Unified authentication platform, method and device

Abstract

This disclosure belongs to the field of nuclear power technology, specifically relating to a unified authentication platform, method, and apparatus. The unified authentication platform provided by this disclosure embeds a common authentication module and a customized authentication module into a gateway. The common parts of the authentication process are encapsulated into the common authentication module, while the customized authentication module supports the customized development of different authentication algorithms. This makes the system authentication process highly reusable and flexible, facilitating expansion and maintenance. It achieves unified authentication processing across systems, simplifies the authentication process between ERP and third-party systems, and ensures seamless system integration. Through the interaction between the gateway and the access control subsystem and the key management subsystem, a dynamic key acquisition mechanism is adopted to ensure the security and real-time performance of authentication key pairs, greatly reducing repetitive key management and invocation processes.

Description

Technical Field

[0001] This disclosure belongs to the field of information technology, specifically relating to a unified authentication platform, method, and apparatus. Background Technology

[0002] In related technologies, applications typically embed inter-system authentication logic into their program code. This means that when the authentication method of an external system changes, the application must be upgraded and redeployed. In severe cases, this can even lead to system downtime and affect business continuity.

[0003] During the integration of ERP with external systems, the fixed key management method and the repetitive and lengthy process of obtaining keys result in a large amount of duplicate code, which reduces development efficiency.

[0004] The existing authentication methods commonly suffer from duplication, with business logic tightly coupled with authentication logic, leading to significant maintenance difficulties. This duplication of authentication logic not only reduces development and integration efficiency but also increases the likelihood of system errors, with the same errors easily recurring. This severely limits the flexibility and scalability of system integration, making it difficult to meet rapidly changing business needs and upgrade authentication methods. Summary of the Invention

[0005] To overcome the problems existing in related technologies, a unified authentication platform, method and device are provided.

[0006] According to one aspect of the present disclosure, a unified authentication platform is provided, the platform being integrated into an ERP system. The platform deploys a gateway, a permission management subsystem, and a key management subsystem. The gateway deploys a public authentication module and a customized authentication module. The key management subsystem stores the identifiers of each external system and their corresponding authentication key pairs. The customized authentication module stores the identifiers of each external system and their corresponding encryption algorithms. Any service application in the ERP system requests authentication from the external systems through the platform.

[0007] After receiving an external authentication request from the ERP system service application, the public authentication module sends a first acquisition request to the permission management subsystem, which carries a static key.

[0008] After verifying the static key, the permission management subsystem responds to the first acquisition request by returning the first dynamic key to the public authentication module.

[0009] The public authentication module generates a second acquisition request carrying the first dynamic key and the identifier of the external system and sends it to the key management subsystem;

[0010] After verifying the first dynamic key, the key management subsystem responds to the second acquisition request by returning the authentication key pair corresponding to the identifier of the external system to the public authentication module.

[0011] The public authentication module sends the authentication key pair and the external authentication request to the customized authentication module. The customized authentication module encrypts the authentication key pair according to the encryption algorithm associated with the external system, generates a second dynamic key, injects it into the external authentication request, and sends it to the external system for authentication interaction with the external system.

[0012] In one possible implementation, when it is necessary to add, delete, or change the encryption information of an external system, the key management subsystem can adaptively add, delete, or change the identifier and authentication key pair corresponding to the external system; the customized authentication module can adaptively add, delete, or change the identifier and encryption algorithm corresponding to the external system.

[0013] In one possible implementation, the permission management subsystem is also used to manage the permission information corresponding to backend users and accounts.

[0014] In one possible implementation, each external system registers as an application in the permission management subsystem and stores the corresponding application information.

[0015] According to another aspect of the embodiments of this disclosure, a unified authentication method is provided, wherein when any service application in an ERP system needs to request authentication from an external system, the method includes:

[0016] Step 101: After receiving the external authentication request from the ERP system service application, the public authentication module of the gateway sends a first acquisition request to the permission management subsystem. The first acquisition request carries a static key.

[0017] Step 102: After verifying the static key, the permission management subsystem responds to the first acquisition request by returning the first dynamic key to the public authentication module.

[0018] Step 103: The public authentication module generates a second acquisition request carrying the first dynamic key and the identifier of the external system and sends it to the key management subsystem;

[0019] Step 104: After verifying the first dynamic key, the key management subsystem, in response to the second acquisition request, returns the authentication key pair corresponding to the identifier of the external system to the public authentication module.

[0020] Step 105: The public authentication module sends the authentication key pair and the external authentication request to the customized authentication module. The customized authentication module encrypts the authentication key pair according to the encryption algorithm associated with the external system, generates a second dynamic key, injects it into the external authentication request, and sends it to the external system for authentication interaction with the external system.

[0021] In one possible implementation, when it is necessary to add, delete, or change the encryption information of an external system, the key management subsystem can adaptively add, delete, or change the identifier and authentication key pair corresponding to the external system; the customized authentication module can adaptively add, delete, or change the identifier and encryption algorithm corresponding to the external system.

[0022] In one possible implementation, the permission management subsystem is also used to manage the permission information corresponding to backend users and accounts.

[0023] In one possible implementation, each external system registers as an application in the permission management subsystem and stores the corresponding application information.

[0024] According to another aspect of the embodiments of this disclosure, a unified authentication device is provided, the device comprising:

[0025] processor;

[0026] Memory used to store processor-executable instructions;

[0027] The processor is configured to execute the above-described method.

[0028] According to another aspect of the present disclosure, a non-volatile computer-readable storage medium is provided, on which computer program instructions are stored, which, when executed by a processor, implement the above-described method.

[0029] The beneficial effects of this disclosure are as follows: The unified authentication platform provided by this disclosure, by embedding a public authentication module and a customized authentication module into the gateway, encapsulates the common parts of the authentication process into a public authentication module, while the customized authentication module supports the customized development of different authentication algorithms. This makes the system authentication process highly reusable and flexible, facilitating expansion and maintenance. It achieves unified authentication processing across systems, simplifies the authentication process between ERP and third-party systems, and ensures seamless system integration. Through the interaction between the gateway and the permission management subsystem and the key management subsystem, a dynamic key acquisition mechanism is adopted to ensure the security and real-time performance of authentication key pairs, greatly reducing repetitive key management and invocation processes.

[0030] This publicly disclosed platform enables efficient and seamless authentication integration between different systems, ensuring data security and consistency in cross-platform environments. It is flexible and lightweight, simplifying development and integration processes while ensuring the security and reliability of the authentication mechanism. It is suitable for various complex enterprise digital integration scenarios, improving the efficiency and security of inter-system interactions. Attached Figure Description

[0031] Figure 1 This is a block diagram illustrating a unified authentication platform according to an embodiment of this disclosure.

[0032] Figure 2 This is a flowchart illustrating a unified authentication method according to an embodiment of this disclosure.

[0033] Figure 3 This is a block diagram illustrating a unified authentication device according to an embodiment of this disclosure. Detailed Implementation

[0034] The present disclosure will now be described in further detail with reference to the accompanying drawings and specific embodiments.

[0035] Unless otherwise defined, the technical and scientific terms used in this disclosure have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure pertains; the terminology used in this disclosure is for the purpose of describing particular embodiments only and is not intended to be limiting of this disclosure; the term "comprising" and any variations thereof in this disclosure are intended to cover non-exclusive inclusion. Clearly, the embodiments described in this disclosure are only a part of the embodiments of this disclosure, and not all of them. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of this disclosure without inventive effort are within the scope of protection of this disclosure.

[0036] In this disclosure, the reference to "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this disclosure. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0037] Figure 1 This is a block diagram illustrating a unified authentication platform according to an embodiment of this disclosure, such as... Figure 1 As shown, the platform is integrated into the ERP system, and the platform deploys a gateway (which may be, for example, an APIG gateway), an access control subsystem, and a key management subsystem; the gateway deploys a public authentication module and a customized authentication module;

[0038] This disclosure uses a gateway as the unified exit point for external traffic from the ERP system, processing all external request traffic through this gateway. Public and custom authentication modules can be embedded within the gateway, for example as plugins, intercepting and processing all external authentication requests received by the gateway using contextualization. This mechanism ensures the consistency of the system's external communication and allows for flexible handling of authentication requirements from different service applications.

[0039] The key management subsystem has KMS (Key Management Service) functionality, which can store the identifiers of multiple external systems and their corresponding authentication key pairs. The authentication key pairs include AK (Access Key) and SK (Secret Key), balancing key security with unified management. The customized authentication module stores the identifiers of each external system and their corresponding encryption algorithms.

[0040] After receiving an external authentication request from the ERP system service application, the public authentication module sends a first acquisition request to the permission management subsystem, which carries a static key. After verifying the static key, the permission management subsystem responds to the first acquisition request by returning a first dynamic key to the public authentication module.

[0041] After receiving the first dynamic key, the public authentication module generates a second acquisition request carrying the first dynamic key and the identifier of the external system and sends it to the key management subsystem; after verifying the first dynamic key, the key management subsystem responds to the second acquisition request and returns the authentication key pair corresponding to the identifier of the external system to the public authentication module.

[0042] This disclosure stores the authentication key pair in the key management subsystem. Using the static key configured in the gateway, a dynamic key is obtained from the permission management subsystem. The gateway then obtains the corresponding authentication key pair from the external system through the key management subsystem using the dynamic key. This dual-authentication dynamic key acquisition mechanism ensures that the key is not leaked or abused during use, realizing the dynamism and flexibility of the authentication process, ensuring the security of authentication, and making subsequent key requests more flexible and efficient.

[0043] Furthermore, considering that the authentication processes of different external systems are highly similar in structure, this disclosure adopts a common authentication module to abstract and encapsulate the common parts of the authentication process, thereby simplifying the integration process of different systems. This allows all systems to share the common authentication module, achieving a high degree of reuse of the authentication process, reducing the writing and maintenance of repetitive code, and significantly improving the efficiency of authentication key usage.

[0044] After obtaining the authentication key pair, the public authentication module sends the authentication key pair and the external authentication request to the customized authentication module. The customized authentication module encrypts the authentication key pair according to the encryption algorithm associated with the external system, generates a second dynamic key, injects it into the external authentication request, and sends it to the external system for authentication interaction. This disclosure allows for customized development of encryption authentication algorithms for different systems based on specific authentication requirements. In the customized authentication module, the encryption algorithm corresponding to each system only needs to implement the differences in the authentication algorithm for that system; the remaining processes are completed by the public authentication module, thereby achieving flexible authentication logic adaptation.

[0045] This disclosed platform assembles and deploys a public authentication module and a customized authentication module into the gateway. External request traffic is first processed by the public plugin, and then, based on the authentication requirements of different systems, it flows to the corresponding authentication plugin for encryption. This design makes the authentication process transparent to business systems, ensuring dynamic adaptation and seamless upgrades of system integration authentication.

[0046] In one possible implementation, when it is necessary to add, delete, or change the encryption information of an external system, the key management subsystem can adaptively add, delete, or change the identifier and authentication key pair corresponding to the external system; the customized authentication module can adaptively add, delete, or change the identifier and encryption algorithm corresponding to the external system.

[0047] This disclosure employs a unified Lua script plugin mechanism, significantly simplifying the complexity of cross-system authentication integration. It also leverages Lua's dynamic characteristics to achieve efficient and flexible authentication logic. Furthermore, it supports customized development of different authentication algorithms within the custom authentication module, making the system authentication process highly reusable and flexible, facilitating expansion and maintenance. The overall design not only meets the security requirements of various system authentications but also utilizes Lua script's hot-fix capabilities for seamless upgrades and dynamic adaptation of authentication methods. It further enhances the system's scalability and maintainability, avoiding frequent program releases and system downtime.

[0048] In one possible implementation, the functionality of this platform can be achieved, for example, using Lua scripts. It should be noted that other adapted assembly language scripts can also be used, and this disclosure does not limit this.

[0049] In one possible implementation, the permission management subsystem is also used to manage permission information corresponding to backend users and accounts. Each external system registers as an application with the permission management subsystem and stores corresponding application information. Thus, upon receiving a static key, the permission management subsystem can determine the permissions of the application service corresponding to that static key based on the stored permission information. If the application service has the permission, the static key is sent; if the application service does not have the permission, a prompt message is returned to the application service indicating that the application service does not have the requested permission.

[0050] Figure 2 This is a flowchart illustrating a unified authentication method according to an embodiment of this disclosure. This method can be implemented based on the aforementioned ERP system, and this disclosure does not limit the type of terminal device. Figure 2 As shown, the method includes:

[0051] Step 101: After receiving the external authentication request from the ERP system service application, the gateway's public authentication module sends a first acquisition request to the permission management subsystem. This first acquisition request carries a static key.

[0052] Step 102: After verifying the static key, the permission management subsystem responds to the first acquisition request by returning the first dynamic key to the public authentication module.

[0053] Step 103: The public authentication module generates a second acquisition request carrying the first dynamic key and the identifier of the external system and sends it to the key management subsystem.

[0054] Step 104: After verifying the first dynamic key, the key management subsystem responds to the second acquisition request by returning the authentication key pair corresponding to the identifier of the external system to the public authentication module.

[0055] Step 105: The public authentication module sends the authentication key pair and the external authentication request to the customized authentication module. The customized authentication module encrypts the authentication key pair according to the encryption algorithm associated with the external system, generates a second dynamic key, injects it into the external authentication request, and sends it to the external system for authentication interaction with the external system.

[0056] In one possible implementation, when it is necessary to add, delete, or change the encryption information of an external system, the key management subsystem can adaptively add, delete, or change the identifier and authentication key pair corresponding to the external system; the customized authentication module can adaptively add, delete, or change the identifier and encryption algorithm corresponding to the external system.

[0057] In one possible implementation, the permission management subsystem is also used to manage the permission information corresponding to backend users and accounts.

[0058] In one possible implementation, each external system registers as an application in the permission management subsystem and stores the corresponding application information.

[0059] The methods described above have already been explained in detail in the descriptions of the aforementioned platforms, and will not be repeated here.

[0060] Figure 3 This is a block diagram illustrating a unified authentication device according to an embodiment of this disclosure. For example, device 1900 can be provided as a server. (Refer to...) Figure 3 The apparatus 1900 includes a processing component 1922, which further includes one or more processors, and memory resources represented by memory 1932 for storing instructions, such as application programs, that can be executed by the processing component 1922. The application programs stored in memory 1932 may include one or more modules, each corresponding to a set of instructions. Furthermore, the processing component 1922 is configured to execute instructions to perform the methods described above.

[0061] Device 1900 may also include a power supply component 1926 configured to perform power management of device 1900, a wired or wireless network interface 1950 configured to connect device 1900 to a network, and an input / output (I / O) interface 1958. Device 1900 can operate on an operating system stored in memory 1932, such as Windows Server™, MacOS X™, Unix™, Linux™, FreeBSD™, or similar.

[0062] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions that can be executed by a processing component 1922 of the device 1900 to perform the above-described method.

[0063] This disclosure can be a system, method, and / or computer program product. A computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for causing a processor to implement various aspects of this disclosure.

[0064] Computer-readable storage media can be tangible devices capable of holding and storing instructions for use by an instruction execution device. Computer-readable storage media can be, for example—but not limited to—electrical storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital multifunction disc (DVD), memory sticks, floppy disks, mechanical encoding devices, such as punch cards or recessed protrusions storing instructions thereon, and any suitable combination thereof. The computer-readable storage media used herein are not to be construed as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses through fiber optic cables), or electrical signals transmitted through wires.

[0065] The computer-readable program instructions described herein can be downloaded from computer-readable storage media to various computing / processing devices, or downloaded via a network, such as the Internet, local area network, wide area network, and / or wireless network, to an external computer or external storage device. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to the computer-readable storage media in the respective computing / processing device.

[0066] Computer program instructions used to perform the operations of this disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, status setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, etc., and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry, such as programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), is personalized by utilizing the status information of the computer-readable program instructions to implement various aspects of this disclosure.

[0067] Various aspects of this disclosure are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0068] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that, when executed by the processor of the computer or other programmable data processing apparatus, they create means for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to operate in a particular manner; thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing aspects of the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0069] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0070] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of an instruction containing one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than those shown in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0071] The various embodiments of this disclosure have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or improvement of the technology in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A unified authentication platform, characterized in that, The platform is integrated into the ERP system, and the platform deploys a gateway, an access control subsystem, and a key management subsystem. The gateway deploys a public authentication module and a customized authentication module; The key management subsystem stores the identifiers of each external system and their corresponding authentication key pairs; the customized authentication module stores the identifiers of each external system and their corresponding encryption algorithms; any service application in the ERP system requests authentication from the external system through the platform. After receiving an external authentication request from the ERP system service application, the public authentication module sends a first acquisition request to the permission management subsystem, which carries a static key. After verifying the static key, the permission management subsystem responds to the first acquisition request by returning the first dynamic key to the public authentication module. The public authentication module generates a second acquisition request carrying the first dynamic key and the identifier of the external system and sends it to the key management subsystem; After verifying the first dynamic key, the key management subsystem responds to the second acquisition request by returning the authentication key pair corresponding to the identifier of the external system to the public authentication module. The public authentication module sends the authentication key pair and the external authentication request to the customized authentication module. The customized authentication module encrypts the authentication key pair according to the encryption algorithm associated with the external system, generates a second dynamic key, injects it into the external authentication request, and sends it to the external system for authentication interaction with the external system.

2. The platform according to claim 1, characterized in that, When it is necessary to add, delete, or change the encryption information of an external system, the key management subsystem can adaptively add, delete, or change the identifier and authentication key pair corresponding to the external system; the customized authentication module can adaptively add, delete, or change the identifier and encryption algorithm corresponding to the external system.

3. The platform according to claim 1, characterized in that, The permission management subsystem is also used to manage the permission information corresponding to backend users and accounts.

4. The platform according to claim 1, characterized in that, Each external system registers as an application in the permission management subsystem and stores the corresponding application information.

5. A unified authentication method, characterized in that, When any service application in the ERP system needs to request authentication from an external system, the method includes: Step 101: After receiving the external authentication request from the ERP system service application, the public authentication module of the gateway sends a first acquisition request to the permission management subsystem. The first acquisition request carries a static key. Step 102: After verifying the static key, the permission management subsystem responds to the first acquisition request by returning the first dynamic key to the public authentication module. Step 103: The public authentication module generates a second acquisition request carrying the first dynamic key and the identifier of the external system and sends it to the key management subsystem; Step 104: After verifying the first dynamic key, the key management subsystem, in response to the second acquisition request, returns the authentication key pair corresponding to the identifier of the external system to the public authentication module. Step 105: The public authentication module sends the authentication key pair and the external authentication request to the customized authentication module of the gateway. The customized authentication module encrypts the authentication key pair according to the encryption algorithm associated with the external system, generates a second dynamic key, injects it into the external authentication request, and sends it to the external system for authentication interaction with the external system.

6. The method according to claim 5, characterized in that, When it is necessary to add, delete, or change the encryption information of an external system, the key management subsystem can adaptively add, delete, or change the identifier and authentication key pair corresponding to the external system; the customized authentication module can adaptively add, delete, or change the identifier and encryption algorithm corresponding to the external system.

7. The method according to claim 5, characterized in that, The permission management subsystem is also used to manage the permission information corresponding to backend users and accounts.

8. The method according to claim 5, characterized in that, Each external system registers as an application in the permission management subsystem and stores the corresponding application information.

9. A unified authentication device, characterized in that, The device includes: processor; Memory used to store processor-executable instructions; The processor is configured to perform the method according to any one of claims 5 to 8.

10. A non-volatile computer-readable storage medium storing computer program instructions thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 5 to 8.

Images