Authentication method and device of identity authentication center
By defining interface specifications and application plug-in packages in the identity authentication center, the problem of insufficient flexibility and security of the existing system is solved, and the diversity and security improvement is achieved.
Patent Information
- Application Number
- CN202510593202.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-05-09
- Publication Date
- 2025-07-25
AI Technical Summary
The existing identity authentication system lacks flexibility, is costly to maintain and is not secure enough to easily scale to adapt to new authentication technologies.
It provides an identity authentication center that supports multiple authentication protocols by defining interface specifications, deploys identity authentication plug-in using application plug-in packages, and supports dynamic loading or uninstallation, achieving flexible integration and compatibility between identity authentication center and plug-in.
It improves the diversity and security of identity authentication, reduces the difficulty of deployment and integration, supports flexible switching and compatibility of multiple authentication methods, and reduces invasive modifications to the original system.
Smart Images
Figure CN120378183A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of identity authentication, and particularly to an authentication method and device for an identity authentication center. Background Art
[0002] With the development of information technology, more and more enterprises and organizations rely on networks and digital services for their daily operations. In this process, user identity authentication has become a key link in protecting data security and personal privacy. Traditional identity authentication systems usually only support a single authentication method, such as a combination of username and password. Although this method is simple and easy to implement, it has deficiencies in terms of security. With the increasing number of network security threats, simple authentication methods can no longer meet modern security requirements. Therefore, a more flexible and scalable identity authentication solution is needed. Summary of the Invention
[0003] In order to solve the above technical problems, the present invention is proposed. Embodiments of the present invention provide an authentication method and device for an identity authentication center, which can improve the diversity of identity verification.
[0004] According to one aspect of the present invention, there is provided an authentication method for an identity authentication center, including: defining the authentication logic of an identity authentication plugin based on a pre-established interface specification of the identity authentication plugin; wherein, the authentication logic includes at least one of password authentication, biometric authentication, and hardware token authentication; configuring the plugin information of the identity authentication plugin based on the authentication logic of the identity authentication plugin; wherein, the identity authentication plugin is deployed in the form of an application add-on package; when the management end is started, scan the path of the add-on package, read the plugin information of the identity authentication plugin, and register the identity authentication plugin into the identity authentication center to complete the integration of the identity authentication center and the identity authentication plugin; authenticate the user identity through the identity authentication plugin integrated in the identity authentication center.
[0005] In an embodiment, the pre-established interface specification of the identity authentication plugin includes: an authentication request processing interface, an authentication logic execution interface, and an authentication result return interface; the authentication request processing interface is used to define the authentication request processing method implemented by the plugin; wherein, the authentication request processing method includes receiving an authentication request and verifying the validity of the request; the authentication logic execution interface is used to define the method for executing the authentication logic; wherein, the method of the authentication logic includes at least one of the logic methods of password authentication, biometric authentication, and hardware token authentication; the authentication result return interface is used to define the method for returning the authentication result; wherein, the method for returning the authentication result includes the status and information of successful authentication and the status and information of failed authentication.
[0006] In one embodiment, the authentication method of the identity authentication center further includes: configuring a plugin repository; putting the identity authentication plugin online to the plugin repository to scan the path of the external program package, read the plugin information of the identity authentication plugin, and register the identity authentication plugin to the identity authentication center without stopping or restarting the authentication service of the identity authentication center, thereby completing the integration of the identity authentication center and the identity authentication plugin.
[0007] In one embodiment, the authentication method of the identity authentication center further includes: when the identity authentication plugin in the identity authentication center has not been used within a preset time range, uninstalling the identity authentication plugin that has not been used within the preset time range; or when the number of uses of the identity authentication plugin in the identity authentication center within a preset time range is less than or equal to a preset number of times, uninstalling the identity authentication plugin whose number of uses within the preset time range is less than or equal to the preset number of times.
[0008] In one embodiment, the authentication method of the identity authentication center further includes: configuring different user roles; where the user roles include at least one of an operation and maintenance personnel, an auditor, and an implementer; associating an identity authentication plugin with each user role; where each user role is associated with the authentication logic of one or more of the identity authentication plugins.
[0009] In one embodiment, authenticating the user identity through the identity authentication plugin integrated in the identity authentication center includes: authenticating the user identity through the corresponding identity authentication plugin integrated in the identity authentication center according to the user role and the identity authentication plugin associated with the user role.
[0010] In one embodiment, the authentication method of the identity authentication center further includes: setting the authentication logic for secondary authentication for different user roles according to different applications; authenticating the user identity through the identity authentication plugin integrated in the identity authentication center includes: when the user logs in to the corresponding application, authenticating the user identity by associating the authentication logic of one or more of the identity authentication plugins and the authentication logic for secondary authentication.
[0011] In one embodiment, when the management terminal is started, scanning the path of the external program package, reading the plugin information of the identity authentication plugin, and registering the identity authentication plugin to the identity authentication center to complete the integration of the identity authentication center and the identity authentication plugin includes: when the management terminal is started, scanning the path of the external program package, reading the plugin information of the identity authentication plugin, and registering the identity authentication plugin to the identity authentication center; auditing the plugin information and registration information of the identity authentication plugin; when the plugin information and registration information of the identity authentication plugin pass the audit, the identity authentication plugin obtains the use permission in the identity authentication center.
[0012] In one embodiment, the authentication method of the identity authentication center further includes: when an exception occurs during the loading or execution of the identity authentication plug-in, sending an exception prompt to the identity authentication plug-in where the exception occurs; and based on the exception handling mechanism of the identity authentication center, performing exception handling on the identity authentication plug-in where the exception occurs.
[0013] According to another aspect of the present invention, there is provided an authentication device for an identity authentication center, including: a definition module, configured to define the authentication logic of the identity authentication plug-in based on the interface specification of the identity authentication plug-in formulated in advance; wherein, the authentication logic includes at least one of password authentication, biometric authentication, and hardware token authentication; a configuration module, configured to configure the plug-in information of the identity authentication plug-in based on the authentication logic of the identity authentication plug-in; wherein, the identity authentication plug-in is deployed in the form of an application add-on package; an integration module, configured to, when the management end is started, scan the path of the add-on package, read the plug-in information of the identity authentication plug-in, and register the identity authentication plug-in into the identity authentication center to complete the integration of the identity authentication center and the identity authentication plug-in; an authentication module, configured to authenticate the user identity through the identity authentication plug-in integrated in the identity authentication center.
[0014] The authentication method and device of the identity authentication center provided by the present invention support multiple authentication protocols through the interface specification, ensuring good compatibility with different authentication methods, enabling the identity authentication center to flexibly integrate multiple authentication methods, and deploying the identity authentication plug-in in the form of an application add-on package, which has no intrusion into the original application system and the original application system does not need to be modified, reducing the difficulty of deployment and integration. Therefore, the identity authentication center can integrate multiple identity authentication plug-ins, enhancing the diversity and security of identity authentication. BRIEF DESCRIPTION OF THE DRAWINGS
[0015] By describing the embodiments of the present invention in more detail in conjunction with the drawings, the above and other objects, features, and advantages of the present invention will become more obvious. The drawings are used to provide a further understanding of the embodiments of the present invention and constitute a part of the specification, and are used to explain the present invention together with the embodiments of the present invention, and do not constitute a limitation to the present invention. In the drawings, the same reference numerals generally represent the same components or steps.
[0016] Figure 1 is a schematic flowchart of the authentication method of the identity authentication center provided by an exemplary embodiment of the present invention.
[0017] Figure 2 is a schematic structural diagram of the authentication device of the identity authentication center provided by an exemplary embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS
[0018] Next, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all embodiments of the present invention. It should be understood that the present invention is not limited by the exemplary embodiments described herein.
[0019] The identity authentication systems on the current market have the following limitations: 1. Lack of flexibility: Most identity authentication systems can only support limited authentication methods and cannot be easily extended to adapt to new authentication technologies. 2. High maintenance cost: When new authentication methods need to be added or authentication policies need to be adjusted, significant modifications are usually required to the existing system, which increases the maintenance cost and complexity. 3. Insufficient security: Traditional identity authentication systems often do not have strong enough security measures to resist complex attacks. To solve the above problems, the present application proposes a unified identity authentication center that supports a dynamic pluggable authentication mechanism. This authentication center can support multiple authentication methods and can dynamically load or unload authentication plugins to adapt to new authentication requirements.
[0020] The authentication method of the identity authentication center of the present application is applied to a unified identity authentication center, which has all the conventional authentication functions of a traditional unified identity authentication center. Role-based access control (RBAC) is used to perform many-to-many bindings on users, applications, roles, and menus to meet the different operation permissions of different users.
[0021] Figure 1 is a schematic flowchart of the authentication method of the identity authentication center provided by an exemplary embodiment of the present invention. As Figure 1 shown, first, based on the interface specification of the pre-defined identity authentication plugin, the authentication logic of the identity authentication plugin is defined (see Figure 1 S100). Among them, the authentication logic includes at least one of password authentication, biometric authentication, and hardware token authentication. Secondly, based on the authentication logic of the identity authentication plugin, the plugin information of the identity authentication plugin is configured (see Figure 1 S200); among them, the identity authentication plugin is deployed in the form of an application add-on package; then, when the management end is started, the path of the add-on package is scanned, the plugin information of the identity authentication plugin is read, and the identity authentication plugin is registered in the identity authentication center to complete the integration of the identity authentication center and the identity authentication plugin (see Figure 1 S300); finally, the user identity is authenticated through the identity authentication plugin integrated in the identity authentication center (see Figure 1 S400).
[0022] The following will Figure 1 introduce the authentication method of the identity authentication center provided by the embodiments of the present application in more detail.
[0023] In S100, based on the pre-established interface specification of the identity authentication plug-in, the authentication logic of the identity authentication plug-in is defined. The interface specification is a standardized definition of the interaction method between systems, modules, components, or services, including data formats, communication protocols, function call rules, etc. By pre-unifying the interface specification, the development and maintenance costs can be reduced. The new identity authentication plug-in only needs to follow the specification to be connected, without modifying the existing system. Through the pre-established interface specification of the identity authentication plug-in, the compatibility, efficiency, security, and maintainability of the identity authentication center can be significantly improved. Therefore, providing a standardized interface makes the integration of the unified identity authentication center and the identity authentication plug-in easier. Support for multiple authentication protocols ensures good compatibility with different authentication methods.
[0024] In some embodiments, the pre-established interface specification of the identity authentication plug-in includes: an authentication request processing interface, an authentication logic execution interface, and an authentication result return interface. The authentication request processing interface is used to define the authentication request processing method implemented by the plug-in; among them, the authentication request processing method includes receiving the authentication request and verifying the validity of the request, etc. The authentication logic execution interface is used to define the method for executing the authentication logic; among them, the method of the authentication logic includes at least one authentication logic method among password authentication, biometric authentication, and hardware token authentication, such as the logic methods of username and password authentication, SMS verification code authentication, UKEY authentication, OTP (One-Time Password) authentication, biometric comparison, etc. The authentication result return interface is used to define the method for returning the authentication result; among them, the method for returning the authentication result includes the status and information of successful authentication and the status and information of failed authentication. By defining multiple XXXXResponseData, the response content of the authentication request and the system callback after completing the authentication is standardized. Users or developers can complete the development of relevant authentication logic according to the plug-in interface specification, such as the development of relevant authentication logic such as OTP authentication, ukey authentication, and SMS authentication. Based on this, the unified identity authentication center can dynamically adapt to the changing authentication requirements and can easily integrate new authentication methods.
[0025] In S200, based on the authentication logic of the identity authentication plug-in, the plug-in information of the identity authentication plug-in is configured; among them, the identity authentication plug-in is deployed in the form of an application external program package. After the development of the authentication logic related to the authentication plug-in is completed, in the plug-in, add the metadata description configuration of the plug-in, including relevant information such as the name, function, and author of the plug-in. Configuring specific parameters for each authentication plug-in can meet different authentication requirements.
[0026] In some embodiments, the present application is deployed in the form of an application management end and an authentication plug-in end. The management end is deployed in the form of a web project, and the authentication plug-in end is deployed in the form of an application plug-in package. Through the management end function, the loading and unloading of the plug-in are dynamically controlled.
[0027] In S300, when the management terminal is started, the path of the plug-in package is scanned, the plug-in information of the identity authentication plug-in is read, and the identity authentication plug-in is registered in the identity authentication center to complete the integration of the identity authentication center and the identity authentication plug-in.
[0028] Packaging and deployment of identity authentication plug-ins: After the identity authentication plug-in is packaged, it is deployed in the form of an application plug-in package. When the management end is started, the scanning task of the identity authentication plug-in will be started, the path of the plug-in package will be scanned, all plug-in packages in the folder will be scanned, the metadata description file of the agreed identity authentication plug-in will be read, and the identity authentication plug-in will be registered in the unified identity authentication center. Deployment in the form of an application plug-in package does not intrude on the original application system of the identity authentication center, and the original application system does not need to be modified. The dynamic plug-in and unplugging of the authentication plug-in can be realized, which solves the difficulty of deployment and integration.
[0029] In the unified identity authentication center, a plug-in warehouse is configured; the identity authentication plug-in is put online to the plug-in warehouse, so that the path of the plug-in package can be scanned, the plug-in information of the identity authentication plug-in can be read, and the identity authentication plug-in can be registered in the identity authentication center without stopping or restarting the authentication service of the identity authentication center, so as to complete the integration of the identity authentication center and the identity authentication plug-in. Therefore, the plug-in warehouse can support the functions of loading and unloading the identity authentication plug-in, support dynamic loading of the identity authentication plug-in, that is, loading a new identity authentication plug-in without restarting the system, and support dynamic unloading of the identity authentication plug-in that is no longer needed, so as to release various resources of the system. In addition, the plug-in warehouse can also support the search and discovery of plug-ins, that is, manually triggering the scanning mechanism of the identity authentication plug-in to complete the automatic registration of the identity authentication plug-in. At the same time, it also supports manual registration of the identity authentication plug-in. By manually filling in the metadata information of the identity authentication plug-in and the file path where the plug-in package is stored, the identity authentication plug-in can be manually registered to the unified identity authentication center.
[0030] For example, when the identity authentication plugin in the identity authentication center has not been used within a preset time range, the identity authentication plugin that has not been used within the preset time range will be uninstalled; or when the number of uses of the identity authentication plugin in the identity authentication center within a preset time range is less than or equal to a preset number of times, the identity authentication plugin with the number of uses less than or equal to the preset number of times within the preset time range will be uninstalled. That is to say, identity authentication plugins that have not been used for a long time can be automatically cleaned up, and identity authentication plugins that are no longer needed can also be manually cleaned up. The fact that identity authentication plugins remain resident in memory will consume CPU, memory, and network resources. After cleaning, system resources can be released, and the running speed can be increased. When cleaning identity authentication plugins, they can be cleaned according to the usage frequency. For example, plugins that have not been used for more than 3 months can be given priority for deletion. They can also be judged according to the necessity of the identity authentication plugin. For example, if there is a preferred alternative for the identity authentication plugin, the old identity authentication plugin can be deleted. Or observe the resource occupancy of the identity authentication plugin. When too many identity authentication plugins are installed and occupy too many resources, some infrequently used identity authentication plugins can be appropriately deleted.
[0031] In some embodiments, the identity authentication plugin is deployed in the form of an application add-on program package. According to the interface specification of the identity authentication plugin formulated in advance, dynamic loading and unloading of the identity authentication plugin can be achieved. The unified identity authentication center supports the hot-plug mechanism. With the assistance of the function of the plugin repository, the plugin can be loaded or unloaded without stopping or restarting the authentication service. This function can be implemented relying on the mechanism of dynamically loading and unloading beans in spring, which greatly facilitates users to quickly complete the switching of the unified authentication method under different environments, different scenarios, and different business requirements.
[0032] In some embodiments, when the management terminal is started, it scans the path of the add-on program package, reads the plugin information of the identity authentication plugin, and registers the identity authentication plugin in the identity authentication center; the plugin information and registration information of the identity authentication plugin are audited; when the plugin information and registration information of the identity authentication plugin pass the audit, the identity authentication plugin obtains the usage permission in the identity authentication center. Since the identity authentication plugin is deployed in the form of an application add-on program package, that is to say, the identity authentication plugin is developed by external developers of the system and then integrated into the unified identity authentication center. To ensure the security of the identity authentication plugin, a plugin authentication ID and authentication key can be issued to the plugin developer during plugin development for authentication during the registration of the identity authentication plugin. At the same time, when the identity authentication plugin goes online to the plugin repository, the identity authentication plugin will be audited. The developer or system operator of the identity authentication plugin submits a request for the identity authentication plugin to go online to the plugin repository, which is audited by the system administrator. After passing the audit, it can go online to the plugin library, and then the identity authentication plugin can be loaded and unloaded through the docking of the plugin repository.
[0033] In addition, the unified identity authentication center can also set the auditing function for the extended authentication plug-ins. Based on the AOP feature of Spring, this function records the loading, unloading, and usage of the authentication plug-ins for security auditing.
[0034] In some embodiments, when an exception occurs during the loading or execution of an identity authentication plug-in, an exception prompt is issued for the identity authentication plug-in with the exception; and based on the exception handling mechanism of the identity authentication center, the identity authentication plug-in with the exception is processed for the exception. The unified identity authentication center has a global exception handling mechanism. When an error occurs during the loading or execution of an identity authentication plug-in, the exception situation can be processed based on the exception handling mechanism to avoid system crashes. That is to say, the exception handling mechanism of the unified identity authentication center can be directly applied to process the exceptions of the identity authentication plug-ins.
[0035] In some embodiments, when the unified identity authentication center is deployed, it supports the distributed deployment mode and can be deployed and run on multiple servers to improve performance and reliability. And through the load balancer, failover, and automatic recovery mechanisms, the high availability of the system is ensured.
[0036] In S400, the user identity is authenticated through the identity authentication plug-ins integrated in the identity authentication center. By using the authentication logic provided by the identity authentication plug-ins to authenticate the user identity, the authentication methods can be enriched and the authentication security can be improved.
[0037] In some embodiments, in the unified identity authentication center, there is a function of configuring the authentication rule engine, and different authentication processes can be customized according to the user roles. That is to say, the system administrator can configure different authentication login processes for different users according to the requirements of different business scenarios. For example, on the basis of the unified identity authentication center having all the conventional authentication functions of the traditional unified identity authentication center, different user roles can be configured; among them, the user roles include at least one of operation and maintenance personnel, auditors, and implementers; an identity authentication plug-in is associated with each user role; among them, each user role is associated with the authentication logic of one or more identity authentication plug-ins, such as OTP authentication, Ukey authentication, etc. According to the user roles and the identity authentication plug-ins associated with the user roles, the user identity is authenticated through the corresponding identity authentication plug-ins integrated in the identity authentication center.
[0038] In addition, in some embodiments, the authentication logic for secondary authentication can also be set for different user roles according to different applications; when a user logs in to the corresponding application, the user identity is authenticated by associating the authentication logic of one or more identity authentication plugins and the authentication logic of secondary authentication. For example, after the binding is completed, the authentication process when the user accesses different applications will be flexible and diverse. For example, when the user accesses Application A and has the role of an administrator, there will be secondary authentication with a Ukey after logging in. When accessing Application B and having the role of an operation and maintenance personnel, there will be secondary authentication with an OTP after logging in, realizing that different users with different roles log in to different systems and having diverse secondary authentication methods. After associating different roles with different applications, then associate the roles of the application with the user to complete the many-to-many binding of user-role-application.
[0039] In other embodiments, tertiary authentication, quaternary authentication, etc. can also be set, which can be flexibly configured according to the user identity and application requirements to improve the authentication security.
[0040] In some embodiments, the unified identity authentication center can be configured with a graphical user interface for the convenience of administrators and users.
[0041] In some embodiments, the unified identity authentication center can also be configured with a user identity management module for managing user identity information, including operations such as registration, update, and cancellation.
[0042] Figure 2 FIG. is a schematic structural diagram of an authentication device of an identity authentication center provided by an exemplary embodiment of the present invention. As Figure 2 shown, the authentication device 2 of the identity authentication center includes: a definition module 21 for defining the authentication logic of the identity authentication plugin based on the interface specification of the pre-formulated identity authentication plugin; wherein, the authentication logic includes at least one of password authentication, biometric authentication, and hardware token authentication; a configuration module 22 for configuring the plugin information of the identity authentication plugin based on the authentication logic of the identity authentication plugin; wherein, the identity authentication plugin is deployed in the form of an application add-on package; an integration module 23 for scanning the path of the add-on package, reading the plugin information of the identity authentication plugin, and registering the identity authentication plugin into the identity authentication center when the management end is started to complete the integration of the identity authentication center and the identity authentication plugin; an authentication module 24 for authenticating the user identity through the identity authentication plugin integrated in the identity authentication center.
[0043] In one embodiment, the interface specifications of the pre-developed identity authentication plug-in include: an authentication request processing interface, an authentication logic execution interface, and an authentication result return interface; the authentication request processing interface is used to define the authentication request processing method implemented by the plug-in; among them, the authentication request processing method includes receiving an authentication request and verifying the validity of the request; the authentication logic execution interface is used to define the method for executing the authentication logic; among them, the method of the authentication logic includes at least one of the logic methods of password authentication, biometric authentication, and hardware token authentication; the authentication result return interface is used to define the method for returning the authentication result; among them, the method for returning the authentication result includes the status and information of successful authentication and the status and information of failed authentication.
[0044] In one embodiment, the authentication device 2 of the identity authentication center may further include: a configuration plug-in repository; online the identity authentication plug-in to the plug-in repository, so as to scan the path of the external program package, read the plug-in information of the identity authentication plug-in, and register the identity authentication plug-in to the identity authentication center without stopping or restarting the authentication service of the identity authentication center, and complete the integration of the identity authentication center and the identity authentication plug-in.
[0045] In one embodiment, the authentication device 2 of the identity authentication center may further include: when the identity authentication plug-in in the identity authentication center has not been used within a preset time range, unload the identity authentication plug-in that has not been used within the preset time range; or when the usage times of the identity authentication plug-in in the identity authentication center are less than or equal to the preset times within a preset time range, unload the identity authentication plug-in whose usage times are less than or equal to the preset times within the preset time range.
[0046] In one embodiment, the authentication device 2 of the identity authentication center may further include: configuring different user roles; among them, the user roles include at least one of operation and maintenance personnel, auditors, and implementers; associating an identity authentication plug-in with each user role; among them, each user role is associated with the authentication logic of one or more identity authentication plug-ins.
[0047] In one embodiment, the authentication module 24 may be configured to: authenticate the user identity through the corresponding identity authentication plug-in integrated in the identity authentication center according to the user role and the identity authentication plug-in associated with the user role.
[0048] In one embodiment, the authentication device 2 of the identity authentication center may further include: setting the authentication logic for secondary authentication for different user roles according to different applications; authenticating the user identity through the identity authentication plug-in integrated in the identity authentication center, including: when the user logs in to the corresponding application, authenticating the user identity through the authentication logic associated with one or more identity authentication plug-ins and the authentication logic for secondary authentication.
[0049] In one embodiment, the integrated module 23 may be configured to: when the management terminal starts up, scan the path of the add-on program package, read the plugin information of the identity authentication plugin, and register the identity authentication plugin into the identity authentication center; review the plugin information and registration information of the identity authentication plugin; when the plugin information and registration information of the identity authentication plugin pass the review, the identity authentication plugin obtains the usage permission in the identity authentication center.
[0050] In one embodiment, the authentication device 2 of the identity authentication center may further include: when an exception occurs during the loading or execution of the identity authentication plugin, sending an exception prompt to the identity authentication plugin with the exception; and based on the exception handling mechanism of the identity authentication center, performing exception handling on the identity authentication plugin with the exception.
[0051] An embodiment of the present invention provides an authentication device for an identity authentication center. The device embodiment can be implemented by software, or by hardware or a combination of software and hardware. In terms of the hardware level, in addition to the CPU, memory, network interface, and non-volatile memory, the device where the device in the embodiment is located usually may further include other hardware, such as a forwarding chip responsible for processing packets, etc. Taking the software implementation as an example, as a logically meaningful device, it is formed by the CPU of its corresponding device reading the computer program instructions in the non-volatile memory into the memory for operation.
[0052] According to another aspect of the present invention, there is provided a computer-readable storage medium storing a computer program for executing the authentication method of the identity authentication center in any of the above embodiments.
[0053] In addition to the above methods and devices, an embodiment of the present invention may also be a computer program product, which includes computer program instructions that, when run by a processor, cause the processor to execute the steps in the authentication method of the identity authentication center according to various embodiments of the present invention described above.
[0054] According to another aspect of the present invention, there is provided an electronic device including: a processor; a memory for storing processor-executable instructions; and the processor for executing the authentication method of the identity authentication center in any of the above embodiments.
[0055] In addition, an embodiment of the present invention may also be a computer-readable storage medium storing computer program instructions that, when run by a processor, cause the processor to execute the steps in the authentication method of the identity authentication center according to various embodiments of the present invention described above.
[0056] The above are only the preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included within the scope of protection of the present invention.
Claims
1. An authentication method for an identity authentication center, characterized in that, Including: Defining the authentication logic of the identity authentication plugin based on the interface specification of the pre-established identity authentication plugin; wherein, the authentication logic includes at least one of password authentication, biometric authentication, and hardware token authentication; Configuring the plugin information of the identity authentication plugin based on the authentication logic of the identity authentication plugin; wherein, the identity authentication plugin is deployed in the form of an application add-on package; When the management end is started, scan the path of the add-on package, read the plugin information of the identity authentication plugin, and register the identity authentication plugin in the identity authentication center to complete the integration of the identity authentication center and the identity authentication plugin; Authenticate the user identity through the identity authentication plugin integrated in the identity authentication center.
2. The authentication method of the identity authentication center according to claim 1, characterized in that, The interface specification of the pre-established identity authentication plugin includes: an authentication request processing interface, an authentication logic execution interface, and an authentication result return interface; The authentication request processing interface is used to define the authentication request processing method implemented by the plugin; wherein, the authentication request processing method includes receiving the authentication request and verifying the validity of the request; The authentication logic execution interface is used to define the method for executing the authentication logic; wherein, the method of the authentication logic includes at least one of the logic methods of password authentication, biometric authentication, and hardware token authentication; The authentication result return interface is used to define the method for returning the authentication result; wherein, the method for returning the authentication result includes the status and information of successful authentication and the status and information of failed authentication.
3. The authentication method of the identity authentication center according to claim 1, characterized in that The authentication method of the identity authentication center further includes: Configuring a plugin repository; Put the identity authentication plugin online to the plugin repository, so that without stopping or restarting the authentication service of the identity authentication center, scan the path of the add-on package, read the plugin information of the identity authentication plugin, and register the identity authentication plugin in the identity authentication center to complete the integration of the identity authentication center and the identity authentication plugin.
4. The authentication method of the identity authentication center according to claim 1, characterized in that, The authentication method of the identity authentication center further includes: When the identity authentication plugin in the identity authentication center has not been used within a preset time range, uninstall the identity authentication plugin that has not been used within the preset time range; or When the number of uses of the identity authentication plugin in the identity authentication center within a preset time range is less than or equal to a preset number of times, uninstall the identity authentication plugin whose number of uses within the preset time range is less than or equal to the preset number of times.
5. The authentication method of the identity authentication center according to claim 1, wherein, The authentication method of the identity authentication center further includes: Configuring different user roles; wherein, the user roles include at least one of operation and maintenance personnel, auditors, and implementers; Associating an identity authentication plugin with each user role; wherein, each user role is associated with the authentication logic of one or more identity authentication plugins.
6. The authentication method of the identity authentication center according to claim 5, characterized in that, Authenticating the user identity through the identity authentication plugin integrated in the identity authentication center includes: Authenticating the user identity through the corresponding identity authentication plugin integrated in the identity authentication center according to the user role and the identity authentication plugin associated with the user role.
7. The authentication method of the identity authentication center according to claim 5, characterized in that, The authentication method of the identity authentication center further includes: Setting the authentication logic for secondary authentication for different user roles according to different applications; Authenticate the user identity through the identity authentication plug-in integrated in the identity authentication center, including: When the user logs in to the corresponding application, authenticate the user identity by associating the authentication logics of one or more of the identity authentication plug-ins and the authentication logic of secondary authentication.
8. The authentication method of the identity authentication center according to claim 1, characterized in that, When the management terminal is started, scan the path of the external program package, read the plug-in information of the identity authentication plug-in, and register the identity authentication plug-in in the identity authentication center to complete the integration of the identity authentication center and the identity authentication plug-in, including: When the management terminal is started, scan the path of the external program package, read the plug-in information of the identity authentication plug-in, and register the identity authentication plug-in in the identity authentication center; Review the plug-in information and registration information of the identity authentication plug-in; When the plug-in information and registration information of the identity authentication plug-in pass the review, the identity authentication plug-in obtains the usage permission in the identity authentication center.
9. The authentication method of the identity authentication center according to claim 1, characterized in that The authentication method of the identity authentication center further includes: When an exception occurs during the loading or execution of the identity authentication plug-in, send an exception prompt to the identity authentication plug-in with the exception; and Based on the exception handling mechanism of the identity authentication center, perform exception handling on the identity authentication plug-in with the exception.
10. An authentication device of an identity authentication center, characterized in that, Including: A definition module for defining the authentication logic of the identity authentication plug-in based on the interface specification of the identity authentication plug-in formulated in advance; wherein, the authentication logic includes at least one of password authentication, biometric authentication, and hardware token authentication; A configuration module for configuring the plug-in information of the identity authentication plug-in based on the authentication logic of the identity authentication plug-in; wherein, the identity authentication plug-in is deployed in the form of an application external program package; An integration module for scanning the path of the external program package, reading the plug-in information of the identity authentication plug-in, and registering the identity authentication plug-in in the identity authentication center when the management terminal is started to complete the integration of the identity authentication center and the identity authentication plug-in; An authentication module for authenticating the user identity through the identity authentication plug-in integrated in the identity authentication center.