An identity authentication method and device for a group enterprise system

Abstract

The application provides an identity authentication method and device for a group enterprise system, which comprises the following steps: a main enterprise system authenticates an identity authentication request initiated by a user, and returns an authentication result to the user; a one-time authorization code is sent to a sub-enterprise system according to an authorization code application request of the sub-enterprise system; a token is sent to the sub-system according to a token application request of the sub-enterprise system; login information of the user is returned to the sub-enterprise system according to the token sent by the sub-enterprise system, so as to complete the login of the user in the sub-enterprise system. In the method and device, the identity information of the user transmitted by the sub-enterprise system is transmitted from the main enterprise system to the sub-enterprise system, the whole process is fast and efficient, one-place login and multi-place mutual trust are realized, and the user cannot see the process, so that the user can realize the switching of business operations without multiple logins, and the user experience is improved.

Description

Technical Field

[0001] This invention relates to the field of identity authentication, and more specifically, to an identity authentication method and apparatus for a group enterprise system. Background Technology

[0002] In a group-type enterprise system, in addition to the main enterprise, there are several subsidiary enterprises. When users need to switch business between different enterprises, traditional technology requires users to log in before performing business operations in each enterprise. Only after successful login and identity authentication can users perform business operations in the system of that enterprise. This identity authentication not only involves many page redirects but also has a cumbersome authentication process, resulting in a poor user experience. Summary of the Invention

[0003] To address the technical problem in existing technologies where user authentication in a group enterprise system involves numerous page redirects and a cumbersome authentication process, resulting in a poor user experience, this invention provides an authentication method and apparatus for group enterprise systems.

[0004] According to one aspect of the present invention, an identity authentication method for a group enterprise system is provided, the group enterprise system comprising one main enterprise system and multiple subsidiary enterprise systems, the method comprising:

[0005] The main enterprise system authenticates the identity authentication request initiated by the user and returns the authentication result to the user. The identity authentication request includes the user's account name and account password, and the authentication result includes authentication success and authentication failure.

[0006] The main enterprise system sends a one-time authorization code to the sub-enterprise system according to the authorization code application request of the sub-enterprise system. The authorization code application request includes the user's account name and the identity information of the sub-enterprise system. The user's account name is obtained by the sub-enterprise system parsing the business operation request initiated by the user. The one-time authorization code includes the identity information of the main enterprise system.

[0007] The main enterprise system sends a token to the sub-enterprise system according to the token request of the sub-enterprise system, wherein the token request includes the one-time authorization code;

[0008] The main enterprise system returns the user's login information to the sub-enterprise system based on the token sent by the sub-enterprise system, thereby completing the user's login in the sub-enterprise system. The login information includes the user's username and password.

[0009] According to another aspect of the present invention, the present invention provides an identity authentication device for a group enterprise system, the group enterprise system including one main enterprise system and multiple subsidiary enterprise systems, the device comprising:

[0010] The first authentication module is used by the main enterprise system to authenticate the identity authentication request initiated by the user and return the authentication result to the user. The identity authentication request includes the user's account name and account password, and the authentication result includes authentication success and authentication failure.

[0011] The authorization code module is used by the main enterprise system to send a one-time authorization code to the sub-enterprise system according to the authorization code application request of the sub-enterprise system. The authorization code application request includes the user's account name and the identity information of the sub-enterprise system. The user's account name is obtained by the sub-enterprise system parsing the business operation request initiated by the user. The one-time authorization code includes the identity information of the main enterprise system.

[0012] A token generation module is used by the main enterprise system to send a token to the sub-enterprise system according to the token application request of the sub-enterprise system, wherein the token application request includes the one-time authorization code;

[0013] The second authentication module is used by the main enterprise system to return the user's login information to the sub-enterprise system based on the token sent by the sub-enterprise system, so as to complete the user's login in the sub-enterprise system. The login information includes the user's account name and account password.

[0014] According to another aspect of the present invention, a computer-readable storage medium is provided, the storage medium storing a computer program for performing the methods described in any of the above aspects of the present invention.

[0015] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising: a processor; a memory for storing executable instructions of the processor; the processor being configured to read the executable instructions from the memory and execute the instructions to implement the method described in any of the preceding aspects of the present invention.

[0016] The present invention discloses an identity authentication method and apparatus for a group enterprise system. The method includes: a main enterprise system authenticating an identity authentication request initiated by a user and returning the authentication result to the user; the main enterprise system sending a one-time authorization code to the sub-enterprise system based on an authorization code request from the sub-enterprise system; the main enterprise system sending a token to the sub-enterprise system based on a token request from the sub-enterprise system; and the main enterprise system returning the user's login information to the sub-enterprise system based on the token sent by the sub-enterprise system, thereby completing the user's login in the sub-enterprise system. In this method and apparatus, the main enterprise system uses the identity information transmitted by the sub-enterprise system to achieve the transfer of the user's trusted identity information from the main enterprise system to the sub-enterprise system. The entire process is fast and efficient, enabling login from one location and mutual trust across multiple locations, and is invisible to the user. Users can switch business operations without multiple logins, significantly improving the user experience. Simultaneously, it provides developers with a universal identity authentication framework, improving developer efficiency. Attached Figure Description

[0017] Exemplary embodiments of the present invention can be more fully understood by referring to the following figures:

[0018] Figure 1 A flowchart illustrating an identity authentication method for a group enterprise system according to a preferred embodiment of the present invention;

[0019] Figure 2 This is a schematic diagram of the structure of an identity authentication device for a group enterprise system according to a preferred embodiment of the present invention;

[0020] Figure 3 This is a schematic diagram of the structure of an electronic device according to a preferred embodiment of the present invention. Detailed Implementation

[0021] Exemplary embodiments of the invention will now be described with reference to the accompanying drawings. However, the invention may be embodied in many different forms and is not limited to the embodiments described herein. These embodiments are provided to fully and completely disclose the invention and to fully convey its scope to those skilled in the art. The terminology used in the exemplary embodiments illustrated in the drawings is not intended to limit the invention. In the drawings, the same units / elements are referred to by the same reference numerals.

[0022] Unless otherwise stated, the terms used herein (including technical terms) have their common meaning as understood by one of ordinary skill in the art. Furthermore, it is understood that terms defined in commonly used dictionaries should be understood to have a meaning consistent with the context of their relevant field, and not to be interpreted as having an idealized or overly formal meaning.

[0023] Exemplary methods

[0024] Figure 1 This is a flowchart illustrating an identity authentication method for a group enterprise system according to a preferred embodiment of the present invention. The group enterprise system described in this preferred embodiment includes one main enterprise system and multiple subsidiary enterprise systems, such as... Figure 1 As shown, the identity authentication method for a group enterprise system described in this preferred embodiment begins with step 101.

[0025] In step 101, the main enterprise system authenticates the identity authentication request initiated by the user and returns the authentication result to the user. The identity authentication request includes the user's account name and account password, and the authentication result includes authentication success and authentication failure.

[0026] In step 102, the main enterprise system sends a one-time authorization code to the sub-enterprise system according to the authorization code application request of the sub-enterprise system. The authorization code application request includes the user's account name and the identity information of the sub-enterprise system. The user's account name is obtained by the sub-enterprise system parsing the business operation request initiated by the user. The one-time authorization code includes the identity information of the main enterprise system.

[0027] Preferably, the main enterprise system sends a one-time authorization code to the sub-enterprise system based on the sub-enterprise system's authorization code application request, including:

[0028] The main enterprise system parses the authorization code application request to obtain the identity information of the sub-enterprise system and the user's account name. The identity information of the sub-enterprise system is the social credit code / taxpayer identification number of the sub-enterprise.

[0029] The user's login status is determined based on their account name, where:

[0030] The user's authentication result is determined based on the user's account name;

[0031] When the authentication result is successful, the login status is determined to be successful; otherwise, the login status is determined to be failed.

[0032] When the login status is successful, a one-time authorization code is generated based on the identity information of the main enterprise system and sent to the sub-enterprise system. The identity information of the main enterprise system is the social credit code / taxpayer identification number of the main enterprise.

[0033] In step 103, the main enterprise system sends a token to the sub-enterprise system according to the token request of the sub-enterprise system, wherein the token request includes the one-time authorization code.

[0034] Preferably, the process of the main enterprise system sending a token to the sub-enterprise system based on the token request from the sub-enterprise system includes:

[0035] The main enterprise system parses the token application request and obtains the one-time authorization code;

[0036] The main enterprise system verifies the validity of the one-time authorization code and confirms the verification result, wherein the verification result includes verification valid and verification invalid;

[0037] When the verification result is valid, a token is generated and sent to the sub-enterprise system.

[0038] In step 104, the main enterprise system returns the user's login information to the sub-enterprise system based on the token sent by the sub-enterprise system, thereby completing the user's login in the sub-enterprise system. The login information includes the user's username and password.

[0039] Preferably, the method further includes:

[0040] After the user completes the login in the sub-enterprise system, the system processes the business operation request, generates the business processing result, and returns it to the user.

[0041] The identity authentication method for group enterprise systems described in this preferred embodiment uses the identity information of the subsidiary enterprise systems. Without the need for additional parameter transmission, it can realize the transfer of trusted identities from the main enterprise to multiple subsidiaries, ensuring data security and protecting user data privacy. Moreover, through the transfer of trusted identities, users can log in seamlessly between the main and subsidiary enterprises, improving user efficiency.

[0042] Exemplary device

[0043] Figure 2 This is a schematic diagram of an identity authentication device for a group enterprise system according to a preferred embodiment of the present invention. The group enterprise system described in this preferred embodiment includes one main enterprise system and multiple subsidiary enterprise systems, such as... Figure 2 As shown, the identity authentication device 200 for a group enterprise system according to this preferred embodiment includes:

[0044] The first authentication module 201 is used by the main enterprise system to authenticate the identity authentication request initiated by the user and return the authentication result to the user. The identity authentication request includes the user's account name and account password, and the authentication result includes authentication success and authentication failure.

[0045] The authorization code module 202 is used by the main enterprise system to send a one-time authorization code to the sub-enterprise system according to the authorization code application request of the sub-enterprise system. The authorization code application request includes the user's account name and the identity information of the sub-enterprise system. The user's account name is obtained by the sub-enterprise system parsing the business operation request initiated by the user. The one-time authorization code includes the identity information of the main enterprise system.

[0046] The token generation module 203 is used by the main enterprise system to send a token to the sub-enterprise system according to the token application request of the sub-enterprise system, wherein the token application request includes the one-time authorization code;

[0047] The second authentication module 204 is used by the main enterprise system to return the user's login information to the sub-enterprise system based on the token sent by the sub-enterprise system, so as to complete the user's login in the sub-enterprise system. The login information includes the user's account name and account password.

[0048] Preferably, the authorization code module 202 enables the main enterprise system to send a one-time authorization code to the sub-enterprise system based on the sub-enterprise system's authorization code application request, including:

[0049] The main enterprise system parses the authorization code application request to obtain the identity information of the sub-enterprise system and the user's account name. The identity information of the sub-enterprise system is the social credit code / taxpayer identification number of the sub-enterprise.

[0050] The user's login status is determined based on their account name, where:

[0051] The user's authentication result is determined based on the user's account name;

[0052] When the authentication result is successful, the login status is determined to be successful; otherwise, the login status is determined to be failed.

[0053] When the login status is successful, a one-time authorization code is generated based on the identity information of the main enterprise system and sent to the sub-enterprise system. The identity information of the main enterprise system is the social credit code / taxpayer identification number of the main enterprise.

[0054] Preferably, the token generation module 203 enables the main enterprise system to send a token to the sub-system based on the token application request of the sub-enterprise system, including:

[0055] The main enterprise system parses the token application request and obtains the one-time authorization code;

[0056] The main enterprise system verifies the validity of the one-time authorization code and confirms the verification result, wherein the verification result includes verification valid and verification invalid;

[0057] When the verification result is valid, a token is generated and sent to the sub-enterprise system.

[0058] Preferably, the device further includes:

[0059] The authorization request module is used by the sub-enterprise system to send an authorization code request to the main enterprise system to obtain the user's login information. The authorization code request includes the user's account name and the sub-enterprise system's identity information. The user's account name is obtained by the sub-enterprise system parsing the business operation request initiated by the user. The login information includes the user's account name and account password.

[0060] The token request module is used by the sub-enterprise system to send a token request to the main enterprise system;

[0061] The token sending module is used for the sub-enterprise system to send a token to the main enterprise system to obtain the user's login information, so as to complete the user's login in the sub-enterprise system, wherein the login information includes the user's account name and account password.

[0062] The identity authentication device for group enterprise systems described in this preferred embodiment and the identity authentication method for group enterprise systems have the same steps for user identity authentication during user business switching, and achieve the same technical effect, so they will not be described again here.

[0063] Exemplary electronic devices

[0064] Figure 3 This is a schematic diagram of an electronic device according to a preferred embodiment of the present invention. The electronic device may be either or both of a first device and a second device, or a standalone device independent of them. The standalone device may communicate with the first device and the second device to receive the collected input signals from them. Figure 3 A block diagram of an electronic device according to an embodiment of the present disclosure is shown. Figure 3 As shown, the electronic device includes one or more processors 301 and memory 302.

[0065] The processor 301 may be a central processing unit (CPU) or other form of processing unit with data processing capabilities and / or instruction execution capabilities, and may control other components in the electronic device to perform desired functions.

[0066] The memory 302 may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache memory. The non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and the processor 301 may execute the program instructions to implement the energy consumption anomaly diagnosis method based on enterprise energy consumption space of the various embodiments disclosed above, and / or other desired functions. In one example, the electronic device may also include an input device 303 and an output device 304, these components being interconnected via a bus system and / or other forms of connection mechanisms (not shown).

[0067] In addition, the input device 303 may also include, for example, a keyboard, a mouse, etc.

[0068] The output device 304 can output various information to the outside. The output device 304 may include, for example, a display, a speaker, a printer, and a communication network and its connected remote output devices, etc.

[0069] Of course, for the sake of simplicity, Figure 3 Only some of the components of the electronic device relevant to this disclosure are shown, omitting components such as buses, input / output interfaces, etc. In addition, the electronic device may include any other suitable components depending on the specific application.

[0070] Exemplary computer program products and computer-readable storage media

[0071] In addition to the methods and apparatus described above, embodiments of this disclosure may also be computer program products comprising computer program instructions that, when executed by a processor, cause the processor to perform the steps in the identity authentication methods for a group enterprise system according to various embodiments of this disclosure as described in the "Exemplary Methods" section of this specification.

[0072] The computer program product can be written in any combination of one or more programming languages ​​to perform the operations of the embodiments of this disclosure. The programming languages ​​include object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on a user's computing device, partially on a user's computing device, as a standalone software package, partially on a user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0073] Furthermore, embodiments of this disclosure may also be computer-readable storage media storing computer program instructions that, when executed by a processor, cause the processor to perform the steps in the identity authentication method for a group enterprise system according to various embodiments of this disclosure as described in the "Exemplary Methods" section above.

[0074] The computer-readable storage medium may be any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may, for example, include, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatuses, or devices, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: electrical connections having one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0075] The basic principles of this disclosure have been described above with reference to specific embodiments. However, it should be noted that the advantages, benefits, and effects mentioned in this disclosure are merely examples and not limitations, and should not be considered as essential features of each embodiment of this disclosure. Furthermore, the specific details disclosed above are for illustrative and facilitative purposes only, and are not limitations. These details do not limit the scope of this disclosure to the necessity of employing the aforementioned specific details for implementation.

[0076] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For system embodiments, since they largely correspond to method embodiments, the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0077] The block diagrams of devices, apparatuses, devices, and systems disclosed herein are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, apparatuses, devices, and systems can be connected, arranged, and configured in any manner. Words such as “comprising,” “including,” “having,” etc., are open-ended terms meaning “including but not limited to,” and are used interchangeably with them. The terms “or” and “and” as used herein refer to the terms “and / or,” and are used interchangeably with them unless the context clearly indicates otherwise. The term “such as” as used herein refers to the phrase “such as but not limited to,” and is used interchangeably with it.

[0078] The apparatus and methods of this disclosure may be implemented in many ways. For example, they may be implemented by software, hardware, firmware, or any combination of software, hardware, and firmware. The above-described order of steps for the methods is for illustrative purposes only, and the steps of the methods of this disclosure are not limited to the order specifically described above unless otherwise specifically stated. Furthermore, in some embodiments, this disclosure may also be implemented as a program recorded on a recording medium, the program including machine-readable instructions for implementing the methods according to this disclosure. Thus, this disclosure also covers recording media storing programs for performing the methods according to this disclosure.

[0079] It should also be noted that in the apparatus, devices, and methods of this disclosure, the components or steps are decomposable and / or recombinable. Such decomposition and / or recombination should be considered equivalent to the present disclosure. The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use this disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein can be applied to other aspects without departing from the scope of this disclosure. Therefore, this disclosure is not intended to be limited to the aspects shown herein, but rather to be carried out within the widest scope consistent with the principles and novel features disclosed herein.

[0080] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of this disclosure to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations therein.

Claims

1. An identity authentication method for a group enterprise system, said group enterprise system comprising one main enterprise system and multiple subsidiary enterprise systems, characterized in that, The method includes: The main enterprise system authenticates the identity authentication request initiated by the user and returns the authentication result to the user. The identity authentication request includes the user's account name and account password, and the authentication result includes authentication success and authentication failure. The main enterprise system sends a one-time authorization code to the sub-enterprise system according to the authorization code application request of the sub-enterprise system. The authorization code application request includes the user's account name and the identity information of the sub-enterprise system. The user's account name is obtained by the sub-enterprise system parsing the business operation request initiated by the user. The one-time authorization code includes the identity information of the main enterprise system. The main enterprise system sends a token to the sub-enterprise system according to the token request of the sub-enterprise system, wherein the token request includes the one-time authorization code; The main enterprise system returns the user's login information to the sub-enterprise system based on the token sent by the sub-enterprise system, thereby completing the user's login in the sub-enterprise system. The login information includes the user's username and password.

2. The method according to claim 1, characterized in that, The main enterprise system sends a one-time authorization code to the sub-enterprise system based on the sub-enterprise system's authorization code application request, including: The main enterprise system parses the authorization code application request to obtain the identity information of the sub-enterprise system and the user's account name. The identity information of the sub-enterprise system is the social credit code / taxpayer identification number of the sub-enterprise. The user's login status is determined based on their account name, where: The user's authentication result is determined based on the user's account name; When the authentication result is successful, the login status is determined to be successful; otherwise, the login status is determined to be failed. When the login status is successful, a one-time authorization code is generated based on the identity information of the main enterprise system and sent to the sub-enterprise system. The identity information of the main enterprise system is the social credit code / taxpayer identification number of the main enterprise.

3. The method according to claim 1, characterized in that, The process of the main enterprise system sending a token to the sub-enterprise system based on the token request from the sub-enterprise system includes: The main enterprise system parses the token application request and obtains the one-time authorization code; The main enterprise system verifies the validity of the one-time authorization code and confirms the verification result, wherein the verification result includes verification valid and verification invalid; When the verification result is valid, a token is generated and sent to the sub-enterprise system.

4. The method according to claim 1, characterized in that, The method further includes: After the user completes the login in the sub-enterprise system, the system processes the business operation request, generates the business processing result, and returns it to the user.

5. An identity authentication device for a group enterprise system, said group enterprise system comprising one main enterprise system and multiple subsidiary enterprise systems, characterized in that, The device includes: The first authentication module is used by the main enterprise system to authenticate the identity authentication request initiated by the user and return the authentication result to the user. The identity authentication request includes the user's account name and account password, and the authentication result includes authentication success and authentication failure. The authorization code module is used by the main enterprise system to send a one-time authorization code to the sub-enterprise system according to the authorization code application request of the sub-enterprise system. The authorization code application request includes the user's account name and the identity information of the sub-enterprise system. The user's account name is obtained by the sub-enterprise system parsing the business operation request initiated by the user. The one-time authorization code includes the identity information of the main enterprise system. A token generation module is used by the main enterprise system to send a token to the sub-enterprise system according to the token application request of the sub-enterprise system, wherein the token application request includes the one-time authorization code; The second authentication module is used by the main enterprise system to return the user's login information to the sub-enterprise system based on the token sent by the sub-enterprise system, so as to complete the user's login in the sub-enterprise system. The login information includes the user's account name and account password.

6. The apparatus according to claim 5, characterized in that, The authorization code module enables the main enterprise system to send a one-time authorization code to the sub-enterprise system based on the sub-enterprise system's authorization code application request, including: The main enterprise system parses the authorization code application request to obtain the identity information of the sub-enterprise system and the user's account name. The identity information of the sub-enterprise system is the social credit code / taxpayer identification number of the sub-enterprise. The user's login status is determined based on their account name, where: The user's authentication result is determined based on the user's account name; When the authentication result is successful, the login status is determined to be successful; otherwise, the login status is determined to be failed. When the login status is successful, a one-time authorization code is generated based on the identity information of the main enterprise system and sent to the sub-enterprise system. The identity information of the main enterprise system is the social credit code / taxpayer identification number of the main enterprise.

7. The apparatus according to claim 5, characterized in that, The token generation module enables the main enterprise system to send a token to the sub-enterprise system based on the token request from the sub-enterprise system, including: The main enterprise system parses the token application request and obtains the one-time authorization code; The main enterprise system verifies the validity of the one-time authorization code and confirms the verification result, wherein the verification result includes verification valid and verification invalid; When the verification result is valid, a token is generated and sent to the sub-enterprise system.

8. The apparatus according to claim 5, characterized in that, The device further includes: The authorization request module is used by the sub-enterprise system to send an authorization code request to the main enterprise system to obtain the user's login information. The authorization code request includes the user's account name and the sub-enterprise system's identity information. The user's account name is obtained by the sub-enterprise system parsing the business operation request initiated by the user. The login information includes the user's account name and account password. The token request module is used by the sub-enterprise system to send a token request to the main enterprise system; The token sending module is used for the sub-enterprise system to send a token to the main enterprise system to obtain the user's login information, so as to complete the user's login in the sub-enterprise system, wherein the login information includes the user's account name and account password.

9. A computer-readable storage medium, characterized in that, The storage medium stores a computer program for executing the method described in any one of claims 1 to 4.

10. An electronic device, characterized in that, The electronic device includes: processor; Memory used to store the processor's executable instructions; The processor is configured to read the executable instructions from the memory and execute the instructions to implement the method described in any one of claims 1 to 4.

Images