Decentralized adaptive authentication PaaS (Application Attachment as Service) method

Abstract

The invention relates to a decentralized self-adaptive authentication application attachment PaaS service method, which adopts a file access authorization mechanism based on an attachment security token, takes form attachment PaaS service as a core component, and is responsible for managing operations related to a form and an attachment; the method comprises a unified identity adapter and application registration management, wherein a file service interface, a token manager and a token replacement interface are used for realizing conversion between an attachment ID and an access token, attachment storage and attachment metadata. According to the method provided by the invention, the PaaS service only generates and issues the temporary token, the authentication function is dispersed into numerous business applications, the authentication performance pressure of the PaaS service is reduced, the security risk is dispersed, the authentication function is not provided by depending on the accessory PaaS service any more, and the application realizes file access authentication, so that the security risk is reduced. The application has higher flexibility to realize diversified authentication schemes, and meanwhile, the application attachment authentication scheme is convenient to upgrade and maintain.

Description

Technical Field

[0001] The present invention relates to an application attachment PaaS service method, in particular to an application attachment PaaS service method with decentralized adaptive authentication. Background Art

[0002] The Application Attachment PaaS service is a cloud service that provides a form-related attachment management solution for business applications, allowing developers to integrate form attachment query, upload, storage, download and management functions through standardized APIs. This service provides infrastructure support for application attachment management, and users do not need to worry about complex issues such as underlying storage and data security.

[0003] At present, the common PaaS services for file storage are common both at home and abroad. There are very few PaaS services that provide form-related attachment management solutions for business applications. The access control strategies they adopt are mostly based on role and authority management (RBAC), but the details are slightly different. The following are common access control strategies:

[0004] 1. Authentication and API access control

[0005] Foreign services (such as AWS S3, Google Cloud Storage): Use standard authentication mechanisms such as OAuth 2.0 and IAM (Identity and Access Management), combined with API keys and access tokens to ensure that only legitimate users can perform operations.

[0006] Domestic services (such as Alibaba Cloud OSS and Tencent Cloud COS): usually adopt similar API access strategies, using RAM (Resource Access Management) to assign user roles and permissions. API calls are also protected by access keys and signature mechanisms.

[0007] 2. Role-Based Access Control (RBAC)

[0008] Abroad: AWS IAM and Google Cloud IAM grant different permissions through roles, controlling what operations users can perform on storage resources (upload, download, delete, etc.). Each user or service has a specific role definition.

[0009] Domestic: Alibaba Cloud OSS and Tencent Cloud COS also widely use RBAC, allowing users to assign permissions to different accounts through the console or API to finely control resource access.

[0010] 3. Policy-Based Access Control (PBAC)

[0011] Abroad: AWS S3 and Google Cloud Storage support policy-based access control, allowing administrators to define detailed access rules through policy syntax, such as limiting resource access by time, IP range, request type, and other conditions.

[0012] Domestic: Alibaba Cloud OSS supports similar policy access control (such as policy language), and can customize rules according to business needs, such as restricting access to certain IP segments or providing access rights within a specific time period.

[0013] The existing application attachment PaaS service generally acts as an authentication subject, and provides file access permission management services for applications by implementing RBAC (role-based access control) or file ACL (access control list) authentication functions. The current application attachment PaaS service solution adopts a file access authentication mechanism based on RBAC and ACL, which usually has the following problems:

[0014] 1. Performance bottleneck: The Attachment PaaS service needs to centrally process file authentication requests from a large number of users, which may lead to performance bottlenecks in high concurrency situations and affect user experience.

[0015] 2. Lack of flexibility: A unified authentication mechanism may not meet the needs of specific applications, limiting the flexibility of developers to customize authentication strategies based on business logic.

[0016] 3. Concentration of security risks: All authentication functions are concentrated in one service. If the service is attacked or has security vulnerabilities, a large amount of user data may be leaked or tampered with.

[0017] 4. High cost of use: additional authorization operations are required for files during use, which increases the workload of users;

[0018] 5. High migration cost: If the authentication service needs to be replaced or upgraded in the future, all applications that rely on the service will need to be modified accordingly, which may result in high migration costs and development workload. Summary of the invention

[0019] The technical problem to be solved by the present invention is to provide an application attachment PaaS service method with decentralized adaptive authentication in view of the deficiencies in the prior art. The method is based on the file access authorization mechanism of the attachment security token, transforms the authentication subject from the attachment PaaS service to the business application, and decentralized authentication, thereby solving the problems of performance bottlenecks, concentrated security risks, high usage and migration costs, etc. brought about by the original authentication scheme. At the same time, the application itself can customize the authentication scheme according to business needs, thereby enhancing flexibility.

[0020] The technical problem to be solved by the present invention is achieved through the following technical solutions. The present invention is a decentralized adaptive authentication application attachment PaaS service method, which is characterized by: the method adopts a file access authorization mechanism based on attachment security tokens; the method uses the form attachment PaaS service as the core component, which is responsible for managing operations related to forms and attachments; and contains the following key components:

[0021] Unified identity adapter: The adapter connects business application services with the unified identity authentication system to ensure that user identity information can flow securely between different services; the unified identity adapter needs to access different clouds based on the application registration configuration information;

[0022] Application registration management: This component is responsible for managing all connected business application services. Through application registration management, the system can record and track the status and permissions of each application, ensuring that only reviewed and approved application services can access the system.

[0023] File service interface: This interface is responsible for processing file information query, upload, download, storage and management operations; files are accessed through the file service interface without directly interacting with the underlying storage system;

[0024] Token Manager: This component is responsible for generating, managing, and verifying attachment access tokens. Attachment access tokens are credentials used to access attachment resources. Through the token manager, the system can ensure that only authorized users can access specific file content or file metadata. The token generation process includes encryption and setting validity periods.

[0025] Token replacement interface: This interface realizes the conversion between attachment ID and access token. Business applications request the token of attachment ID through this interface. The token replacement interface verifies the request and returns the corresponding access token. It can access files securely without exposing the actual attachment ID.

[0026] Attachment storage: responsible for storing attachment files uploaded by users;

[0027] Attachment metadata: responsible for recording the metadata information of uploaded attachments.

[0028] The decentralized adaptive authentication application attachment PaaS service method described in the present invention has a further preferred technical solution: the metadata information includes the file name, file size, upload time and the attachment ID used to associate with the form.

[0029] The decentralized adaptive authentication application attachment PaaS service method described in the present invention has a further preferred technical solution: the file access authentication process based on the attachment security token is as follows:

[0030] (1) The user opens the browser, loads the business application front-end page, and then initiates a request to load form data. This request starts the entire attachment loading process. The user expects to obtain relevant form data from the business application back-end service for subsequent operations and viewing.

[0031] (2) After receiving the request, the business application backend service first authenticates the user to ensure that the user can access the form data and file information, and then loads the form data required by the request. The data should include the attachment ID used to associate the attachment information.

[0032] (3) The form data interface in the business application backend service uses its own application service account identity to initiate a request to the attachment PaaS service, hoping to replace the attachment ID in the form data with the attachment token;

[0033] (4) After receiving the request, the token replacement interface in the attachment PaaS service first verifies the request to confirm that the caller is the application service account identity. After the verification is passed, the requested attachment ID is sent to the token manager in the hope of obtaining an encrypted attachment access token;

[0034] (5) The token manager encrypts the attachment ID with a random key and writes it into the token, sets the validity period of the token, saves the random key into the key cache, writes the key ID into the token, and then returns the token to the token replacement interface;

[0035] (6) The token replacement interface returns the encrypted attachment token to the form data interface of the business application;

[0036] (7) The form data interface returns the encrypted attachment token and form data to the front-end page of the business application; after the front-end page receives the encrypted token, it can further perform file-related operations;

[0037] (8) The application front-end page uses the encrypted attachment token to initiate a request to the attachment PaaS service, expecting to load file information or file content;

[0038] (9) After receiving the request, the file service interface of the attachment PaaS service applies for a decryption token from the token manager;

[0039] (10) After receiving the application, the token manager uses the key ID taken from the token, obtains the key from the key cache according to the key ID, decrypts the encrypted token using the corresponding decryption algorithm, and extracts the returned attachment ID;

[0040] (11) Based on the extracted attachment ID, the attachment PaaS service is used to load the attachment information and content. The system searches for the corresponding attachment information and content in the storage based on the attachment ID to prepare for the final return. (12) The attachment PaaS service is used to return the file information and file content to the front-end page of the business application or the relevant requesting party. After the entire process is completed, the user finally obtains the required file information and content and can view, process or perform other related operations.

[0041] Compared with the prior art, the present invention has the following beneficial effects:

[0042] In the method of the present invention, the implementation subject of the file access authentication action is changed from PaaS service to business application. PaaS service only generates and issues temporary tokens, distributing the authentication function to many business applications, reducing the authentication performance pressure of PaaS service, dispersing security risks, and no longer relying on the attachment PaaS service to provide authentication functions. Instead, the application itself implements file access authentication, giving the application greater flexibility to implement a variety of authentication schemes, and also facilitating the upgrade and maintenance of the application attachment authentication scheme. The method solves the problems of performance bottleneck, lack of flexibility, concentrated security risks, high use and migration costs, etc. brought about by the current centralized authentication implementation scheme of the attachment PaaS service. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 This is the overall architecture diagram of the application attachment PaaS service method of the decentralized adaptive authentication of the present invention;

[0044] Figure 2 Diagram of the file access authentication process based on attachment security tokens. DETAILED DESCRIPTION

[0045] The specific technical solutions of the present invention are further described below to help those skilled in the art further understand the present invention without limiting the rights thereof.

[0046] Example 1, reference Figure 1 , decentralized adaptive authentication application attachment PaaS service method:

[0047] This method adopts a file access authorization mechanism based on attachment security tokens. This method uses the form attachment PaaS service as the core component, which is responsible for managing operations related to forms and attachments. It includes the following key components:

[0048] Unified identity adapter: The adapter connects business application services with the unified identity authentication system to ensure that user identity information can flow securely between different services; the unified identity adapter needs to access different clouds based on the application registration configuration information;

[0049] Application registration management: This component is responsible for managing all connected business application services. Through application registration management, the system can record and track the status and permissions of each application, ensuring that only reviewed and approved application services can access the system.

[0050] File service interface: This interface is responsible for processing file information query, upload, download, storage and management operations; files are accessed through the file service interface without directly interacting with the underlying storage system;

[0051] Token Manager: This component is responsible for generating, managing, and verifying attachment access tokens. Attachment access tokens are credentials used to access attachment resources. Through the token manager, the system can ensure that only authorized users can access specific file content or file metadata. The token generation process includes encryption and setting validity periods.

[0052] Token replacement interface: This interface realizes the conversion between attachment ID and access token. Business applications request the token of attachment ID through this interface. The token replacement interface verifies the request and returns the corresponding access token. It can access files securely without exposing the actual attachment ID.

[0053] Attachment storage: responsible for storing attachment files uploaded by users;

[0054] Attachment metadata: responsible for recording the metadata information of the uploaded attachment, including the file name, file size, upload time, and attachment ID used to associate with the form.

[0055] Reference Figure 2 , the file access authentication process based on the attachment security token is as follows:

[0056] (1) The user opens the browser, loads the business application front-end page, and then initiates a request to load form data. This request starts the entire attachment loading process. The user expects to obtain relevant form data from the business application back-end service for subsequent operations and viewing.

[0057] (2) After receiving the request, the business application backend service first authenticates the user to ensure that the user can access the form data and file information, and then loads the form data required by the request. The data should include the attachment ID used to associate the attachment information.

[0058] (3) The form data interface in the business application backend service uses its own application service account identity to initiate a request to the attachment PaaS service, hoping to replace the attachment ID in the form data with the attachment token;

[0059] (4) After receiving the request, the token replacement interface in the attachment PaaS service first verifies the request to confirm that the caller is the application service account identity. After the verification is passed, the requested attachment ID is sent to the token manager in the hope of obtaining an encrypted attachment access token;

[0060] (5) The token manager encrypts the attachment ID with a random key and writes it into the token, sets the validity period of the token, saves the random key into the key cache, writes the key ID into the token, and then returns the token to the token replacement interface;

[0061] (6) The token replacement interface returns the encrypted attachment token to the form data interface of the business application;

[0062] (7) The form data interface returns the encrypted attachment token and form data to the front-end page of the business application; after the front-end page receives the encrypted token, it can further perform file-related operations;

[0063] (8) The application front-end page uses the encrypted attachment token to initiate a request to the attachment PaaS service, expecting to load file information or file content;

[0064] (9) After receiving the request, the file service interface of the attachment PaaS service applies for a decryption token from the token manager;

[0065] (10) After receiving the application, the token manager uses the key ID taken from the token, obtains the key from the key cache according to the key ID, decrypts the encrypted token using the corresponding decryption algorithm, and extracts the returned attachment ID;

[0066] (11) Based on the extracted attachment ID, the attachment PaaS service is used to load the attachment information and content. The system searches for the corresponding attachment information and content in the storage based on the attachment ID to prepare for the final return. (12) The attachment PaaS service is used to return the file information and file content to the front-end page of the business application or the relevant requesting party. After the entire process is completed, the user finally obtains the required file information and content and can view, process or perform other related operations.

[0067] The key points of this process to ensure file access security are:

[0068] File information and content can only be obtained through temporary encrypted attachment tokens, avoiding direct exposure of attachment IDs, which can effectively prevent direct access and guessing attacks;

[0069] The encrypted attachment token of the PaaS service can only be obtained using the application's own service account. Users cannot directly obtain the attachment token;

[0070] The encrypted attachment token is obtained after the business application authenticates the user, ensuring that the user has the corresponding business authorization to obtain the file information;

[0071] The credentials of the application service account are only stored in the server environment, which is more secure than the user device environment and is more conducive to the security of the attachment token.

[0072] The token manager uses a random key to encrypt when generating an access token, and the random key is stored in a secure key cache to ensure the confidentiality and tamper-proof nature of the token.

[0073] The generated attachment access token has a validity period set, and becomes invalid after the expiration date, to prevent unauthorized long-term access and enhance the security of the system.

[0074] Example 2: Application example of decentralized adaptive authentication application attachment PaaS service method

[0075] A shipbuilding company under CSSC originally built a large number of information application systems based on unified file services, using traditional RBAC and ACL authentication methods, which led to heavy request pressure on the file authentication center, difficulty in improving performance, and difficulty in achieving personalized authentication needs. After migrating a large number of information application systems to the PaaS service attached to the decentralized authentication mechanism, the entire information system has been improved:

[0076] Performance improvements:

[0077] File authentication response time: The average response time of traditional centralized authentication is reduced from 500ms to 120ms after decentralized authentication, an increase of about 75%.

[0078] High concurrent processing capability: In high-concurrency scenarios, the traditional centralized file authentication system processes 3,000 requests per second, while after decentralization, the number of requests that can be processed per second is increased to 8,000, an increase of about 167%.

[0079] Flexibility improvements:

[0080] Coverage of customized authentication solutions: The new technology improves the ability of applications to customize authentication strategies according to different business scenarios and user needs, and the satisfaction rate of customized needs has increased from the original 10% to 90%.

[0081] Shortened development cycle: When developers write authentication rules for specific business scenarios, they only need to consider the authentication implementation of the current business scenario, which reduces the development difficulty and reduces the time required from the original average of 3 weeks to 1 week, reducing the development time by about 67%.

[0082] Security Enhancements:

[0083] Data leakage risk: After decentralization, single points of failure and centralized attack surfaces are effectively reduced, and the risk of data leakage is reduced by about 80%.

[0084] System vulnerability exposure time: The decentralized architecture distributes the authentication logic among different services, shortening the vulnerability exposure time from the original average of 48 hours to 12 hours, a reduction of about 75%.

[0085] Reduced cost of use:

[0086] File authorization operation frequency: Since the authentication operation is handled by the application itself, the dependence on central services is reduced. The frequency of file authorization operations has been reduced by about 80%, making user operations smoother.

[0087] User workload: Users no longer need to frequently interact with centralized authentication services when accessing files, and the number of user operation steps is reduced by about 50%, thereby significantly reducing user operating costs.

[0088] Reduced migration costs:

[0089] Authentication service replacement cost: If the authentication service needs to be replaced in the future, the new decentralized architecture only requires partial adjustments to the application, and the migration cost is reduced from the original 100 people / day to 30 people / day, saving about 70% of the migration development time and cost.

[0090] System update cycle: After decentralization, the update and maintenance cycle of the authentication system was reduced from 6 months to 2 months, improving the system iteration efficiency by about 67%.

Claims

1. A decentralized adaptive authentication application attachment PaaS service method, characterized by: The method adopts a file access authorization mechanism based on attachment security tokens; the method uses the form attachment PaaS service as the core component, which is responsible for managing operations related to forms and attachments; It contains the following key components: Unified identity adapter: The adapter connects business application services with the unified identity authentication system to ensure that user identity information can flow securely between different services; The unified identity adapter needs to access different clouds based on the application registration configuration information; Application registration management: This component is responsible for managing all connected business application services; Through application registration management, the system can record and track the status of each application and its permissions; Ensure that only reviewed and approved application services can access the system; File service interface: This interface is responsible for processing file information query, upload, download, storage and management operations; files are accessed through the file service interface without directly interacting with the underlying storage system; Token Manager: This component is responsible for generating, managing, and validating attachment access tokens; The attachment access token is a credential used to access attachment resources. Through the token manager, the system can ensure that only authorized users can access specific file content or file metadata. The token generation process includes encryption and setting the validity period. Token replacement interface: This interface implements the conversion between attachment ID and access token; The business application requests the token of the attachment ID through this interface, and the token replacement interface verifies the request and returns the corresponding access token; Securely access files without exposing the actual attachment ID; Attachment storage: responsible for storing attachment files uploaded by users; Attachment metadata: responsible for recording the metadata information of uploaded attachments.

2. The decentralized adaptive authentication application attachment PaaS service method according to claim 1, characterized in that: The metadata information includes the file name, file size, upload time, and the attachment ID used to associate with the form.

3. The decentralized adaptive authentication application attachment PaaS service method according to claim 1, characterized in that: The file access authentication process based on the attachment security token is as follows: (1) The user opens the browser, loads the business application front-end page, and then initiates a request to load form data. This request starts the entire attachment loading process. The user expects to obtain relevant form data from the business application back-end service for subsequent operations and viewing. (2) After receiving the request, the business application backend service first authenticates the user to ensure that the user can access the form data and file information, and then loads the form data required by the request. The data should include the attachment ID used to associate the attachment information. (3) The form data interface in the business application backend service uses its own application service account identity to initiate a request to the attachment PaaS service, hoping to replace the attachment ID in the form data with the attachment token; (4) After receiving the request, the token replacement interface in the attachment PaaS service first verifies the request to confirm that the caller is the application service account identity. After the verification is passed, the requested attachment ID is sent to the token manager in the hope of obtaining an encrypted attachment access token; (5) The token manager encrypts the attachment ID with a random key and writes it into the token, sets the validity period of the token, saves the random key into the key cache, writes the key ID into the token, and then returns the token to the token replacement interface; (6) The token replacement interface returns the encrypted attachment token to the form data interface of the business application; (7) The form data interface returns the encrypted attachment token and form data to the front-end page of the business application; after the front-end page receives the encrypted token, it can further perform file-related operations; (8) The application front-end page uses the encrypted attachment token to initiate a request to the attachment PaaS service, expecting to load file information or file content; (9) After receiving the request, the file service interface of the attachment PaaS service applies for a decryption token from the token manager; (10) After receiving the application, the token manager uses the key ID taken from the token, obtains the key from the key cache according to the key ID, decrypts the encrypted token using the corresponding decryption algorithm, and extracts the returned attachment ID; (11) Based on the extracted attachment ID, the attachment information and content are loaded using the attachment PaaS service; The system searches for the corresponding attachment information and content in the storage according to the attachment ID, preparing for the final return; (12) The application attachment PaaS service returns the file information and file content to the front-end page of the business application or the relevant requester; After completing the entire process, users finally obtain the required file information and content and can view, process or perform other related operations.

Images