise has access rights.

[0097] Corresponding to Table 2, the specific value of the shipment date and the specific value of the receipt time are obtained.

[0098] As an optional embodiment, when the target enterprise needs to access metadata of multiple enterprises, the industrial query identifier may also include multiple enterprise identifiers of multiple enterprises to which the multiple metadata belong, such as the enterprise identifiers of X1 enterprise and X2 enterprise.

[0099] 302. Determine the visited enterprise according to the enterprise identifier of the enterprise to which the metadata belongs;

[0100] After the enterprise ID of the enterprise to which the metadata belongs is determined, the target enterprise can determine the visited enterprise to be visited based on the enterprise ID. For example, when the target enterprise wants to access the metadata of enterprise X, enterprise X can be determined based on its enterprise ID.

[0101] As an optional embodiment, when multiple enterprise identifications are included, multiple visited enterprises can be determined respectively based on the multiple enterprise identifications. For example, when the enterprise identifications of X1 enterprise and X2 enterprise are included, X1 enterprise and X2 enterprise can be determined respectively based on their enterprise identifications.

[0102] 303. Calling the data interface of the visited enterprise to obtain the value of the metadata;

[0103] After the visited enterprise is determined, the data interface of the visited enterprise can be called to obtain the value of the metadata. For example, when the visited enterprise is enterprise X, the API interface of enterprise X can be called to obtain the value of the metadata from the API interface of enterprise X, such as obtaining the specific value of the shipment date and the specific value of the receipt date.

[0104] As an optional embodiment, after obtaining multiple visited enterprises, the data interfaces of the multiple visited enterprises can be called respectively to obtain multiple values ​​of multiple metadata.

[0105] 304. Concatenate the metadata and the value of the metadata to obtain concatenated data;

[0106] Correspondingly, after obtaining the value of the metadata, for the sake of data integrity, the metadata and the value of the metadata may be concatenated to obtain concatenated data.

[0107] If the metadata is the release date and the metadata value is 2024-11-3, the metadata and the metadata value can be spliced ​​to obtain the release date: 2024-11-3, and the spliced ​​data can be sent to the target enterprise.

[0108] As an optional embodiment, after obtaining multiple metadata and multiple metadata values, in order to ensure the correctness and integrity of the data, the embodiment of the present application can also splice the multiple metadata, multiple metadata values ​​and multiple enterprise logos separately to obtain spliced ​​data.

[0109] For example, when the first metadata is the shipment date, the value of the first metadata is 2024-11-3, and the first metadata belongs to the X1 enterprise; the second metadata is the receipt date, the value of the second metadata is 2024-11-5, and the second metadata belongs to the X2 enterprise, then the spliced ​​data can be X1 enterprise: shipment date is 2024-11-3, X2 enterprise: receipt date is 2024-11-5, thereby ensuring the accuracy and completeness of the data.

[0110] 305. Return the spliced ​​data to the target enterprise.

[0111] After the spliced ​​data is obtained, the spliced ​​data can be returned to the target enterprise.

[0112] The embodiment of the present application describes in detail the process of returning metadata and metadata values ​​to the target enterprise. After obtaining the metadata and metadata values, in order to ensure the accuracy and completeness of the data, the embodiment of the present application combines the metadata and metadata values ​​into spliced ​​data, thereby ensuring the accuracy and completeness of the metadata and metadata values ​​returned to the target enterprise.

[0113] It is understandable that, in various embodiments of the present invention, the sequence numbers of the above steps do not mean the order of execution. The order of execution of the steps should be determined by their functions and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0114] The above describes the identification resolution and authentication method in the embodiment of the present application. The following describes the identification resolution and authentication device in the embodiment of the present application. Figure 4 , an embodiment of the identity resolution and authentication device in the embodiment of the present application includes:

[0115] The receiving unit 401 is used to receive a request from a target enterprise to access metadata in the industrial Internet identity resolution system, where the access request carries the industrial Internet identity of the target enterprise and an operation type for the metadata;

[0116] The acquisition unit 402 is used to acquire, according to the industrial Internet identifier of the target enterprise, an authentication template associated with the industrial Internet identifier of the target enterprise and target enterprise attributes associated with the industrial Internet identifier of the target enterprise, wherein the authentication template includes metadata, operation permissions for the metadata, and enterprise attributes associated with the operation permissions for the metadata;

[0117] A matching unit 403, used to match the target enterprise attribute with the enterprise attribute associated with the operation authority of the metadata to obtain a matching result;

[0118] The receiving unit 401 is further configured to receive an access request from the target enterprise when the matching results are the same.

[0119] Preferably, the operation types for the metadata include read operations and write operations;

[0120] The operation authority for the metadata includes: a read operation authority for the metadata and a write operation authority for the metadata; the enterprise attribute associated with the operation authority for the metadata includes: a first enterprise attribute associated with the read operation authority for the metadata and a second enterprise attribute associated with the write operation authority for the metadata;

[0121] The matching unit 403 is specifically configured to:

[0122] The target enterprise attribute is matched with a first enterprise attribute associated with the read operation permission of the metadata, and / or the target enterprise attribute is matched with a second enterprise attribute associated with the write operation permission of the metadata to obtain a matching result.

[0123] Preferably, the target enterprise attribute includes at least one of the region where the target enterprise is located, the level of the target enterprise, and the type of the target enterprise;

[0124] The first enterprise attribute includes a single enterprise attribute or multiple enterprise attributes, the second enterprise attribute includes a single enterprise attribute and multiple enterprise attributes, and the multiple enterprise attributes are connected by a logical operator;

[0125] The matching unit 403 is specifically configured to:

[0126] Matching the target enterprise attribute with a single enterprise attribute or a logical operation result of multiple enterprise attributes associated with the read operation permission of the metadata;

[0127] and / or,

[0128] The target enterprise attribute is matched with a single enterprise attribute or a logical operation result of multiple enterprise attributes associated with the write operation permission of the metadata.

[0129] Preferably, the authentication template further includes: environmental attributes associated with the operation authority of the metadata;

[0130] The matching unit 403 is specifically configured to:

[0131] Obtaining environmental attributes of the target enterprise in the current environment;

[0132] The target enterprise attributes and the environment attributes of the target enterprise are matched with the enterprise attributes and the environment attributes associated with the operation authority of the metadata.

[0133] Preferably, the access request also carries an industrial query identifier, and the industrial query identifier carries the enterprise identifier of the enterprise to which the metadata belongs;

[0134] The authentication device further comprises:

[0135] The parsing unit 404 is used to parse the industrial query identifier to obtain the enterprise identifier of the enterprise to which the metadata belongs from the industrial query identifier;

[0136] A determination unit 405, configured to determine the visited enterprise according to the enterprise identifier of the enterprise to which the metadata belongs;

[0137] The acquisition unit 402 is further used to call the data interface of the visited enterprise to obtain the value of the metadata;

[0138] A splicing unit 406, configured to splice the metadata and the value of the metadata to obtain spliced ​​data;

[0139] The returning unit 407 is used to return the spliced ​​data to the target enterprise.

[0140] Preferably, the industrial query identifier carries multiple enterprise identifiers of multiple enterprises to which the multiple metadata belong;

[0141] The determining unit 405 is specifically configured to:

[0142] Determine a plurality of visited enterprises according to a plurality of enterprise identifiers of the plurality of enterprises to which the plurality of metadata belong;

[0143] The acquisition unit 402 is specifically used for:

[0144] Calling respective data interfaces of the plurality of visited enterprises to obtain a plurality of values ​​of the plurality of metadata;

[0145] The splicing unit 406 is specifically used for:

[0146] The multiple metadata, the multiple values ​​of the multiple metadata and the enterprise identifications of the multiple visited enterprises are spliced ​​together to obtain spliced ​​data.

[0147] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0148] In an embodiment of the present application, when a request for access to metadata in the industrial Internet from a target enterprise is received through the receiving unit 401, the authentication template and target enterprise attributes associated with the industrial Internet identifier of the target enterprise are acquired through the acquisition unit 402 according to the industrial Internet identifier of the target enterprise, and then the target enterprise attributes are matched with the enterprise attributes in the authentication template through the matching unit 403. If the matching results are the same, the access request from the target enterprise is received, so that a permission relationship between the enterprise attributes and the accessed data can be established through the authentication template, so that the corresponding data operation permissions can be obtained by authenticating the attributes of the target enterprise, thereby ensuring data security in the industrial Internet and correspondingly realizing secure interaction of cross-enterprise data.

[0149] The embodiment of the present application also provides a computer program product, on which a computer program is stored. When the computer program is executed by a processor, it is used to implement the various steps in the above-mentioned identity resolution and authentication method embodiment.

[0150] The above describes the identity resolution and authentication device in the embodiment of the present invention from the perspective of modular functional entities. The following describes the computer device in the embodiment of the present invention from the perspective of hardware processing:

[0151] The computer device is used to implement the function of the identification resolution and authentication device. In an embodiment of the present invention, an embodiment of the computer device includes:

[0152] Processor and memory;

[0153] When the memory is used to store a computer program and the processor is used to execute the computer program stored in the memory, each step in the above-mentioned identification resolution and authentication method embodiment can be implemented.

[0154] It is understandable that when the processor in the computer device described above executes the computer program, it can also implement the functions of the various units in the corresponding device embodiments described above, which will not be repeated here. Exemplarily, the computer program can be divided into one or more modules / units, and the one or more modules / units are stored in the memory and executed by the processor to complete the present invention. The one or more modules / units can be a series of computer program instruction segments that can perform specific functions, and the instruction segments are used to describe the execution process of the computer program in the authentication device. For example, the computer program can be divided into the various units in the above-mentioned authentication device, and each unit can implement the specific functions described in the above-mentioned corresponding authentication device.

[0155] The computer device may be a computing device such as a desktop computer, a notebook, a PDA, and a cloud server. The computer device may include, but is not limited to, a processor and a memory. Those skilled in the art will appreciate that a processor and a memory are merely examples of computer devices and do not constitute a limitation of the computer device. The computer device may include more or fewer components, or a combination of certain components, or different components. For example, the computer device may also include input and output devices, network access devices, buses, and the like.

[0156] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the computer device, and uses various interfaces and lines to connect various parts of the entire computer device.

[0157] The memory can be used to store the computer program and / or module, and the processor realizes various functions of the computer device by running or executing the computer program and / or module stored in the memory, and calling the data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required for a function, etc.; the data storage area can store data created according to the use of the terminal, etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0158] The present invention also provides a computer-readable storage medium, which is used to implement the functions of the identification resolution and authentication device, and stores a computer program. When the computer program is executed by a processor, the processor can implement each step in the above-mentioned identification resolution and authentication method embodiment.

[0159] It is understandable that if the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a corresponding computer-readable storage medium. Based on such an understanding, the present invention implements all or part of the processes in the above-mentioned corresponding embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0160] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0161] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0162] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0163] As described above, the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features thereof may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An identity resolution authentication method, characterized in that: include: Receive a target enterprise's access request to metadata in the industrial Internet identity resolution system, wherein the access request carries the target enterprise's industrial Internet identity and an operation type for the metadata; According to the industrial Internet identifier of the target enterprise, obtaining an authentication template associated with the industrial Internet identifier of the target enterprise and target enterprise attributes associated with the industrial Internet identifier of the target enterprise, wherein the authentication template includes metadata, operation permissions for the metadata, and enterprise attributes associated with the operation permissions for the metadata; Matching the target enterprise attribute with the enterprise attribute associated with the operation authority of the metadata to obtain a matching result; If the matching result is the same, then the access request of the target enterprise is received.

2. The method according to claim 1, characterized in that The operation types for the metadata include read operation and write operation; The operation authority for the metadata includes: a read operation authority for the metadata and a write operation authority for the metadata; the enterprise attribute associated with the operation authority for the metadata includes: a first enterprise attribute associated with the read operation authority for the metadata and a second enterprise attribute associated with the write operation authority for the metadata; Matching the target enterprise attribute with the enterprise attribute associated with the operation authority of the metadata to obtain a matching result includes: The target enterprise attribute is matched with a first enterprise attribute associated with the read operation permission of the metadata, and / or the target enterprise attribute is matched with a second enterprise attribute associated with the write operation permission of the metadata to obtain a matching result.

3. The method according to claim 2, characterized in that The target enterprise attribute includes at least one of the region where the target enterprise is located, the level of the target enterprise, and the type of the target enterprise; The first enterprise attribute includes a single enterprise attribute or multiple enterprise attributes, the second enterprise attribute includes a single enterprise attribute and multiple enterprise attributes, and the multiple enterprise attributes are connected by a logical operator; Matching the target enterprise attribute with a first enterprise attribute associated with the read operation permission of the metadata includes: Matching the target enterprise attribute with a single enterprise attribute or a logical operation result of multiple enterprise attributes associated with the read operation permission of the metadata; Matching the target enterprise attribute with a second enterprise attribute associated with the write operation permission of the metadata includes: The target enterprise attribute is matched with a single enterprise attribute or a logical operation result of multiple enterprise attributes associated with the write operation permission of the metadata.

4. The method according to claim 1, characterized in that: The authentication template also includes: environmental attributes associated with the operation authority of the metadata; Matching the target enterprise attribute with the enterprise attribute associated with the operation authority of the metadata includes: Obtaining environmental attributes of the target enterprise in the current environment; The target enterprise attributes and the environment attributes of the target enterprise are matched with the enterprise attributes and the environment attributes associated with the operation authority of the metadata.

5. The method according to any one of claims 1 to 4, characterized in that: The access request also carries an industrial query identifier, and the industrial query identifier carries the enterprise identifier of the enterprise to which the metadata belongs; After receiving the access request of the target enterprise, the method further includes: Parsing the industrial query identifier to obtain the enterprise identifier of the enterprise to which the metadata belongs from the industrial query identifier; Determine the visited enterprise according to the enterprise identifier of the enterprise to which the metadata belongs; Calling the data interface of the visited enterprise to obtain the value of the metadata; splicing the metadata and the value of the metadata to obtain spliced ​​data; The stitched data is returned to the target enterprise.

6. The method according to claim 5, characterized in that The industrial query identifier carries multiple enterprise identifiers of multiple enterprises to which the multiple metadata belong; Determine the visited enterprise according to the enterprise identifier of the enterprise to which the metadata belongs, including: Determine a plurality of visited enterprises according to a plurality of enterprise identifiers of the plurality of enterprises to which the plurality of metadata belong; Calling the data interface of the visited enterprise to obtain the value of the metadata includes: Calling respective data interfaces of the plurality of visited enterprises to obtain a plurality of values ​​of the plurality of metadata; The metadata and the value of the metadata are concatenated to obtain concatenated data, including: The multiple metadata, the multiple values ​​of the multiple metadata and the enterprise identifications of the multiple visited enterprises are spliced ​​together to obtain spliced ​​data.

7. An identity resolution and authentication device, characterized in that: include: A receiving unit, configured to receive a target enterprise's access request to metadata in an industrial Internet identity resolution system, wherein the access request carries the target enterprise's industrial Internet identity and an operation type for the metadata; an acquisition unit, configured to acquire, according to the industrial Internet identifier of the target enterprise, an authentication template associated with the industrial Internet identifier of the target enterprise and target enterprise attributes associated with the industrial Internet identifier of the target enterprise, wherein the authentication template includes metadata, operation permissions for the metadata, and enterprise attributes associated with the operation permissions for the metadata; A matching unit, used for matching the target enterprise attribute with the enterprise attribute associated with the operation authority of the metadata to obtain a matching result; The receiving unit is further configured to receive an access request from the target enterprise when the matching results are the same.

8. A computer device comprising a processor, characterized in that: When executing the computer program stored in the memory, the processor is used to implement the identification resolution and authentication method as described in any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it is used to implement the identification resolution and authentication method as described in any one of claims 1 to 6.

10. A computer program product having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it is used to implement the identification resolution and authentication method as described in any one of claims 1 to 6.

Images