Unauthorized user security access platform, method and device for ERP (Enterprise Resource Planning) system

Abstract

The invention belongs to the technical field of nuclear power, and particularly relates to an unauthorized user security access platform, method and device for an ERP system. According to the platform provided by the invention, the static resources are deployed in the front-end business service module, so that an external user can directly access the system through the Internet, the access delay is reduced, the user experience is improved, and meanwhile, the data security is improved through separation of a user interface and sensitive data processing. Through the design of the agency transfer service module, all external requests need to be subjected to user identity verification and request legality verification through the service, so that the secure connection between external users and an ERP internal system is realized, and through an authentication encryption and protection mechanism between the agency transfer service module and the ERP system, the data security is enhanced; and data leakage and hostile attacks are prevented.

Description

Technical Field

[0001] The present invention belongs to the field of nuclear power technology, and in particular relates to a platform, method and device for secure access of unauthorized users to an ERP system. Background Art

[0002] ERP systems often involve the core business and sensitive information of enterprises. If there is no reliable identity authentication mechanism for unauthorized users, they may try to access the system in various ways, which may bring serious security risks. Such unauthenticated access may lead to internal data leakage, operational errors or malicious use of the system. Existing technologies have certain limitations in handling unauthorized user identity authentication, especially in complex business scenarios, and cannot ensure the effective combination of multiple identity authentication methods.

[0003] In the deployment and use of ERP systems, enterprise users usually access ERP systems through the enterprise's internal LAN, which is relatively closed and secure. However, unauthorized users (such as employees waiting to join the company, suppliers, etc.) usually need to access the ERP system through the Internet to perform operations, such as filling in personal information or supplementing real-name authentication data. In this case, Internet access exposes the ERP system to more external risks of open networks, such as unauthorized access, data leakage or malicious attacks.

[0004] The problem of permission management for unauthorized users to access the internal interface of the ERP system through the Internet page mainly lies in how to avoid potential security risks and excessive authorization calls caused by directly exposing the internal interface of the ERP. Due to the complex access environment for external users, once the interface permissions are not designed properly, unauthorized users may abuse the interface permissions and call sensitive data or key functions of the system, thereby increasing the risk of data leakage. Summary of the invention

[0005] In order to overcome the problems existing in the related art, a platform, method and device for secure access of unauthorized users to an ERP system are provided.

[0006] According to one aspect of an embodiment of the present disclosure, there is provided a secure access platform for use of unauthorized user functions of an ERP system, the platform deploys static resources and is arranged in a first internal local area network, the platform comprises: a front-end business service module and an agent transit service module;

[0007] External users can directly access the front-end business service module through the Internet. The proxy transit service module is registered with the ERP system deployed in the second internal LAN as an application. The ERP system only authorizes the external interface to the proxy transit service module. The proxy transit service module and the external interface of the ERP system can communicate through the authentication protocol.

[0008] The front-end business service module is only used for page display and user interface interaction. External users submit requests to the ERP system through the user interface of the front-end business service module. The front-end business service module forwards the received requests to the proxy transfer service module for processing;

[0009] After receiving the request from the external user, the proxy transit service module verifies whether the request meets the preset authentication conditions, and if the request verification is passed, sends the request to the external interface of the ERP system through the authentication protocol. The front-end business service module displays the processing result obtained by the ERP system based on the received user request; if the request verification is passed, the proxy transit service module displays the request verification failure through the front-end business service module.

[0010] In a possible implementation, the proxy transit service module sends the request to the external interface corresponding to the user authority in the ERP system through an authentication protocol according to the mapping relationship between the user authority and the external interface of the ERP system.

[0011] In a possible implementation, the proxy transit service module further includes a text message verification submodule, a list verification submodule, and an identity verification submodule;

[0012] The SMS verification submodule is used for mobile phone number and SMS verification. After receiving the request, the proxy transit service module generates a verification code and sends it via SMS to the mobile terminal corresponding to the mobile phone number carried in the request. When it is determined that the verification code entered by the user in the user interface of the front-end business service module is consistent with the generated verification code, it is transferred to the list verification submodule; when it is determined that the verification code entered by the user in the user interface of the front-end business service module is inconsistent with the generated verification code, the front-end business service module displays that the request verification has failed;

[0013] The list verification submodule verifies whether the personnel information carried in the received request belongs to the preset personnel list. If it is determined that the personnel information carried in the request belongs to the preset personnel list, it will transfer to the identity authentication submodule; if it is determined that the personnel information carried in the request belongs to the preset personnel list, the front-end business service module will display that the request verification fails;

[0014] After receiving the request, the identity authentication submodule calls the external SaaS service, displays the face recognition interface on the front-end business service module, obtains the face recognition identity authentication information obtained by the user through the face recognition interface, and compares the identified person information with the person information corresponding to the request in the personnel list. When the identified person information is consistent with the person information corresponding to the request in the personnel list, the front-end business service module displays that the request verification is passed; when the identified person information is inconsistent with the person information corresponding to the request in the personnel list, the front-end business service module displays that the request verification is failed.

[0015] According to another aspect of the embodiment of the present disclosure, a secure access method for unauthorized user function use of an ERP system is provided, the method being implemented based on the above platform, and the method comprising:

[0016] Step 11, the front-end business service module forwards the request for the ERP system submitted by the user interface to the proxy transfer service module for processing;

[0017] Step 12: After receiving the request from the external user, the proxy transfer service module verifies whether the request meets the preset authentication conditions.

[0018] Step 13: If the request verification is passed, the proxy transit service module sends the request to the external interface of the ERP system through the authentication protocol; and if the request verification is passed, the front-end business service module displays that the request verification has failed;

[0019] Step 14: The front-end business service module displays the processing result obtained by the ERP system according to the received user request.

[0020] In a possible implementation, step 12 includes: step 121, the proxy transit service module sends the request to the external interface corresponding to the user authority in the ERP system through the authentication protocol according to the mapping relationship between the user authority and the external interface of the EPR system.

[0021] In a possible implementation, step 13 includes:

[0022] Step 131: after receiving the request, the proxy transit service module generates a verification code and sends it to the mobile terminal corresponding to the mobile phone number carried in the request via SMS. When it is determined that the verification code entered by the user in the user interface of the front-end business service module is consistent with the generated verification code, the process proceeds to step 132; when it is determined that the verification code entered by the user in the user interface of the front-end business service module is inconsistent with the generated verification code, the front-end business service module displays that the request verification has failed;

[0023] Step 132, the proxy transit service module verifies whether the personnel information carried in the received request belongs to the preset personnel list. When it is determined that the personnel information carried in the request belongs to the preset personnel list, the process proceeds to step 133; when it is determined that the personnel information carried in the request belongs to the preset personnel list, the front-end business service module displays that the request verification fails;

[0024] Step 133, the proxy transit service module calls the external SaaS service, displays the face recognition interface in the front-end business service module, obtains the face recognition identity authentication of the user through the face recognition interface to obtain the identified person information, and checks the identified person information with the person information corresponding to the request in the personnel list. When the identified person information is consistent with the person information corresponding to the request in the personnel list, the front-end business service module displays that the request verification is passed; when the identified person information is inconsistent with the person information corresponding to the request in the personnel list, the front-end business service module displays that the request verification is failed.

[0025] According to another aspect of an embodiment of the present disclosure, a secure access device for unauthorized user functions of an ERP system is provided, the device being implemented based on the platform described in the claim, and comprising:

[0026] A forwarding module, used to forward the request for the ERP system submitted by the user interface to the proxy transfer service module for processing;

[0027] The verification module is used to verify whether the request meets the preset authentication conditions after receiving the request from the external user.

[0028] The processing module is used to send the request to the external interface of the ERP system through the authentication protocol if the request verification passes; and to display the request verification failure through the front-end business service module if the request verification passes;

[0029] The return display module is used to display the processing results obtained by the ERP system based on the user request received.

[0030] According to another aspect of an embodiment of the present disclosure, there is provided a secure access device for unauthorized user functions of an ERP system, the device comprising:

[0031] processor;

[0032] a memory for storing processor-executable instructions;

[0033] Wherein, the processor is configured to execute the above method.

[0034] According to another aspect of an embodiment of the present disclosure, a non-volatile computer-readable storage medium is provided, on which computer program instructions are stored, and the computer program instructions implement the above method when executed by a processor.

[0035] The beneficial effects of the present disclosure are as follows: the platform provided by the present disclosure enables external users to directly access the system through the Internet by deploying static resources in the front-end business service module, thereby reducing access delays and improving user experience. At the same time, the user interface is separated from sensitive data processing to increase data security. The design of the proxy transit service module requires all external requests to go through the service for user identity verification and request legitimacy verification, thereby achieving a secure connection between external users and the ERP internal system, and through the authentication encryption and protection mechanism between the proxy transit service module and the ERP system, data security is enhanced to prevent data leakage and malicious attacks. In addition, the present disclosure performs refined permission control on each interface of the proxy transit service module, and only authorizes the external interface of the ERP system to the registered proxy transit service module, ensuring that only users who meet the role and permission can access specific interfaces, thereby achieving comprehensive interface permission verification and enhancing the security and stability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 It is a block diagram of a secure access platform used by unauthorized users of an ERP system as shown in an embodiment of the present disclosure.

[0037] Figure 2 It is a block diagram of a secure access device for use by unauthorized users of an ERP system shown in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0038] The present disclosure is further described in detail below in conjunction with the accompanying drawings and specific embodiments.

[0039] Unless otherwise defined, the technical and scientific terms used in the present disclosure have the same meanings as those generally understood by those skilled in the art to which the present disclosure belongs; the terms used in the present disclosure are only for the purpose of describing specific embodiments and are not intended to limit the present disclosure; the term "including" and any variations thereof in the present disclosure are intended to cover non-exclusive inclusions. Obviously, the embodiments described in the present disclosure are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making creative efforts are within the scope of protection of the present disclosure.

[0040] Reference to "embodiments" in this disclosure means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the disclosure. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0041] Figure 1 is a block diagram of a secure access platform for unauthorized user functions of an ERP system shown in an embodiment of the present disclosure, such as Figure 1 As shown, the platform deploys static resources (such as HTML, CSS, JS files) and is set in the first internal LAN, and the ERP system is deployed in the second internal LAN. The platform includes: a front-end business service module and an agent transit service module; external users can directly access the front-end business service module through the Internet. The agent transit service module is registered to the ERP system as an application identity, and the ERP system only authorizes the external interface to the agent transit service module. The agent transit service module and the external interface of the ERP system can communicate through the authentication protocol. Since the API of the internal application of the ERP system also implements strict interface authorization control, this design ensures that the ERP system performs comprehensive interface permission verification on the transit agent service module to ensure the security and stability of the system. The front-end business service module can be developed, for example, using H5, which is only used for page display and user interface interaction, and does not involve the processing of internal enterprise data, so that external users can safely and directly access the ERP system, ensure the separation of internal data processing interaction logic and page display, and enhance the security of the system. It can also reduce the access delay between the ERP system and external users and improve the user experience.

[0042] The proxy transit service module is the bridge between external users and the ERP system. External users submit requests to the ERP system through the user interface of the front-end business service module. The front-end business service module forwards the received request to the proxy transit service module for processing. After receiving the request from the external user, the proxy transit service module verifies whether the request meets the preset authentication conditions. If the request verification passes, the proxy transit service module sends the request to the external interface corresponding to the user authority in the ERP system through the authentication protocol according to the mapping relationship between the pre-configured user authority and the external interface (OpenAPI) of the EPR system. The ERP system processes the user request and obtains the processing result, which is returned to the front-end business service module through the proxy transit module using the authentication protocol for display. In the present disclosure, all external user requests from the Internet must be verified by the proxy transit service module to verify the user identity and the legitimacy of the request, and forwarded to the external interface inside the ERP protocol according to the preset rules. During the request process, the proxy transit service module also encrypts and protects the request according to the authentication protocol registered with the ERP system to prevent data leakage and malicious attacks.

[0043] In addition, each external interface deployed in the proxy transfer service module is subject to refined permission control, and all interface access is strictly controlled according to the user's role and permission. Only users who meet the permission conditions can access specific transfer service interfaces. This realizes the design of minimizing ERP application interface authorization.

[0044] The proxy transit service module is registered to the ERP system as an application, and only authorizes the ERP system's OpenAPI to the application. When the front-end business service initiates a request to the proxy transit service module, the transit service forwards the request to the ERP's OpenAPI after identity authentication and interface verification. Since the API of the ERP internal application also implements strict interface authorization control, this design ensures that the ERP system performs comprehensive interface permission verification on the transit proxy service, ensuring the security and stability of the system.

[0045] In a possible implementation, the proxy transit service module further includes a text message verification submodule, a list verification submodule, and an identity verification submodule.

[0046] The SMS verification submodule is used for mobile phone number and SMS verification. After receiving the request, the proxy transit service module generates a verification code and sends it via SMS to the mobile terminal corresponding to the mobile phone number carried in the request. When it is determined that the verification code entered by the user in the user interface of the front-end business service module is consistent with the generated verification code, it will be transferred to the list verification submodule; when it is determined that the verification code entered by the user in the user interface of the front-end business service module is inconsistent with the generated verification code, the front-end business service module will display that the request verification has failed. The present disclosure verifies the mobile phone number in real time by submitting the mobile phone number and receiving the SMS verification code. This method ensures the authenticity and validity of the mobile phone number, thereby avoiding the risk of false numbers or non-personal operations.

[0047] The list verification submodule can pre-configure a personnel list, which can be edited and approved according to actual needs. The list verification submodule verifies whether the personnel information carried by the request (which can be, for example, the personnel's ID number, gender, age, and the unit, etc., the present disclosure does not limit the specific content of the personnel information, as long as the personnel information can effectively and uniquely identify the corresponding person) belongs to the preset personnel list. When it is judged that the mobile phone number carried by the request belongs to the preset personnel list, it will be transferred to the identity authentication submodule; when it is judged that the mobile phone number carried by the request belongs to the preset personnel list, the front-end business service module will display that the request verification has failed. The list verification submodule can ensure that only valid personnel in the preset list can continue to perform subsequent operations. This verification step ensures that only legitimate users who have been entered into the system can access specific functions or services.

[0048] After receiving the request, the identity verification submodule calls the external SaaS service, displays the face recognition interface in the front-end business service module, and obtains the information of the person identified by the user through the face recognition interface. The person identified information is checked against the person information corresponding to the request in the personnel list. If the person identified information is consistent with the person information corresponding to the request in the personnel list, the request is determined to meet the preset authentication conditions and the request is verified. In this way, by calling the third-party face recognition information, the accuracy and legitimacy of the user's identity verification are further ensured, and the user is ensured to be consistent with the system record.

[0049] In this way, the present invention ensures the authenticity and legitimacy of the user's identity through a multi-level identity authentication mechanism including mobile phone number verification, personnel list verification and face recognition, ensures the consistency between system records and users, and reduces the risk of false numbers or non-personal operations.

[0050] According to another aspect of the embodiment of the present disclosure, a secure access method for unauthorized user function use of an ERP system is provided, the method being implemented based on the above platform, and the method comprising:

[0051] Step 11, the front-end business service module forwards the request for the ERP system submitted by the user interface to the proxy transfer service module for processing;

[0052] Step 12: After receiving the request from the external user, the proxy transfer service module verifies whether the request meets the preset authentication conditions.

[0053] Step 13: If the request verification is passed, the proxy transit service module sends the request to the external interface of the ERP system through the authentication protocol; and if the request verification is passed, the front-end business service module displays that the request verification has failed;

[0054] Step 14: The front-end business service module displays the processing result obtained by the ERP system according to the received user request.

[0055] In a possible implementation, step 12 includes: step 121, the proxy transit service module sends the request to the external interface corresponding to the user authority in the ERP system through the authentication protocol according to the mapping relationship between the user authority and the external interface of the EPR system.

[0056] In a possible implementation, step 13 includes:

[0057] Step 131: after receiving the request, the proxy transit service module generates a verification code and sends it to the mobile terminal corresponding to the mobile phone number carried in the request via SMS. When it is determined that the verification code entered by the user in the user interface of the front-end business service module is consistent with the generated verification code, the process proceeds to step 132; when it is determined that the verification code entered by the user in the user interface of the front-end business service module is inconsistent with the generated verification code, the front-end business service module displays that the request verification has failed;

[0058] Step 132, the proxy transit service module verifies whether the personnel information carried in the received request belongs to the preset personnel list. When it is determined that the personnel information carried in the request belongs to the preset personnel list, the process proceeds to step 133; when it is determined that the personnel information carried in the request belongs to the preset personnel list, the front-end business service module displays that the request verification fails;

[0059] Step 133, the proxy transit service module calls the external SaaS service, displays the face recognition interface in the front-end business service module, obtains the face recognition identity authentication of the user through the face recognition interface to obtain the identified person information, and checks the identified person information with the person information corresponding to the request in the personnel list. When the identified person information is consistent with the person information corresponding to the request in the personnel list, the front-end business service module displays that the request verification is passed; when the identified person information is inconsistent with the person information corresponding to the request in the personnel list, the front-end business service module displays that the request verification is failed.

[0060] According to another aspect of an embodiment of the present disclosure, a secure access device for unauthorized user functions of an ERP system is provided, the device being implemented based on the platform described in the claim, and comprising:

[0061] A forwarding module, used to forward the request for the ERP system submitted by the user interface to the proxy transfer service module for processing;

[0062] The verification module is used to verify whether the request meets the preset authentication conditions after receiving the request from the external user.

[0063] The processing module is used to send the request to the external interface of the ERP system through the authentication protocol if the request verification passes; and to display the request verification failure through the front-end business service module if the request verification passes;

[0064] The return display module is used to display the processing results obtained by the ERP system based on the user request received.

[0065] The description of the above method and device has been explained in detail in the description of the above platform and will not be repeated here.

[0066] Figure 2 1900 is a block diagram of a secure access platform for use by unauthorized users of an ERP system according to an embodiment of the present disclosure. For example, the device 1900 may be provided as a server. Figure 2 , the apparatus 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932 for storing instructions, such as an application, that can be executed by the processing component 1922. The application stored in the memory 1932 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute instructions to perform the above method.

[0067] The device 1900 may also include a power supply component 1926 configured to perform power management of the device 1900, a wired or wireless network interface 1950 configured to connect the device 1900 to a network, and an input / output (I / O) interface 1958. The device 1900 may operate based on an operating system stored in the memory 1932, such as Windows Server™, MacOS X™, Unix™, Linux™, FreeBSD™, or the like.

[0068] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions, which can be executed by the processing component 1922 of the device 1900 to perform the above method.

[0069] The present disclosure may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0070] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples of computer-readable storage media (a non-exhaustive list) include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium is not to be interpreted as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0071] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0072] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be customized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0073] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0074] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0075] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0076] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of the module, program segment or instruction includes one or more executable instructions for realizing the specified logical function. In some alternative implementations, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or action, or can be implemented with a combination of special hardware and computer instructions.

[0077] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A secure access platform for unauthorized user functions in an ERP system, characterized in that: The platform deploys static resources and is set up in a first internal LAN, and the platform includes: a front-end business service module and an agent transfer service module; External users can directly access the front-end business service module through the Internet. The proxy transit service module is registered with the ERP system deployed in the second internal LAN as an application. The ERP system only authorizes the external interface to the proxy transit service module. The proxy transit service module and the external interface of the ERP system can communicate through the authentication protocol. The front-end business service module is only used for page display and user interface interaction. External users submit requests to the ERP system through the user interface of the front-end business service module. The front-end business service module forwards the received requests to the proxy transfer service module for processing; After receiving the request from the external user, the proxy transit service module verifies whether the request meets the preset authentication conditions, and if the request verification is passed, sends the request to the external interface of the ERP system through the authentication protocol. The front-end business service module displays the processing result obtained by the ERP system based on the received user request; if the request verification is passed, the proxy transit service module displays the request verification failure through the front-end business service module.

2. The platform according to claim 1, characterized in that The proxy transit service module sends the request to the external interface corresponding to the user authority in the ERP system through the authentication protocol according to the mapping relationship between the user authority and the external interface of the EPR system.

3. The platform according to claim 1, characterized in that: The proxy transit service module also includes a text message verification submodule, a list verification submodule and an identity verification submodule; The SMS verification submodule is used for mobile phone number and SMS verification. After receiving the request, the proxy transit service module generates a verification code and sends it via SMS to the mobile terminal corresponding to the mobile phone number carried in the request. When it is determined that the verification code entered by the user in the user interface of the front-end business service module is consistent with the generated verification code, it will be transferred to the list verification submodule; When it is determined that the verification code entered by the user in the user interface of the front-end business service module is inconsistent with the generated verification code, the front-end business service module displays that the request verification fails; The list verification submodule verifies whether the personnel information carried in the received request belongs to the preset personnel list. If it is determined that the personnel information carried in the request belongs to the preset personnel list, it will be transferred to the identity verification submodule; When it is determined that the personnel information carried in the request belongs to the preset personnel list, the front-end business service module displays that the request verification fails; After receiving the request, the identity authentication submodule calls the external SaaS service, displays the face recognition interface on the front-end business service module, obtains the face recognition identity authentication information obtained by the user through the face recognition interface, and compares the identified person information with the person information corresponding to the request in the personnel list. When the identified person information is consistent with the person information corresponding to the request in the personnel list, the front-end business service module displays that the request verification is passed; when the identified person information is inconsistent with the person information corresponding to the request in the personnel list, the front-end business service module displays that the request verification is failed.

4. A secure access method for unauthorized user functions in an ERP system, the method being implemented based on the platform described in any one of claims 1 to 3, characterized in that: The method comprises: Step 11, the front-end business service module forwards the request for the ERP system submitted by the user interface to the proxy transfer service module for processing; Step 12: After receiving the request from the external user, the proxy transfer service module verifies whether the request meets the preset authentication conditions. Step 13: If the request verification is passed, the proxy transit service module sends the request to the external interface of the ERP system through the authentication protocol; and if the request verification is passed, the front-end business service module displays that the request verification has failed; Step 14: The front-end business service module displays the processing result obtained by the ERP system according to the received user request.

5. The method according to claim 4, characterized in that Step 12 includes: Step 121, the proxy transit service module sends the request to the external interface corresponding to the user authority in the ERP system through the authentication protocol according to the mapping relationship between the user authority and the external interface of the EPR system.

6. The method according to claim 4, characterized in that Step 13 includes: Step 131: after receiving the request, the proxy transit service module generates a verification code and sends it to the mobile terminal corresponding to the mobile phone number carried in the request via SMS. When it is determined that the verification code entered by the user in the user interface of the front-end business service module is consistent with the generated verification code, the process proceeds to step 132; when it is determined that the verification code entered by the user in the user interface of the front-end business service module is inconsistent with the generated verification code, the front-end business service module displays that the request verification has failed; Step 132, the proxy transit service module verifies whether the personnel information carried in the received request belongs to the preset personnel list. When it is determined that the personnel information carried in the request belongs to the preset personnel list, the process proceeds to step 133; when it is determined that the personnel information carried in the request belongs to the preset personnel list, the front-end business service module displays that the request verification fails; Step 133, the proxy transit service module calls the external SaaS service, displays the face recognition interface in the front-end business service module, obtains the face recognition identity authentication of the user through the face recognition interface to obtain the identified person information, and checks the identified person information with the person information corresponding to the request in the personnel list. When the identified person information is consistent with the person information corresponding to the request in the personnel list, the front-end business service module displays that the request verification is passed; when the identified person information is inconsistent with the person information corresponding to the request in the personnel list, the front-end business service module displays that the request verification is failed.

7. A secure access device for unauthorized user functions of an ERP system, the device being implemented based on the platform according to any one of claims 1 to 3, characterized in that: The device comprises: A forwarding module, used to forward the request for the ERP system submitted by the user interface to the proxy transfer service module for processing; The verification module is used to verify whether the request meets the preset authentication conditions after receiving the request from the external user. The processing module is used to send the request to the external interface of the ERP system through the authentication protocol if the request verification passes; and to display the request verification failure through the front-end business service module if the request verification passes; The return display module is used to display the processing results obtained by the ERP system based on the user request received.

8. A secure access device for unauthorized user functions in an ERP system, characterized in that: The device comprises: processor; a memory for storing processor-executable instructions; The processor is configured to execute the method according to any one of claims 4 to 6.

9. A non-volatile computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 4 to 6 is implemented.

Images