Unified authentication and authentication method

Abstract

The invention relates to the technical field of network security, in particular to a unified authentication method based on an application gateway, which comprises the following steps of: S1, deploying the application gateway on an application, sending an access application request to the application gateway when a front end receives the access application request, intercepting the access application request by the application gateway, and identifying an interface type of the access application request; s2, according to the interface type, the application gateway calls a central controller to carry out processing operations including configuring user permission and providing a user unified login page; and S3, the application gateway performs permission authentication according to the processing result, if the permission authentication is successful, the application access request is agented to the application to realize access, and if the permission authentication is failed, the front end returns that the user has no permission to access. According to the method, one application gateway is deployed on each application, each application gateway authenticates and authenticates the respective application, the bottleneck problem of single-point performance is reduced, and due to the fact that the application gateway is deployed on each application, communication between the applications cannot bypass authentication and authentication.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method, device and storage medium for unified authentication based on an application gateway. Background Art

[0002] With the rapid development of the Internet, a company often has multiple different applications (including websites and services). These applications usually require users to provide some personal information or account passwords to log in and use. In the past, each application maintained its own account and permissions, which resulted in users having to log in multiple times when accessing different applications, and managers had to manage permissions for each application separately. In order to ensure user security and convenience, unified authentication and authorization technology came into being. With unified authentication, users only need to log in once to access multiple different applications. Managers also only need to manage permissions on a unified platform.

[0003] Existing unified authentication and authorization technologies often need to be centralized on a unified executor (generally a gateway) for authentication and authorization, which results in performance bottlenecks when the number of users and access volume is large, and communication between applications can bypass the unified executor. Summary of the invention

[0004] The purpose of the present invention is to solve the shortcomings of the prior art and provide a method for unified authentication based on an application gateway, comprising the following steps: S1: deploy an application gateway on the application, and when the front end receives an application access request, it sends it to the application gateway, and the application gateway intercepts the application access request and identifies the interface type of the application access request; S2: The application gateway performs processing operations including configuring user permissions and providing a unified user login page by calling the central controller according to the interface type; S3: The application gateway performs permission identification according to the processing result. If the permission identification is successful, the application access request is proxied to the application to implement access. If the permission identification fails, the front end returns that the user has no right to access.

[0005] Preferably, the application gateway intercepts the application access request and identifies the interface type of the application access request, further comprising: S11: The application gateway receives the access application request including the URL path, request method, request header and request body; S12: The application gateway identifies whether the interface is a login interface, a token interface or other interface by checking the information including the URL path, the request method and the request body parameters.

[0006] Preferably, in step S2, the application gateway performs processing operations including configuring user permissions and providing a unified user login page by calling a central controller according to the interface type, further comprising: If the access application request is identified as the login interface, the login status is determined, and the application gateway performs processing operations by calling the central controller according to the login status; If the access application request is identified as a token interface, the application gateway extracts the random code in the request body parameter, and calls the interface of the central controller to obtain the token according to the access application unique ID, password and random code, and returns the token to the front end; If it is identified that the application access request is another interface, the application gateway extracts the token from the application access request and processes it according to the extraction result.

[0007] Preferably, the application gateway performs processing operations by calling the central controller according to the login status, further comprising: If the user is not logged in, the system returns to the front end and redirects the user to the login page of the central controller. The user logs in through the login page through methods including account and password authentication, fingerprint authentication, SMS authentication, and ukey authentication. If the user is already logged in, there is no need to log in again. The central controller generates the access application request in the form of parameters with a random code and the unique ID of the access application, returns to the front-end page, and redirects to the application token application interface address.

[0008] Preferably, the application gateway extracts the token from the application access request and processes according to the extraction result, further comprising: If the token extraction fails, the application gateway returns a failure message and returns to the front-end page to require the user to log in and operate; If the token is extracted successfully, the application gateway verifies the validity of the token.

[0009] Preferably, the application gateway verifies the validity of the token, further comprising: The application gateway decodes the header of the JWT token and obtains the encryption algorithm and key ID; Decode the payload of the JWT token to obtain information including the user name, the issuance time of the random code, and the validity period; Verify whether the current time is within the validity period. If not, the verification fails. Query whether there is a corresponding public key locally according to the key ID. If not, call the central controller interface to obtain the corresponding public key; The signature part is verified by the public key and encryption algorithm. If the verification is successful, it is a success, otherwise it is a failure.

[0010] Preferably, in step S3, the application gateway performs authority identification according to the processing result, further comprising: The application gateway performs permission authentication according to the application permissions configured by the administrator in the central controller; The administrator configures application permissions in the central controller, including: The central controller configures the application interface and limits access users and / or access applications; Optimize through interface groups, user groups, and application groups to reduce administrator configuration time; The central controller sends the application permissions to the application gateway.

[0011] Preferably, the central controller sends the application permission to the application gateway, further comprising: The application gateway extracts the user name and the access application unique ID from the token; Determine whether the user has permission to access the interface based on the user name, the access application unique ID, the user permission, and the application unique ID; Wherein, determining whether the user has the authority to access the interface according to the user name, the access application unique ID, the user authority, and the application unique ID includes: Determine whether the user has permission to access the interface according to the user name and the user authority; Determine whether there is permission to access the interface according to the access application unique ID and the application unique ID, wherein if the access application unique ID is not the application unique ID, the determination fails; If the access application unique ID is consistent with the application unique ID, whether the application corresponding to the access application unique ID has the permission to access the interface is determined based on whether the application has the permission to access the interface.

[0012] Based on the same concept, the present invention also provides a computer device, including a memory and a processor, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the processor executes the steps of the method for unified authentication and authorization based on the application gateway as described in the embodiment.

[0013] Based on the same concept, the present invention also provides a storage medium storing computer-readable instructions. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the method for unified authentication and authorization based on application gateway as described in the embodiment.

[0014] Compared with the prior art, the present invention has the following beneficial effects: The present invention deploys an application gateway on the application, and when the front end receives an application access request, it sends it to the application gateway. The application gateway intercepts the application access request and identifies the interface type of the application access request, thereby realizing not only controlling the user's access rights, but also controlling the access rights between different applications. The application gateway of the present invention performs processing operations including configuring user permissions and providing a unified user login page by calling a central controller according to the interface type, thereby realizing that multiple applications use one account system, and users only need to log in once to access multiple applications, and administrators can perform unified permission configuration on one platform; The application gateway of the present invention performs permission identification based on the processing results. If the permission identification is successful, the access application request is proxied to the application to achieve access. If the permission identification fails, the front end returns that the user has no right to access, thereby placing the authentication and authorization work on each application gateway and reducing the authentication and authorization pressure. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the following detailed description of the preferred embodiment.The drawings are only for the purpose of illustrating the preferred embodiments and are not to be construed as limiting the invention.

[0016] Figure 1 It is a deployment diagram of the unified authentication method based on the application gateway of the present invention; Figure 2 It is a flow chart of the unified authentication method based on application gateway of the present invention; Figure 3 The present invention is a cross-functional flow chart of the unified authentication and authorization method based on the application gateway. DETAILED DESCRIPTION

[0017] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. Obviously, the described embodiments are part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of this application.

[0018] Those skilled in the art will appreciate that, unless otherwise stated, the singular forms "a", "an", and "the" used herein may also include plural forms. It should be further understood that the term "comprising" used in the specification of the present invention refers to the presence of the features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof.

[0019] The technical terms involved in the embodiments of the present invention are defined as follows: Token: A mechanism used for authentication in a computer system. It usually consists of a string of characters and is used to verify the identity of the user. In the field of network security, tokens are often used to represent a user's identity information in order to interact with the system.

[0020] JWT: The full name is "JSON Web Token", which consists of three parts: header, payload and signature. The header is used to describe the metadata of JWT, such as encryption algorithm, etc. The payload stores the actual information to be transmitted, such as user name, issuance time, validity period, etc. The signature is to sign the information in the header and payload to ensure the integrity and accuracy of the transmitted information.

[0021] Example 1 See also Figure 1 As described, a central controller is deployed in the network, and an application gateway is deployed on each application. It supports deployment on the same machine as the application in software form, and also supports deployment in the form of independent hardware. The central controller is mainly used to provide administrators with user configuration, configuration permissions, and provide users with a unified login page. The application gateway is mainly used for user authentication and authorization.

[0022] See also Figure 2 and Figure 3 As shown, this embodiment provides a unified authentication method based on an application gateway, comprising the following steps: S1: Deploy an application gateway on the application. When the front-end receives an application access request, it sends it to the application gateway. The application gateway intercepts the application access request and identifies the interface type of the application access request.

[0023] Preferably, the application gateway intercepts the access application request and identifies the interface type of the access application request, further comprising: S11: The application gateway receives an access application request including a URL path, a request method, a request header, and a request body; S12: The application gateway identifies whether the interface is a login interface, a token interface or other interface by checking information including the URL path, request method and request body parameters. Specifically, in this embodiment, if the URL path is " / login" and the request method is "POST", and the request body contains login-related parameters such as user name and password, then the interface can be identified as a login interface. If the URL path points to a specific path for obtaining or verifying a token, and the request body contains relevant parameters for generating or verifying a token (such as a random code, etc.), it can be determined to be a token interface. For other requests that do not conform to the above-mentioned login interface or token interface, they are classified as other interface types.

[0024] S2: The application gateway performs processing operations including configuring user permissions and providing a unified login page for users by calling the central controller according to the interface type.

[0025] Preferably, in step S2, the application gateway performs processing operations including configuring user permissions and providing a unified user login page by calling the central controller according to the interface type, further comprising: If the access application request is identified as a login interface, the login status is determined, and the application gateway performs processing operations by calling the central controller according to the login status; If the access application request is identified as a token interface, the application gateway extracts the random code in the request body parameter, and calls the interface of the central controller to obtain the token according to the access application unique ID, password and random code, and returns the token to the front end. Specifically, in this embodiment, the token will be attached when the front end accesses the interface later; If it is identified that the access application request is from other interfaces, the application gateway extracts the token from the access application request and processes it according to the extraction result.

[0026] Preferably, the application gateway performs processing operations by calling the central controller according to the login status, further comprising: If the user is not logged in, the system returns to the front end and redirects the user to the login page of the central controller. The user logs in through the login page through methods including account and password authentication, fingerprint authentication, SMS authentication, and ukey authentication. Specifically, in this embodiment, in the case of the first visit, the user returns to the front end without a token and redirects the user to the login page of the central controller for login operation. If the user is already logged in, there is no need to log in again. The central controller generates the access application request in the form of parameters with a random code and a unique ID for the access application, returns it to the front-end page, and redirects it to the application token application interface address. Specifically, in this embodiment, the front-end page redirects to the application token application interface address, and re-determines the interface type.

[0027] Preferably, the application gateway extracts the token from the application access request and processes according to the extraction result, further comprising: If the token extraction fails, the application gateway returns a failure message and returns to the front-end page to require the user to log in and operate; If the token is extracted successfully, the application gateway verifies the validity of the token.

[0028] Preferably, the application gateway verifies the validity of the token, further comprising: The application gateway decodes the header of the JWT token and obtains the encryption algorithm and key ID; Decode the payload of the JWT token to obtain information including the user name, issuance time of the random code, and validity period; Verify whether the current time is within the validity period. If not, the verification fails. Check whether there is a corresponding public key locally based on the key ID. If not, call the central controller interface to obtain the corresponding public key. The signature part is verified by the public key and encryption algorithm. If the verification is successful, it is a success, otherwise it is a failure.

[0029] S3: The application gateway performs permission authentication based on the processing results. If the permission authentication is successful, the application access request will be proxied to the application to implement access. If the permission authentication fails, the front end will return that the user is not authorized to access.

[0030] Preferably, in step S3, the application gateway performs authority identification according to the processing result, further comprising: The application gateway performs permission authentication based on the application permissions configured by the administrator in the central controller; The administrator configures application permissions in the central controller, including: The central controller configures the application interface and limits the access users and / or access applications. Specifically, in this embodiment, the specific functions, input parameters, output results, and calling methods of each application interface are clarified. For the application interface, it specifies which users can access the interface and the access permission level; Optimize through interface groups, user groups, and application groups to reduce administrator configuration time; The central controller sends the application permission to the application gateway. Specifically, in this embodiment, the central controller collects application permission information and sends the application permission information to the application gateway according to the relevant protocol.

[0031] Preferably, the central controller sends the application permissions to the application gateway, further comprising: The application gateway extracts the user name and unique ID of the access application from the token; Determine whether the user has the authority to access the interface based on the user name, access application unique ID, user permissions, and application unique ID; Among them, judging whether the user has the authority to access the interface based on the user name, the unique ID of the access application, the user authority, and the unique ID of the application includes: Determine whether you have permission to access the interface based on the user name and user permissions; Determine whether there is permission to access the interface based on the access application unique ID and the application unique ID, wherein if the access application unique ID is not the application unique ID, the determination fails; If the access application unique ID is consistent with the application unique ID, whether the application corresponding to the access application unique ID has the permission to access the interface is determined based on whether the application has the permission to access the interface.

[0032] Preferably, the application unique ID is the ID that the application gateway applies for from the central controller when it is deployed. There is also a password corresponding to the application unique ID, and the application unique ID and the application unique ID password are stored in the application gateway. In addition, the application unique ID and the application unique ID password both use random numbers longer than 32 bits. Random numbers longer than 32 bits can be long and not easily cracked by brute force, and are not easily hit by database collisions or guessed.

[0033] Preferably, the central controller maintains the relationship between the random code and the application unique ID password. The central controller provides an interface to verify the random code, the application unique ID password and the application unique ID password. After successful verification, a token in JWT format is issued, wherein the header of the token in JWT format contains the encryption method and the ID of the encryption key, and the payload includes but is not limited to the application unique ID password, issuance time, validity period, and user. This random code becomes invalid after obtaining the token once and cannot be used any further.

[0034] Example 2 In some embodiments of the present application, a computer device is also provided, including a memory and a processor, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the processor executes the steps of the method for unified authentication and authorization based on an application gateway in an embodiment of the present invention.

[0035] The present invention also provides a storage medium storing computer-readable instructions. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the method for unified authentication and authorization based on application gateway in one embodiment of the present invention.

[0036] It is understandable that, for the aforementioned unified authentication and authorization method based on application gateway, if it is implemented in the form of software function modules and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer server, or a network device, etc.) to perform all or part of the steps of the methods of various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program codes.

[0037] Computer readable storage media may include data signals propagated in baseband or as part of a carrier wave, wherein readable program codes are carried. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The readable storage medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, device, or device. The program codes contained on the readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination thereof.

[0038] The above is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should also be regarded as the protection scope of the present invention.

Claims

1. A unified authentication method based on an application gateway, characterized in that: The following steps are involved: S1: deploy an application gateway on the application, and when the front end receives an application access request, it sends it to the application gateway, and the application gateway intercepts the application access request and identifies the interface type of the application access request; S2: The application gateway performs processing operations including configuring user permissions and providing a unified user login page by calling the central controller according to the interface type; S3: The application gateway performs permission identification according to the processing result. If the permission identification is successful, the application access request is proxied to the application to implement access. If the permission identification fails, the front end returns that the user has no right to access.

2. The method for unified authentication based on application gateway according to claim 1, characterized in that: The application gateway intercepts the application access request and identifies the interface type of the application access request, further comprising: S11: The application gateway receives the access application request including the URL path, request method, request header and request body; S12: The application gateway identifies whether the interface is a login interface, a token interface or other interface by checking the information including the URL path, the request method and the request body parameters.

3. The method for unified authentication based on application gateway according to claim 2, characterized in that: In step S2, the application gateway performs processing operations including configuring user permissions and providing a unified user login page by calling a central controller according to the interface type, further comprising: If the access application request is identified as the login interface, the login status is determined, and the application gateway performs processing operations by calling the central controller according to the login status; If the access application request is identified as a token interface, the application gateway extracts the random code in the request body parameter, and calls the interface of the central controller to obtain the token according to the access application unique ID, password and random code, and returns the token to the front end; If it is identified that the application access request is another interface, the application gateway extracts the token from the application access request and processes it according to the extraction result.

4. The method for unified authentication based on application gateway according to claim 3 is characterized in that: The application gateway performs processing operations by calling the central controller according to the login status, further comprising: If the user is not logged in, the system returns to the front end and redirects the user to the login page of the central controller. The user logs in through the login page through methods including account and password authentication, fingerprint authentication, SMS authentication, and ukey authentication. If the user is already logged in, there is no need to log in again. The central controller generates the access application request in the form of parameters with a random code and a unique ID for the access application, returns the request to the front-end page, and redirects the request to the application token interface address.

5. The method for unified authentication based on application gateway according to claim 4, characterized in that: The application gateway extracts the token from the application access request and processes according to the extraction result, and also includes: If the token extraction fails, the application gateway returns a failure message and returns to the front-end page to require the user to log in and operate; If the token is extracted successfully, the application gateway verifies the validity of the token.

6. The method for unified authentication based on application gateway according to claim 5, characterized in that: The application gateway verifies the validity of the token, further comprising: The application gateway decodes the header of the JWT token and obtains the encryption algorithm and key ID; Decode the payload of the JWT token to obtain information including the user name, the issuance time of the random code, and the validity period; Verify whether the current time is within the validity period. If not, the verification fails. Query whether there is a corresponding public key locally according to the key ID. If not, call the central controller interface to obtain the corresponding public key; The signature part is verified by the public key and encryption algorithm. If the verification is successful, it is a success, otherwise it is a failure.

7. The method for unified authentication based on application gateway according to claim 6, characterized in that: In step S3, the application gateway performs authority authentication according to the processing result, further comprising: The application gateway performs permission authentication according to the application permissions configured by the administrator in the central controller; The administrator configures application permissions in the central controller, including: The central controller configures the application interface and limits access users and / or access applications; Optimize through interface groups, user groups, and application groups to reduce administrator configuration time; The central controller sends the application permissions to the application gateway.

8. The method for unified authentication based on application gateway according to claim 7, characterized in that: The central controller sends the application permission to the application gateway, further comprising: The application gateway extracts the user name and the access application unique ID from the token; Determine whether the user has permission to access the interface based on the user name, the access application unique ID, the user permission, and the application unique ID; Wherein, determining whether the user has the authority to access the interface according to the user name, the access application unique ID, the user authority, and the application unique ID includes: Determine whether the user has permission to access the interface according to the user name and the user authority; Determine whether there is permission to access the interface according to the access application unique ID and the application unique ID, wherein if the access application unique ID is not the application unique ID, the determination fails; If the access application unique ID is consistent with the application unique ID, whether the application corresponding to the access application unique ID has the permission to access the interface is determined based on whether the application has the permission to access the interface.

9. A computer device, characterized in that: It comprises a memory and a processor, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the processor executes the steps of the method for unified authentication and authorization based on an application gateway as described in any one of claims 1 to 8.

10. A storage medium storing computer-readable instructions, characterized in that: When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the method for unified authentication and authorization based on an application gateway as described in any one of claims 1 to 8.

Images