Unified authentication platform, method and device

Abstract

The invention belongs to the technical field of nuclear power, and particularly relates to a unified authentication platform, method and device. According to the unified authentication platform provided by the invention, the public authentication module and the customized authentication module are embedded into the gateway, the universal part of the authentication process is packaged into the public authentication module, and meanwhile, the customized authentication module supports customized development of different authentication algorithms, so that the system authentication process has high reusability and flexibility and is convenient to expand and maintain. The cross-system unified authentication processing is realized, the authentication process between the ERP and the third-party system is simplified, and seamless system integration is ensured. Through interaction between the gateway and the authority management subsystem and between the gateway and the secret key management subsystem, a dynamic secret key obtaining mechanism is adopted, the safety and the real-time performance of an authentication secret key pair are ensured, and repeated secret key management and calling processes are greatly reduced.

Description

Technical Field

[0001] The present disclosure belongs to the field of information technology, and specifically relates to a unified authentication platform, method and device. Background Art

[0002] In related technologies, applications usually embed authentication logic between systems into program codes, which means that when the authentication method of the external system changes, the application must be upgraded and re-released. In severe cases, it may even cause system downtime, affecting business continuity.

[0003] In the process of integrating ERP with external systems, due to the fixed key management method, the process of obtaining keys is repetitive and lengthy, resulting in the existence of a large amount of duplicate code, which reduces development efficiency.

[0004] The existing authentication methods between systems are generally duplicated, and the business logic is tightly coupled with the authentication logic, which makes subsequent maintenance difficult. The duplicate authentication logic not only reduces the efficiency of development and integration, but also increases the probability of system errors. The same errors are prone to recurrence, and the flexibility and scalability of system integration are severely limited, making it difficult to meet rapidly changing business needs and authentication method upgrades. Summary of the invention

[0005] In order to overcome the problems existing in the related technologies, a unified authentication platform, method and device are provided.

[0006] According to one aspect of an embodiment of the present disclosure, a unified authentication platform is provided, the platform is integrated in an ERP system, the platform deploys a gateway, a rights management subsystem, and a key management subsystem; the gateway deploys a public authentication module and a customized authentication module; the key management subsystem stores the identifiers of each external system and the corresponding authentication key pair; the customized authentication module stores the identifiers of each external system and the corresponding encryption algorithm; any service application in the ERP system requests authentication from the external system through the platform;

[0007] After receiving the external authentication request from the ERP system service application, the public authentication module sends a first acquisition request to the authority management subsystem, where the first acquisition request carries a static key;

[0008] After verifying the static key, the authority management subsystem returns the first dynamic key to the public authentication module in response to the first acquisition request;

[0009] The public authentication module generates a second acquisition request carrying the first dynamic key and the identifier of the external system and sends the request to the key management subsystem;

[0010] After verifying the first dynamic key, the key management subsystem returns the authentication key pair corresponding to the identifier of the external system to the public authentication module in response to the second acquisition request;

[0011] The public authentication module sends the authentication key pair and the external authentication request to the customized authentication module. The customized authentication module encrypts the authentication key pair according to the encryption algorithm associated with the external system, generates a second dynamic key, injects it into the external authentication request, and then sends it to the external system for interactive authentication with the external system.

[0012] In one possible implementation, when it is necessary to add, delete or change the encryption information of an external system, the key management subsystem can adaptively add, delete or change the identification and authentication key pair corresponding to the external system; the customized authentication module can adaptively add, delete or change the identification and encryption algorithm corresponding to the external system.

[0013] In a possible implementation, the permission management subsystem is also used to manage permission information corresponding to backend users and accounts.

[0014] In a possible implementation, each external system is registered as an application in the rights management subsystem, and corresponding application information is stored.

[0015] According to another aspect of an embodiment of the present disclosure, a unified authentication method is provided. When any service application in an ERP system needs to request authentication from an external system, the method includes:

[0016] Step 101: After receiving an external authentication request from an ERP system service application, the public authentication module of the gateway sends a first acquisition request to the authority management subsystem, where the first acquisition request carries a static key;

[0017] Step 102, after verifying the static key, the authority management subsystem returns the first dynamic key to the public authentication module in response to the first acquisition request;

[0018] Step 103: the public authentication module generates a second acquisition request carrying the first dynamic key and the identifier of the external system and sends it to the key management subsystem;

[0019] Step 104: After verifying the first dynamic key, the key management subsystem returns the authentication key pair corresponding to the identifier of the external system to the public authentication module in response to the second acquisition request;

[0020] Step 105: The public authentication module sends the authentication key pair and the external authentication request to the customized authentication module. The customized authentication module encrypts the authentication key pair according to the encryption algorithm associated with the external system, generates a second dynamic key, injects it into the external authentication request, and then sends it to the external system for interactive authentication with the external system.

[0021] In one possible implementation, when it is necessary to add, delete or change the encryption information of an external system, the key management subsystem can adaptively add, delete or change the identification and authentication key pair corresponding to the external system; the customized authentication module can adaptively add, delete or change the identification and encryption algorithm corresponding to the external system.

[0022] In a possible implementation, the permission management subsystem is also used to manage permission information corresponding to backend users and accounts.

[0023] In a possible implementation, each external system is registered as an application in the rights management subsystem, and corresponding application information is stored.

[0024] According to another aspect of an embodiment of the present disclosure, a unified authentication device is provided, the device comprising:

[0025] processor;

[0026] a memory for storing processor-executable instructions;

[0027] Wherein, the processor is configured to execute the above method.

[0028] According to another aspect of an embodiment of the present disclosure, a non-volatile computer-readable storage medium is provided, on which computer program instructions are stored, and the computer program instructions implement the above method when executed by a processor.

[0029] The beneficial effects of the present disclosure are as follows: the unified authentication platform provided by the present disclosure, by embedding the public authentication module and the customized authentication module into the gateway, encapsulates the common part of the authentication process into a public authentication module, and at the same time, the customized authentication module supports the customized development of different authentication algorithms, so that the system authentication process is highly reusable and flexible, and is easy to expand and maintain. The unified authentication processing across systems is realized, the authentication process between ERP and third-party systems is simplified, and seamless system integration is ensured. Through the interaction between the gateway and the authority management subsystem and the key management subsystem, a dynamic key acquisition mechanism is adopted to ensure the security and real-time performance of the authentication key pair, greatly reducing repeated key management and call processes.

[0030] The disclosed platform can achieve efficient and seamless authentication docking between different systems, ensuring data security and consistency in a cross-platform environment. It is flexible and lightweight, and simplifies the development and integration process while ensuring the security and reliability of the authentication mechanism. It is suitable for various complex enterprise digital integration scenarios and improves the interaction efficiency and security between systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 It is a block diagram of a unified authentication platform shown in an embodiment of the present disclosure.

[0032] Figure 2 It is a flowchart of a unified authentication method shown in an embodiment of the present disclosure.

[0033] Figure 3 It is a block diagram of a unified authentication device shown in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0034] The present disclosure is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0035] Unless otherwise defined, the technical and scientific terms used in the present disclosure have the same meanings as those generally understood by those skilled in the art to which the present disclosure belongs; the terms used in the present disclosure are only for the purpose of describing specific embodiments and are not intended to limit the present disclosure; the term "including" and any variations thereof in the present disclosure are intended to cover non-exclusive inclusions. Obviously, the embodiments described in the present disclosure are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making creative efforts are within the scope of protection of the present disclosure.

[0036] Reference to "embodiments" in this disclosure means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the disclosure. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0037] Figure 1 is a block diagram of a unified authentication platform shown in an embodiment of the present disclosure, such as Figure 1 As shown, the platform is integrated in the ERP system, and the platform deploys a gateway (which may be, for example, an APIG gateway), a rights management subsystem, and a key management subsystem; the gateway deploys a public authentication module and a customized authentication module;

[0038] The present disclosure uses a gateway as a unified outlet for external traffic of the ERP system, and all external request traffic is processed through the gateway. The public authentication module and the customized authentication module can be embedded in the gateway in the form of a plug-in, for example, to intercept and process all external authentication requests received by the gateway in a contextual manner. This mechanism ensures the consistency of the system's external communication. At the same time, it can flexibly handle authentication requirements from different service applications.

[0039] The key management subsystem has the KMS (Key Management Service) function, which can store the identifiers of multiple external systems and the corresponding authentication key pairs, including AK (Access Key) and SK (Secret Key), taking into account the security of the key and the uniformity of management. The customized authentication module stores the identifiers of each external system and the corresponding encryption algorithm.

[0040] After receiving the external authentication request from the ERP system service application, the public authentication module sends a first acquisition request to the authority management subsystem, and the first acquisition request carries a static key; after verifying the static key, the authority management subsystem returns a first dynamic key to the public authentication module in response to the first acquisition request.

[0041] After receiving the first dynamic key, the public authentication module generates a second acquisition request carrying the first dynamic key and the identifier of the external system and sends it to the key management subsystem; after verifying the first dynamic key, the key management subsystem returns an authentication key pair corresponding to the identifier of the external system to the public authentication module in response to the second acquisition request;

[0042] The present invention stores the authentication key pair in the key management subsystem, uses the static key configured in the gateway to obtain the dynamic key from the authority management subsystem, and the gateway then obtains the authentication key pair corresponding to the external system from the key management subsystem through the dynamic key. The dynamic key acquisition mechanism of dual authentication ensures that the key is not leaked or abused during use, realizes the dynamism and flexibility of the authentication process, ensures the security of authentication, and makes subsequent key requests more flexible and efficient.

[0043] In addition, the present disclosure takes into account that the authentication processes of different external systems are highly similar in structure, and adopts a common authentication module to abstract and functionally encapsulate the common parts of the authentication process, thereby simplifying the integration process of different systems, so that the common authentication processes of all systems can share the common authentication module, achieving high reuse of the authentication process, reducing the writing and maintenance of repetitive code, and greatly improving the efficiency of using authentication keys.

[0044] After obtaining the authentication key pair, the public authentication module sends the authentication key pair and the external authentication request to the customized authentication module. The customized authentication module encrypts the authentication key pair according to the encryption algorithm associated with the external system, generates a second dynamic key, injects it into the external authentication request, and then sends it to the external system for interactive authentication with the external system. The encryption authentication algorithms of different systems disclosed in the present invention can be customized according to specific authentication requirements. In the customized authentication module, the encryption algorithm corresponding to each system only needs to implement the different parts of the authentication algorithm of the system, and the rest of the process is completed by the public authentication module, thereby realizing flexible authentication logic adaptation.

[0045] The platform disclosed in this paper assembles and deploys the public authentication module and the customized authentication module into the gateway. The external request traffic is first processed by the public plug-in, and then transferred to the corresponding authentication plug-in for encryption processing according to the authentication requirements of different systems. This design makes the business system unaware of the authentication process, ensuring the dynamic adaptation and seamless upgrade of system integration authentication.

[0046] In one possible implementation, when it is necessary to add, delete or change the encryption information of an external system, the key management subsystem can adaptively add, delete or change the identification and authentication key pair corresponding to the external system; the customized authentication module can adaptively add, delete or change the identification and encryption algorithm corresponding to the external system.

[0047] The present disclosure can adopt a unified Lua script plug-in mechanism, which greatly simplifies the complexity of cross-system authentication integration, and at the same time realizes efficient and flexible authentication logic with the help of Lua's dynamic characteristics. At the same time, it supports customized development of different authentication algorithms in the customized authentication module, so that the system authentication process is highly reusable and flexible, and easy to expand and maintain. The overall design not only meets the security requirements of various system authentications, but also utilizes the hot repair characteristics of Lua scripts, which is more conducive to seamless upgrades and dynamic adaptation of authentication methods, and also improves the scalability and maintainability of the system, avoiding frequent program releases and system downtime.

[0048] In a possible implementation, the functions of the platform of the present disclosure may be implemented, for example, using Lua scripts. It should be noted that other adapted assembly language scripts may also be used, and the present disclosure does not limit this.

[0049] In a possible implementation, the permission management subsystem is also used to manage the permission information corresponding to the background users and accounts. Each external system is registered as an application in the permission management subsystem and stores the corresponding application information. In this way, the permission management subsystem can also judge the permission of the application service corresponding to the static key according to the stored permission information after receiving the static key, send the static key when the application service has the permission, and return a prompt message to the application service when the application service does not have the permission to prompt the application service that it does not have the requested permission.

[0050] Figure 2 is a flow chart of a unified authentication method shown in an embodiment of the present disclosure. The method can be implemented based on the above-mentioned EPR system, and the embodiment of the present disclosure does not limit the type of terminal device. Figure 2 As shown, the method includes:

[0051] Step 101: After receiving an external authentication request from an ERP system service application, the public authentication module of the gateway sends a first acquisition request to the authority management subsystem, where the first acquisition request carries a static key.

[0052] Step 102: After verifying the static key, the authority management subsystem returns a first dynamic key to the public authentication module in response to the first acquisition request.

[0053] Step 103: The public authentication module generates a second acquisition request carrying the first dynamic key and the identifier of the external system and sends it to the key management subsystem.

[0054] Step 104: After verifying the first dynamic key, the key management subsystem returns the authentication key pair corresponding to the identifier of the external system to the public authentication module in response to the second acquisition request.

[0055] Step 105: The public authentication module sends the authentication key pair and the external authentication request to the customized authentication module. The customized authentication module encrypts the authentication key pair according to the encryption algorithm associated with the external system, generates a second dynamic key, injects it into the external authentication request, and then sends it to the external system for interactive authentication with the external system.

[0056] In one possible implementation, when it is necessary to add, delete or change the encryption information of an external system, the key management subsystem can adaptively add, delete or change the identification and authentication key pair corresponding to the external system; the customized authentication module can adaptively add, delete or change the identification and encryption algorithm corresponding to the external system.

[0057] In a possible implementation, the permission management subsystem is also used to manage permission information corresponding to backend users and accounts.

[0058] In a possible implementation, each external system is registered as an application in the rights management subsystem, and corresponding application information is stored.

[0059] The description of the above method has been explained in detail in the description of the above platform and will not be repeated here.

[0060] Figure 3 1900 is a block diagram of a unified authentication device shown in an embodiment of the present disclosure. For example, the device 1900 may be provided as a server. Figure 3 , the apparatus 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932 for storing instructions, such as an application, that can be executed by the processing component 1922. The application stored in the memory 1932 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute instructions to perform the above method.

[0061] The device 1900 may also include a power supply component 1926 configured to perform power management of the device 1900, a wired or wireless network interface 1950 configured to connect the device 1900 to a network, and an input / output (I / O) interface 1958. The device 1900 may operate based on an operating system stored in the memory 1932, such as Windows Server™, MacOS X™, Unix™, Linux™, FreeBSD™, or the like.

[0062] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions, which can be executed by the processing component 1922 of the device 1900 to perform the above method.

[0063] The present disclosure may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0064] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples of computer-readable storage media (a non-exhaustive list) include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium is not to be interpreted as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0065] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0066] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be customized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0067] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0068] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0069] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0070] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of the module, program segment or instruction includes one or more executable instructions for realizing the specified logical function. In some alternative implementations, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or action, or can be implemented with a combination of special hardware and computer instructions.

[0071] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A unified authentication platform, characterized in that: The platform is integrated into the ERP system, and the platform deploys a gateway, a rights management subsystem, and a key management subsystem; The gateway deploys a public authentication module and a customized authentication module; The key management subsystem stores the identifiers of each external system and the corresponding authentication key pair; the customized authentication module stores the identifiers of each external system and the corresponding encryption algorithm; any service application in the ERP system requests authentication from the external system through the platform; After receiving the external authentication request from the ERP system service application, the public authentication module sends a first acquisition request to the authority management subsystem, where the first acquisition request carries a static key; After verifying the static key, the authority management subsystem returns the first dynamic key to the public authentication module in response to the first acquisition request; The public authentication module generates a second acquisition request carrying the first dynamic key and the identifier of the external system and sends the request to the key management subsystem; After verifying the first dynamic key, the key management subsystem returns the authentication key pair corresponding to the identifier of the external system to the public authentication module in response to the second acquisition request; The public authentication module sends the authentication key pair and the external authentication request to the customized authentication module. The customized authentication module encrypts the authentication key pair according to the encryption algorithm associated with the external system, generates a second dynamic key, injects it into the external authentication request, and then sends it to the external system for interactive authentication with the external system.

2. The platform according to claim 1, characterized in that When it is necessary to add, delete or change the encryption information of an external system, the key management subsystem can adaptively add, delete or change the identification and authentication key pair corresponding to the external system; the customized authentication module can adaptively add, delete or change the identification and encryption algorithm corresponding to the external system.

3. The platform according to claim 1, characterized in that: The authority management subsystem is also used to manage the authority information corresponding to the backend users and accounts.

4. The platform according to claim 1, characterized in that Each external system is registered as an application in the authority management subsystem, and the corresponding application information is stored.

5. A unified authentication method, characterized in that: When any service application in the ERP system needs to request authentication from an external system, the method includes: Step 101: After receiving an external authentication request from an ERP system service application, the public authentication module of the gateway sends a first acquisition request to the authority management subsystem, where the first acquisition request carries a static key; Step 102, after verifying the static key, the authority management subsystem returns the first dynamic key to the public authentication module in response to the first acquisition request; Step 103: the public authentication module generates a second acquisition request carrying the first dynamic key and the identifier of the external system and sends it to the key management subsystem; Step 104: After verifying the first dynamic key, the key management subsystem returns the authentication key pair corresponding to the identifier of the external system to the public authentication module in response to the second acquisition request; Step 105: The public authentication module sends the authentication key pair and the external authentication request to the customized authentication module. The customized authentication module encrypts the authentication key pair according to the encryption algorithm associated with the external system, generates a second dynamic key, injects it into the external authentication request, and then sends it to the external system for interactive authentication with the external system.

6. The method according to claim 1, characterized in that When it is necessary to add, delete or change the encryption information of an external system, the key management subsystem can adaptively add, delete or change the identification and authentication key pair corresponding to the external system; the customized authentication module can adaptively add, delete or change the identification and encryption algorithm corresponding to the external system.

7. The method according to claim 1, characterized in that The authority management subsystem is also used to manage the authority information corresponding to the backend users and accounts.

8. The method according to claim 1, characterized in that Each external system is registered as an application in the authority management subsystem, and the corresponding application information is stored.

9. A unified authentication device, characterized in that: The device comprises: processor; a memory for storing processor-executable instructions; The processor is configured to execute the method described in any one of claims 5 to 8.

10. A non-volatile computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 5 to 8 is implemented.

Images