Data access method and device based on cross-unit unified identity authentication system

Abstract

The invention belongs to the technical field of information security, and particularly relates to a data access method and device based on a cross-unit unified identity authentication system, and the method comprises the steps: S1, carrying out the identity verification of a user through an application client of a unit where the user is located; s2, the unified authentication server issues a unified authentication identity; s3, the user sends the unified authentication identity to the server of the unit to be accessed; s4, the application server of the unit to be accessed verifies the unified authentication identity, and after verification is passed, an account of the user in the unit to be accessed is determined; and S5, based on the access authority of the account of the unit to be accessed of the user, constructing a communication link between the database matched with the access authority and the application client. According to the application, the joint authentication of the user and the application is realized, the hidden danger of security and secrecy caused by a cross-unit traditional application docking mode is avoided, and the security and secrecy control capability is improved.

Description

Technical Field

[0001] The present application belongs to the field of information security technology, and in particular relates to a data access method and device based on a cross-unit unified identity authentication system. Background Art

[0002] Some groups have hundreds of subordinate units, each of which is engaged in information system construction. The completed information systems are also deployed within the units. At the same time, due to the constraints of security and confidentiality factors unique to the group, the networks within the member units are blocked from each other, and the business systems are independent of each other, resulting in duplicate system construction and serious waste of resources. At the same time, with the increase in the complexity of equipment development, it is difficult for a single unit to independently complete the development of the entire equipment under the traditional model. The joint cooperation of multiple units within the group has become the mainstream equipment development model.

[0003] At present, each unit within the group has independently built its own identity authentication (PKI / CA) system and realized internal identity authentication management. However, since each unit adopts different identity authentication methods, such as two-factor authentication, dynamic token authentication, fingerprint authentication, etc., there is no unified standard specification. Different authentication technologies make the authentication systems of each unit unrelated and difficult to trust. The two parties can only visit each other by opening network ports and providing user names and passwords. This method has security vulnerabilities and risks of leakage, which seriously affects the security protection level of the information system. Summary of the invention

[0004] In order to solve the above problems, the present application provides a data access method and device based on a cross-unit unified identity authentication system to solve the existing problems of user identities not being able to trust each other across units and system resources not being able to be shared.

[0005] The first aspect of the present application provides a data access method based on a cross-unit unified identity authentication system, mainly comprising:

[0006] Step S1: The application client of the unit where the user works authenticates the user;

[0007] Step S2: The unified authentication server issues a unified authentication identity;

[0008] Step S3: The user sends the unified authentication identity to the server of the unit to be accessed;

[0009] Step S4: The application server of the unit to be visited verifies the unified authentication identity, and after the verification is passed, determines the user's account number in the unit to be visited;

[0010] Step S5: Based on the access rights of the user's account of the unit to be accessed, a communication link between the database matching the access rights and the application client is constructed.

[0011] Preferably, in step S1, the identity authentication includes dual authentication of a digital certificate and a password, or dual authentication of a digital certificate and a scan.

[0012] Preferably, step S2 further comprises:

[0013] Step S21: For a user who has passed identity authentication, the unified authentication server receives a server access request to the access unit initiated by the user;

[0014] Step S22: The unified authentication server retrieves the unified authentication identity of the user and feeds it back to the application client.

[0015] Preferably, step S4 further comprises:

[0016] Step S41, the application server of the unit to be accessed sends the unified authentication identity to the unified authentication server;

[0017] Step S42: The unified authentication server verifies whether the user exists. If the user exists, the account number registered by the user in the unit to be visited is retrieved and sent to the application server of the unit to be visited.

[0018] The second aspect of the present application provides a data access device based on a cross-unit unified identity authentication system, mainly comprising:

[0019] The identity authentication module is used for the application client of the user's unit to authenticate the user;

[0020] Access credential acquisition module, used for unified authentication identity issued by unified authentication server;

[0021] An access credential sending module is used for the user to send the unified authentication identity to the server of the unit to be accessed;

[0022] An access credential verification module is used to verify the unified authentication identity by the application server of the unit to be visited, and after the verification is passed, determine the user's account number in the unit to be visited;

[0023] The data communication building module is used to build a communication link between the database matching the access rights and the application client based on the access rights of the account of the unit to be visited by the user.

[0024] Preferably, in the identity authentication module, the identity authentication includes dual authentication of a digital certificate and a password, or dual authentication of a digital certificate and a scan.

[0025] Preferably, the access credential acquisition module includes:

[0026] A server access request acquisition unit is used for receiving, by a unified authentication server, a server access request initiated by a user who has passed identity authentication to a server access unit to be accessed;

[0027] The unified authentication identity determination unit is used to retrieve the unified authentication identity of the user from the unified authentication server and feed it back to the application client.

[0028] Preferably, the access credential verification module includes:

[0029] A unified authentication identity sending unit, configured to send the unified authentication identity to a unified authentication server from the application server of the unit to be accessed;

[0030] The user account acquisition unit is used to verify whether the user exists through the unified authentication server. If the user exists, the account registered by the user in the unit to be visited is retrieved and sent to the application server of the unit to be visited.

[0031] This application realizes the joint authentication of users and applications, avoids the security and confidentiality risks brought by the traditional cross-unit application docking mode, and improves the security and confidentiality control capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 It is a flowchart of a preferred embodiment of the data access method based on the cross-unit unified identity authentication system of the present application. DETAILED DESCRIPTION

[0033] In order to make the purpose, technical scheme and advantages of the implementation of this application clearer, the technical scheme in the implementation of this application will be described in more detail in combination with the drawings in the implementation of this application. In the drawings, the same or similar reference numerals throughout represent the same or similar elements or elements with the same or similar functions. The described implementation is a part of the implementation of this application, not all of the implementations. The implementation described below with reference to the drawings is exemplary and is intended to be used to explain this application, and cannot be understood as a limitation on this application. Based on the implementation in this application, all other implementations obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application. The implementation of this application is described in detail below in combination with the drawings.

[0034] The first aspect of the present application provides a data access method based on a cross-unit unified identity authentication system, such as Figure 1 As shown, it mainly includes:

[0035] Step S1: The application client of the unit where the user works authenticates the user;

[0036] Step S2: The unified authentication server issues a unified authentication identity;

[0037] Step S3: The user sends the unified authentication identity to the server of the unit to be accessed;

[0038] Step S4: The application server of the unit to be visited verifies the unified authentication identity, and after the verification is passed, determines the user's account number in the unit to be visited;

[0039] Step S5: Based on the access rights of the user's account of the unit to be accessed, a communication link between the database matching the access rights and the application client is constructed.

[0040] This application mainly builds a unified authentication server to solve the problem of collaborative development of equipment across units. Users from each unit can log in with a single click on the application entrance within the unit. After logging in, the unified authentication server is used to verify the user's access rights to other units' servers, allowing smooth access to the other party's application system, improving user experience, and effectively ensuring collaborative efficiency.

[0041] According to the above description, it can be seen that the unified authentication server of this application is the upper-level user management platform of multiple units. In actual operation, each unit can build its own unified authentication server, and then the unified authentication servers of multiple units are interconnected. Units need to rely on the identity center module in their own unified identity authentication system to manage the organization, user information, and equipment information within the unit. If necessary, data can be synchronized with the unit's internal human resources management system and asset management system. At the same time, in order to ensure the synchronization and mutual trust of user information across units, both parties should try to constrain the standardization of field design. The definitions of the organization information field, user identity information field, and equipment field are shown in Table 1, Table 2, and Table 3:

[0042] Table 1 Organization information field definition

[0043] Field Tags Field Description Type Length Is this field required? ORG_ID Organization ID VARCHAR(64) yes ORG_NAME Organization Name VARCHAR(100) yes ORG_NO Organization Code VARCHAR(64) yes ORG_TYPE Organization Type VARCHAR(64) yes PARENT_ID Parent organization ID VARCHAR(64) yes SHOW_ORDER Display Order VARCHAR(64) yes ORG_STATUS Organization Status INT yes ORG_ADDRESS Organization Address VARCHAR(128) no ORG_PHONE Organization Contact Information VARCHAR(128) no REMARK Remark VARCHAR(500) no UPDATE_TIME Update time DATETIME yes

[0044] Table 2 User identity information field definition

[0045]

[0046]

[0047] Table 3 Device information field definition

[0048] Field Tags Field Description Type Length Is this field required? DEVICE_ID Device ID VARCHAR(64) yes DEVICE_NO Equipment No. VARCHAR(128) yes DEVICE_NAME Device Name VARCHAR(256) yes ORG_ID Responsible Department VARCHAR(64) yes USER_ID Person in charge ID VARCHAR(64) yes DEVICE_IP IP VARCHAR(128) no DEVICE_MAC MAC VARCHAR(128) no DEVICE_TYPE Device Type INT yes DEVICE_STATUS Device Status INT yes REMARK Remark VARCAHR(2048) no UPDATE_TIME Update time DATETIME yes

[0049] In addition to the user's unified authentication identity, the unified authentication server also has the user account of the unified authentication identity in each unit. Based on the user account, the user's permissions are set through the permission management module. The competent department of each unit shall first sort out and establish the correspondence between user attributes and business systems and roles in the system according to business rules or management requirements, clearly define the characteristic groups allowed to access users, form a user permission model, and maintain and manage it in the policy center. Then, it is registered and integrated in the application center of the unified authentication server. When a user accesses a cross-unit business system, the cross-unit business system calls the interface of the policy center to obtain the user's permission list, and sends the permission list to the unified authentication server, which displays it to the user.

[0050] When user information is added or changed, the policy center can also use database synchronization, interface access, etc. to automatically verify the compliance of the permission model, and synchronize the user identity information and role permission information to the business system. The system completes identity reception and permission granting.

[0051] In addition to cross-unit management of users, the business systems of each unit can also be connected to the unified authentication server. Each unit will register the tasks that need to be completed collaboratively on the unified authentication server and specify access roles, so that personnel with corresponding roles in each unit can access them.

[0052] In some optional implementations, in step S1, the identity verification includes dual authentication of a digital certificate and a password, or dual authentication of a digital certificate and a scan.

[0053] In some optional embodiments, such as Figure 1 As shown, step S2 further includes:

[0054] Step S21: For a user who has passed identity authentication, the unified authentication server receives a server access request to the access unit initiated by the user;

[0055] Step S22: The unified authentication server retrieves the unified authentication identity of the user and feeds it back to the application client.

[0056] In some optional implementations, step S4 further includes:

[0057] Step S41, the application server of the unit to be accessed sends the unified authentication identity to the unified authentication server;

[0058] Step S42: The unified authentication server verifies whether the user exists. If the user exists, the account number registered by the user in the unit to be visited is retrieved and sent to the application server of the unit to be visited.

[0059] Under the premise of unified authentication and single sign-on within the unit, after mutual trust integration of the unified identity authentication system of both parties is realized through mutual trust docking of trusted gateways, users of unit A can access the business system of unit B. The user access steps are as follows:

[0060] 1) The business system of unit B applies to access the unified authentication server of unit B, and provides the application domain name, service IP address and port number information, and points the domain name resolution to the trusted gateway of unit B;

[0061] 2) The unified authentication system of units A and B is mutually trusted through the trusted gateway communication protocol of both parties, and the business system of unit B is processed and configured after the gateway is integrated;

[0062] 3) User A of unit A accesses the application through the processed and configured domain name. The trusted gateway automatically determines that if the user is not logged in, it will automatically jump to the unified authentication login interface.

[0063] 4) User A of unit A uses digital certificate + password or digital certificate + scanning to authenticate the identity of the unit;

[0064] 5) When the authentication is passed, unit A completes the login operation on the unified authentication login interface and performs mutual trust access to the unified authentication center of unit B;

[0065] 6) After the mutual trust access login is passed, it will automatically jump back to the application service of the unit B business system, and the application system will obtain the access ticket from the URL with the access ticket.

[0066] 7) The business system of unit B calls the unified authentication interface, verifies the access ticket, obtains the user identity information of the visitor from unit A, and allows login after determining that the ticket exists in the business system.

[0067] Compared with the existing technology, this application designs a method for building and connecting a unified identity authentication system across enterprises, providing a universal, efficient and economical technical method for cross-unit business system sharing and integration, forming a trust system of unified identity, unified authentication and unified authorization, and realizing cross-unit information resource integration and business collaboration. The beneficial effects are as follows:

[0068] 1) From the user level, it solves the problem of cross-unit collaborative development of weapons and equipment. Users can click on the application entrance within their own unit to log in with a single point of view, smoothly access the other party's application system, improve user experience, and effectively ensure collaborative efficiency;

[0069] 2) From the perspective of security protection, joint application authentication is achieved, which avoids the security and confidentiality risks brought by the traditional cross-unit application docking mode and improves security and confidentiality control capabilities;

[0070] 3) From an economic perspective, a unified standard integrated authentication platform is established for remote collaborative systems, avoiding the problems of traditional point-to-point system integration and significantly saving project costs;

[0071] 4) From the perspective of cross-domain collaboration, the integration of the unified identity authentication system has made the information integration among the various units of the group closer, and a unified application authentication management and control system has been established, providing a secure foundation for the future sharing of application resources across the entire group and the entire industrial chain.

[0072] The second aspect of the present application provides a data access device based on a cross-unit unified identity authentication system corresponding to the above method, mainly comprising:

[0073] The identity authentication module is used for the application client of the user's unit to authenticate the user;

[0074] Access credential acquisition module, used for unified authentication identity issued by unified authentication server;

[0075] An access credential sending module is used for the user to send the unified authentication identity to the server of the unit to be accessed;

[0076] An access credential verification module is used to verify the unified authentication identity by the application server of the unit to be visited, and after the verification is passed, determine the user's account number in the unit to be visited;

[0077] The data communication building module is used to build a communication link between the database matching the access rights and the application client based on the access rights of the account of the unit to be visited by the user.

[0078] In some optional implementations, in the identity authentication module, the identity authentication includes dual authentication of a digital certificate and a password, or dual authentication of a digital certificate and a scan.

[0079] In some optional implementations, the access credential acquisition module includes:

[0080] A server access request acquisition unit is used for receiving, by a unified authentication server, a server access request initiated by a user who has passed identity authentication to a server access unit to be accessed;

[0081] The unified authentication identity determination unit is used to retrieve the unified authentication identity of the user from the unified authentication server and feed it back to the application client.

[0082] In some optional implementations, the access credential verification module includes:

[0083] A unified authentication identity sending unit, configured to send the unified authentication identity to a unified authentication server from the application server of the unit to be accessed;

[0084] The user account acquisition unit is used to verify whether the user exists through the unified authentication server. If the user exists, the account registered by the user in the unit to be visited is retrieved and sent to the application server of the unit to be visited.

[0085] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A data access method based on a cross-unit unified identity authentication system, characterized in that: include: Step S1: The application client of the unit where the user works authenticates the user; Step S2: The unified authentication server issues a unified authentication identity; Step S3: The user sends the unified authentication identity to the server of the unit to be accessed; Step S4: The application server of the unit to be visited verifies the unified authentication identity, and after the verification is passed, determines the user's account number in the unit to be visited; Step S5: Based on the access rights of the user's account of the unit to be accessed, a communication link between the database matching the access rights and the application client is constructed.

2. The data access method based on the cross-unit unified identity authentication system according to claim 1, characterized in that: In step S1, the identity authentication includes dual authentication of a digital certificate and a password, or dual authentication of a digital certificate and a scan.

3. The data access method based on the cross-unit unified identity authentication system according to claim 1, characterized in that: Step S2 further comprises: Step S21: For a user who has passed identity authentication, the unified authentication server receives a server access request to the access unit initiated by the user; Step S22: The unified authentication server retrieves the unified authentication identity of the user and feeds it back to the application client.

4. The data access method based on the cross-unit unified identity authentication system according to claim 1, characterized in that: Step S4 further comprises: Step S41, the application server of the unit to be accessed sends the unified authentication identity to the unified authentication server; Step S42: The unified authentication server verifies whether the user exists. If the user exists, the account number registered by the user in the unit to be visited is retrieved and sent to the application server of the unit to be visited.

5. A data access device based on a cross-unit unified identity authentication system, characterized in that: include: The identity authentication module is used for the application client of the user's unit to authenticate the user; Access credential acquisition module, used for unified authentication identity issued by unified authentication server; An access credential sending module is used for the user to send the unified authentication identity to the server of the unit to be accessed; An access credential verification module is used to verify the unified authentication identity by the application server of the unit to be visited, and after the verification is passed, determine the user's account number in the unit to be visited; The data communication building module is used to build a communication link between the database matching the access rights and the application client based on the access rights of the account of the unit to be visited by the user.

6. The data access device based on the cross-unit unified identity authentication system as claimed in claim 5, characterized in that: In the identity authentication module, the identity authentication includes dual authentication of a digital certificate and a password, or dual authentication of a digital certificate and a scan.

7. The data access device based on the cross-unit unified identity authentication system as claimed in claim 5, characterized in that: The access credential acquisition module includes: A server access request acquisition unit is used for receiving, by a unified authentication server, a server access request initiated by a user who has passed identity authentication to a server access unit to be accessed; The unified authentication identity determination unit is used to retrieve the unified authentication identity of the user from the unified authentication server and feed it back to the application client.

8. The data access device based on the cross-unit unified identity authentication system as claimed in claim 5, characterized in that: The access credential verification module includes: A unified authentication identity sending unit, configured to send the unified authentication identity to a unified authentication server from the application server of the unit to be accessed; The user account acquisition unit is used to verify whether the user exists through the unified authentication server. If the user exists, the account registered by the user in the unit to be visited is retrieved and sent to the application server of the unit to be visited.

Images