Login method, device and electronic equipment of overseas oil and gas operation system

Abstract

The application relates to the technical field of IT and system login, and provides a login method, device and electronic equipment of an overseas oil and gas operation system. The method is executed in any target data service in the overseas oil and gas operation system, and the method comprises the following steps: obtaining a first character sequence input by an enterprise user when the enterprise user requests to log in the target data service, the target data service does not save the first character sequence, and the first character sequences of all the enterprise users are different from each other; performing mapping processing on the first character sequence through a preset mapping algorithm to obtain first verification information; verifying whether the enterprise user is legal based on the first verification information and first comparison information reserved in the target data service; if the enterprise user is legal, the enterprise user is allowed to log in the target data service; and if the enterprise user is not legal, the enterprise user is refused to log in the target data service. The application can improve the security of user information in the overseas oil and gas operation system.

Description

Technical Field

[0001] This application relates to the field of IT and system login technology, and more specifically, to a login method, apparatus and electronic equipment for an overseas oil and gas operation system. Background Technology

[0002] With the continuous advancement of globalization, more and more companies are developing and operating oil and gas resources overseas. Against this backdrop, companies urgently need a secure and reliable operating system to manage their overseas oil and gas operations. Overseas oil and gas operation systems help enterprise users effectively manage and monitor their operations by providing system services for various business types (such as material procurement, inventory management, production management, human resource management, and financial management). However, due to the complexity of overseas oil and gas operation systems and the large number and wide distribution of enterprise users, ensuring the security of enterprise user login information has become a significant technical challenge.

[0003] In the current technological environment, traditional system login verification methods mainly rely on simple password verification mechanisms. However, these methods have certain security vulnerabilities, such as susceptibility to brute-force attacks, computer viruses, and hacker attacks. Therefore, improving the security of user information in overseas oil and gas operation systems is an urgent technical problem to be solved. Summary of the Invention

[0004] The embodiments of this application provide a login method, apparatus, computer program product or computer program, computer-readable storage medium and electronic device for an overseas oil and gas operation system, which can at least to some extent improve the security of user information in the overseas oil and gas operation system.

[0005] Other features and advantages of this application will become apparent from the following detailed description, or may be learned in part by practice of this application.

[0006] According to one aspect of the embodiments of this application, a login method for an overseas oil and gas operation system is provided. The overseas oil and gas operation system includes multiple data services. The method is executed on a target data service, which is any one of the data services in the overseas oil and gas operation system. The method includes: obtaining a first character sequence entered by an enterprise user when requesting to log in to the target data service, wherein the target data service does not store the first character sequence, and the first character sequences of each enterprise user are different; mapping the first character sequence using a preset mapping algorithm to obtain first verification information; verifying whether the enterprise user is legitimate based on the first verification information and first comparison information reserved in the target data service; if the enterprise user is legitimate, allowing the enterprise user to log in to the target data service; if the enterprise user is illegitimate, refusing the enterprise user to log in to the target data service.

[0007] In some embodiments of this application, based on the foregoing scheme, obtaining the first character sequence entered by the enterprise user when requesting to log in to the target data service includes: obtaining encrypted data sent by the terminal where the enterprise user is located, wherein the encrypted data is the data after the first character sequence has been encrypted using the public key of the target data service; and decrypting the encrypted data based on the private key of the target data service to obtain the first character sequence.

[0008] In some embodiments of this application, based on the foregoing scheme, the mapping algorithm includes at least two independent mapping sub-algorithms, each of which is independently isolated within a container in the target data service. The step of mapping the first character sequence using a preset mapping algorithm to obtain the first verification information includes: mapping the character sequences at preset positions in the first character sequence using the at least two mapping sub-algorithms to obtain at least two verification sub-information; and determining the first verification information based on the at least two verification sub-information.

[0009] In some embodiments of this application, based on the foregoing scheme, verifying whether the enterprise user is legitimate based on the first verification information and the first comparison information reserved in the target data service includes: if the first verification information and the first comparison information reserved in the target data service are consistent, then the enterprise user is determined to be legitimate; if the first verification information and the first comparison information reserved in the target data service are inconsistent, then the enterprise user is determined to be illegitimate.

[0010] In some embodiments of this application, based on the aforementioned scheme, the first comparison information includes comparison sub-information corresponding to each mapping sub-algorithm. The step of verifying whether the enterprise user is legitimate based on the first verification information and the first comparison information reserved in the target data service includes: if the number of matching verification sub-information in the first verification information and the comparison sub-information in the first comparison information is greater than or equal to a preset number, then the enterprise user is determined to be legitimate; if the number of matching verification sub-information in the first verification information and the comparison sub-information in the first comparison information is less than the preset number, then the enterprise user is determined to be illegitimate.

[0011] In some embodiments of this application, based on the foregoing scheme, before obtaining the first character sequence entered by the enterprise user when requesting to log in to the target data service, the method further includes: obtaining the communication time when the enterprise user establishes communication with the target data service, and the communication environment data of the enterprise user; if there is a broadcast event of other data services in the overseas oil and gas operation system on the communication environment data within a set time period before the communication time, then the enterprise user is directly allowed to log in to the target data service, and the broadcast event is triggered by the other data service when the enterprise user logs out.

[0012] In some embodiments of this application, based on the foregoing scheme, the overseas oil and gas operation system further includes a relay service. The relay service is used to connect the target data service and non-enterprise users. The relay service communicates with the target data service via an intranet, and communicates with the non-enterprise users via an extranet. The method further includes: when a non-enterprise user logs into the relay service, obtaining a second character sequence forwarded by the non-enterprise user, wherein the target data service does not store the second character sequence, and the second character sequences of each non-enterprise user are different; mapping the second character sequence using a preset mapping algorithm to obtain second verification information; verifying the legitimacy of the non-enterprise user based on the second verification information and the second comparison information reserved in the target data service; and sending the verification result to the relay service so that the relay service determines whether to allow the non-enterprise user to log into the relay service based on the verification result.

[0013] In some embodiments of this application, the mapping algorithm is asymmetric based on the foregoing scheme.

[0014] According to one aspect of the embodiments of this application, a login device for an overseas oil and gas operation system is provided. The overseas oil and gas operation system includes multiple data services, and the device is set on a target data service, which is any one of the data services in the overseas oil and gas operation system. The device includes: an acquisition unit, used to acquire a first character sequence entered by an enterprise user when requesting to log in to the target data service, wherein the target data service does not store the first character sequence, and the first character sequences of each enterprise user are different; a mapping unit, used to map the first character sequence using a preset mapping algorithm to obtain first verification information; and a verification unit, used to verify whether the enterprise user is legitimate based on the first verification information and first comparison information reserved in the target data service; if the enterprise user is legitimate, then the enterprise user is allowed to log in to the target data service; if the enterprise user is illegitimate, then the enterprise user is denied access to the target data service.

[0015] According to one aspect of the embodiments of this application, a computer program product or computer program is provided, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the methods described in the above embodiments.

[0016] According to one aspect of the embodiments of this application, a computer-readable storage medium is provided, on which a computer program is stored, which, when executed by a processor, implements the method described in the above embodiments.

[0017] According to one aspect of the embodiments of this application, an electronic device is provided, including: one or more processors; and a storage device for storing one or more programs, which, when executed by the one or more processors, cause the one or more processors to perform the method described in the above embodiments.

[0018] Based on the technical solution proposed in this application, the system obtains the first character sequence entered by the enterprise user and processes it using a mapping algorithm to generate first verification information. Then, this first verification information is compared with first comparison information stored in the target data service to verify the legitimacy of the enterprise user. The entire process ensures the security of user information and the reliability of the system. Specifically, when an enterprise user requests login, they enter the first character sequence. The target data service processes this sequence using a mapping algorithm to generate first verification information, which is then compared with the stored first comparison information. If the verification passes, login is allowed; otherwise, login is denied. This effectively solves the security risks of traditional password verification methods, which are susceptible to brute-force attacks and hacker attacks. Furthermore, the mapping algorithm, through its complex processing mechanism, improves the security of user information in overseas oil and gas operation systems, thereby enhancing the security of user login verification. In addition, the target data service does not store the enterprise user's first character sequence, further ensuring the security of user information in overseas oil and gas operation systems.

[0019] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0020] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application. It is obvious that the drawings described below are merely some embodiments of this application, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort. In the drawings:

[0021] Figure 1 A system architecture diagram of a blockchain-based overseas oil and gas operation system according to an embodiment of this application is shown;

[0022] Figure 2 A flowchart illustrating a login method for an overseas oil and gas operation system according to an embodiment of this application is shown;

[0023] Figure 3 A system architecture diagram of a blockchain-based overseas oil and gas operation system according to an embodiment of this application is shown;

[0024] Figure 4 A block diagram of a login device for an overseas oil and gas operation system according to an embodiment of this application is shown;

[0025] Figure 5 A schematic diagram of the structure of a computer system suitable for implementing the electronic device of the present application is shown. Detailed Implementation

[0026] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided to make this application more comprehensive and complete, and to fully convey the concept of the exemplary embodiments to those skilled in the art.

[0027] Furthermore, the described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. Numerous specific details are provided in the following description to give a thorough understanding of embodiments of this application. However, those skilled in the art will recognize that the technical solutions of this application can be practiced without one or more of the specific details, or other methods, components, apparatuses, steps, etc., can be employed. In other instances, well-known methods, apparatuses, implementations, or operations are not shown or described in detail to avoid obscuring various aspects of this application.

[0028] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0029] The flowcharts shown in the accompanying drawings are merely illustrative and do not necessarily include all content and operations / steps, nor do they necessarily have to be performed in the described order. For example, some operations / steps can be broken down, while others can be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0030] It should be noted that "multiple" in this article refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. The character " / " generally indicates that the preceding and following related objects have an "or" relationship.

[0031] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such uses of these terms can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described.

[0032] Currently, with an increasing number of companies developing and operating oil and gas resources overseas, there is an urgent need for a secure and reliable operating system to manage their overseas oil and gas operations. Overseas oil and gas operating systems help companies effectively manage and monitor their operations by providing system services across various business types (such as material procurement, inventory management, production management, human resource management, and financial management).

[0033] To enable those skilled in the art to better understand overseas oil and gas operation systems, this application combines Figure 1 A specific example illustrating an overseas oil and gas operation system is provided. Please refer to [link / reference]. Figure 1 The diagram illustrates a system architecture diagram of a blockchain-based overseas oil and gas operation system according to an embodiment of this application.

[0034] In this embodiment, the blockchain-based overseas oil and gas operation system may include multiple specialized business management platforms, each equipped with corresponding data services to manage business data in a specific area. For example... Figure 1 As shown, a blockchain-based overseas oil and gas operation system may include: a material procurement platform 110, an inventory management platform 120, a production management platform 130, a human resources management platform 140, and a financial management platform 150.

[0035] The material procurement platform 110 includes a procurement data service 111, configured to manage material procurement data in overseas oil and gas operation projects; the inventory management platform 120 includes an inventory data service 121, configured to manage material inventory data in overseas oil and gas operation projects; the production management platform 130 includes a production data service 131, configured to manage production data in overseas oil and gas operation projects; the human resources management platform 140 includes a human resources data service 141, configured to manage human resources data in overseas oil and gas operation projects; and the financial management platform 150 includes a financial data service 151, configured to manage financial data in overseas oil and gas operation projects. The procurement data service 111, inventory data service 121, production data service 131, human resources data service 141, and financial data service 151 communicate via a blockchain network to synchronize their respective business data generated in the oil and gas operation projects.

[0036] In practical application scenarios, the overseas oil and gas operation system proposed in this embodiment can be implemented in the China-Africa oilfield operation project of a multinational oil and gas company. In this project, the various business management platforms are interconnected through a blockchain network to form a unified data ecosystem.

[0037] Specifically, the materials procurement platform 110, in addition to procurement data services, may also include procurement demand nodes, procurement management nodes, procurement decision-making nodes, relay services, and supplier nodes (e.g., Figure 1 The processing nodes in the material procurement platform 110 shown can be terminal devices, and enterprise users can process material procurement data through these processing nodes.

[0038] Inventory management platforms can utilize mobile applications with barcode scanning capabilities. When materials are issued or removed from the warehouse, enterprise users can scan the barcodes using terminal devices (e.g., mobile applications with barcode scanning functionality). Figure 1 The inventory management platform 120 shown includes processing nodes, which can be terminal devices. Enterprise users can process material inventory data through these processing nodes and update the material inventory data in the inventory data service in real time. The platform supports multi-warehouse management, inventory alerts, and material allocation. When inventory changes, the relevant material inventory data can be immediately synchronized to the blockchain network.

[0039] The production management platform can use management software that integrates a real-time data acquisition module. Production data services can be directly connected to on-site production equipment nodes and production scheduling nodes (e.g., ...). Figure 1 The production management platform 130 shown contains processing nodes (which can be terminal devices, allowing enterprise users to process production data). The platform includes functions such as production planning, equipment monitoring, and output statistics. The production data service records key data generated during the production process and synchronizes it to the blockchain network.

[0040] The HR management platform can utilize multilingual HR management software to meet the needs of multinational projects. The HR management platform can include nodes for employee information management, attendance management, and performance evaluation (e.g., ...). Figure 1 The processing nodes in the human resources management platform 140 shown can be terminal devices. Enterprise users can process human resources data through these processing nodes. Changes to important employee-related information can be synchronized to other relevant management platforms through the blockchain network.

[0041] The financial management platform can utilize accounting software compliant with international accounting standards and supports multi-currency accounting. The platform includes functions such as budget management, cost accounting, and financial statement generation. Enterprise users can access the platform via terminal devices (e.g., ...). Figure 1 The processing nodes in the financial management platform 150 shown can be terminal devices. Enterprise users can process financial data through these processing nodes. The financial data entered or updated can be synchronized in real time through the blockchain network to ensure that the financial data used by other business management platforms meets the consistency requirements.

[0042] In this embodiment, the blockchain network can be built on a consortium blockchain based on Ethereum or Hyperledger. Each communication node in the blockchain network can be deployed on the data services of various business management platforms within the overseas oil and gas operation system. These data services communicate with each other through the blockchain network, enabling efficient synchronization of different types of business data. For example, when the materials procurement platform generates a new purchase order, the order information is synchronized in real time to other business management platforms, such as the inventory management platform and the financial management platform, via the blockchain network. In this way, this implementation method effectively solves the data synchronization problem in overseas oil and gas operation projects, ensuring cross-platform data consistency and real-time performance, improving the operational efficiency of overseas oil and gas operation projects, reducing management costs, and providing reliable data support for project decision-making.

[0043] The overseas oil and gas operation system proposed in this embodiment, by employing blockchain technology, can also solve the data security and trustworthiness issues in traditional solutions. Specifically, the immutability of blockchain ensures data integrity, while its decentralized structure reduces the risk of single points of failure. Furthermore, the transparency of blockchain makes the flow of different business data within the overseas oil and gas operation system traceable, contributing to improved auditability.

[0044] Currently, due to the complexity of overseas oil and gas operation systems and the large number and wide distribution of enterprise users, ensuring the security of enterprise user login information has become a significant technical challenge. In the current technological environment, traditional system login verification methods mainly rely on simple account and password verification mechanisms. However, these methods have certain security vulnerabilities, such as susceptibility to brute-force attacks, computer viruses, and hacker attacks. Therefore, this application proposes a login method for overseas oil and gas operation systems to improve the security of user information in these systems.

[0045] The implementation details of the technical solutions in the embodiments of this application are described in detail below:

[0046] Reference Figure 2 The diagram illustrates a flowchart of a login method for an overseas oil and gas operation system according to an embodiment of this application. The overseas oil and gas operation system may include multiple data services, and the method is executed on a target data service (i.e., a device with computing processing capabilities), wherein the target data service is any one of the data services within the overseas oil and gas operation system.

[0047] like Figure 2 As shown, the login method for this overseas oil and gas operation system includes at least steps 210 to 240, which are detailed below:

[0048] In step 210, the first character sequence entered by the enterprise user when requesting to log in to the target data service is obtained. The target data service does not save the first character sequence, and the first character sequences of each enterprise user are different.

[0049] In this application, when a user requests to log in to the target data service, they only need to enter a first character sequence on their terminal device. This first character sequence is not only a key identifier of the user's identity but also the user's private information, which can be used to verify the legitimacy of the user's identity. Unlike traditional login methods, users only need to enter a first character sequence without needing to enter complex usernames or passwords, thus simplifying the login process and improving the user experience. The first character sequence can be a set of characters selected by the user, which may be a phrase, a combination of the first letters of a word, or other short information, such as "userA123". Due to the privacy of this character sequence, only the enterprise user knows it, thus reducing the risk of it being guessed or stolen by others.

[0050] Furthermore, the target data service does not save the first character sequence entered by the user after obtaining it. In this way, even if the target data service suffers a data breach, attackers cannot obtain the user's first character sequence, thus protecting user privacy and improving the security of user information in overseas oil and gas operation systems.

[0051] Furthermore, to ensure security, each enterprise user's first character sequence is unique. Specifically, this is achieved during user registration. When an enterprise user determines their first character sequence during registration, it can be checked whether that first character sequence has already been used by another enterprise user, thus ensuring that each enterprise user's first character sequence is unique. This uniqueness not only helps prevent user identity conflicts but also reduces potential security risks.

[0052] In summary, the privacy and uniqueness of the first character sequence make it an effective authentication mechanism. This ensures that only legitimate enterprise users can access the target data services, while also reducing the burden on enterprise users to remember complex passwords. Therefore, this solution improves both security and user experience, making the login process simpler and more efficient for enterprise users.

[0053] Continue to refer to Figure 2 In step 220, the first character sequence is mapped using a preset mapping algorithm to obtain the first verification information.

[0054] In this application, the first character sequence entered by the user can be deleted after being processed by a mapping algorithm. Simultaneously, the first verification information obtained after the mapping algorithm processing is significantly different in form from the original entered first character sequence. Thus, the information used to verify the legitimacy of the user's identity is the first verification information, rather than the first character sequence, thereby preventing the user-entered first character sequence from being exposed for extended periods in the target data service and improving the security of user information in overseas oil and gas operation systems.

[0055] In this application, the mapping algorithm can be symmetric. Specifically, the mapping algorithm can deduce the first character sequence into the first verification information, and simultaneously deduce the first verification information back into the first character sequence. This bidirectional mapping mechanism not only improves the flexibility of enterprise user authentication but also ensures the security and reliability of enterprise users during the login process to target data services. Even if the first verification information is leaked, attackers cannot easily obtain the first character sequence entered by the user unless the detailed information of the mapping algorithm is leaked.

[0056] In this application, the mapping algorithm can also be asymmetric. Specifically, through the mapping algorithm, the first character sequence can be mapped to the first verification information, but the first verification information cannot be reverse-engineered to obtain the first character sequence. That is, when performing the mapping processing of the first character sequence, the mapping process and the reverse mapping process are not symmetrical. In this way, it can effectively prevent attackers from inferring the original first character sequence entered by the enterprise user through reverse engineering.

[0057] In this application, the asymmetric mapping algorithm can be a one-way hash function, such as the SHA-256 algorithm. By introducing an asymmetric mapping algorithm, the security of user login information in overseas oil and gas operation systems can be significantly improved. Even in the face of threats such as brute-force attacks, computer viruses, and hacker attacks, the asymmetric mapping algorithm can provide higher security guarantees because even if an attacker obtains the first verification information and the detailed information of the mapping algorithm, they cannot obtain the original first character sequence entered by the enterprise user, thereby effectively protecting the security of the enterprise user's login information.

[0058] Continue to refer to Figure 2 In step 230, the legitimacy of the enterprise user is verified based on the first verification information and the first comparison information reserved in the target data service.

[0059] In this application, after obtaining the first character sequence entered by the enterprise user to represent their identity information and generating the first verification information, the target data service compares it with the first comparison information to verify whether the enterprise user is legitimate. It should be noted that the first comparison information can be pre-stored in the target data service; specifically, it can be generated and stored in the target data service when the enterprise user registers with the target data service.

[0060] In this application, the mapping algorithm can be updated periodically or non-periodically. In practical applications, it is used as follows: Figure 1 For example, the administrator managing personnel data can change the mapping algorithm in personnel data service 141 and synchronize the changed mapping algorithm to other business data services in the overseas oil and gas operation system through blockchain network 100. It is understood that when the mapping algorithm is updated, the first reference information in each business data service will also be updated synchronously. In this way, the negative impact of an attack on the mapping algorithm can be reduced, thereby improving the security of user login verification.

[0061] Continue to refer to Figure 2 In step 240, if the enterprise user is legitimate, the enterprise user is allowed to log in to the target data service; if the enterprise user is illegitimate, the enterprise user is denied access to the target data service.

[0062] In this application, by comparing the first verification information entered by the enterprise user with the first comparison information stored in the target data service, if the two match, the legitimacy of the enterprise user can be confirmed, and the enterprise user can be allowed to log in to the target data service and access the business data in the target data service; otherwise, if the two do not match, it indicates that the legitimacy of the enterprise user has not been confirmed, and the target data service will reject the enterprise user's login request.

[0063] To enable those in the field to better understand this application, the following will be combined with Figure 3 The following is an illustration using a specific example.

[0064] See Figure 3 The diagram illustrates a system architecture diagram of a blockchain-based overseas oil and gas operation system according to an embodiment of this application.

[0065] For example, such as Figure 3As shown, in an overseas oil and gas operation system, enterprise user A, who manages material procurement data, enters their first character sequence at the procurement demand node 1111, procurement management node 1112, or procurement decision node 1113 of the material procurement platform to request login to the procurement data service 111. The first character sequence is: "userA123". After obtaining "userA123", the procurement data service 111 can generate the following hash value (hypothetically) using the SHA-256 algorithm (i.e., a one-way hash function), and use this hash value as the first verification information.

[0066] "a3c6c3d7d0b2e1b9c2a5c4b6c5e9d5a5e7b4c8f2f5d8e1e8a6a9c3c6b2d4e9e1".

[0067] Furthermore, if the first verification information matches the first comparison information reserved in the procurement data service 111, then enterprise user A is determined to be legitimate, and enterprise user A is allowed to log in to the procurement data service 111.

[0068] For example, such as Figure 3 As shown, in an overseas oil and gas operation system, enterprise user B, who manages material inventory data, enters their first character sequence at the inventory management node 1211 of the material inventory platform to request login to the inventory data service 121. The first character sequence is: "userB123". After obtaining "userB123", the inventory data service 121 can generate the following hash value (hypothetically) using the SHA-256 algorithm (i.e., a one-way hash function), and use this hash value as the first verification information.

[0069] "9f5b8a8b4c3a6c6f8b5e5d6e8e6b1c8c6f9f8c8a6f8b5e5d6e8e6b1c8c6f9f8c8".

[0070] Furthermore, if the first verification information does not match the first comparison information reserved in the inventory data service 121, then enterprise user B is determined to be illegitimate and will not be allowed to log in to the inventory data service 121.

[0071] Based on the technical solution proposed in this application, the system obtains the first character sequence entered by the enterprise user and processes it using a mapping algorithm to generate first verification information. Then, this first verification information is compared with first comparison information stored in the target data service to verify the legitimacy of the enterprise user. The entire process ensures the security of user information and the reliability of the system. Specifically, when an enterprise user requests login, they enter the first character sequence. The target data service processes this sequence using a mapping algorithm to generate first verification information, which is then compared with the stored first comparison information. If the verification passes, login is allowed; otherwise, login is denied. This effectively solves the security risks of traditional password verification methods, which are susceptible to brute-force attacks and hacker attacks. Furthermore, the mapping algorithm, through its complex processing mechanism, improves the security of user information in overseas oil and gas operation systems, thereby enhancing the security of user login verification. In addition, the target data service does not store the enterprise user's first character sequence, further ensuring the security of user information in overseas oil and gas operation systems.

[0072] Next, this application will address the above. Figure 2 Further explanation will be provided for each step in the process.

[0073] In this application, obtaining the first character sequence entered by the enterprise user when requesting to log in to the target data service can be performed according to the following steps 211 to 212:

[0074] Step 211: Obtain encrypted data sent by the terminal where the enterprise user is located. The encrypted data is the data after the first character sequence has been encrypted using the public key of the target data service.

[0075] Step 212: Decrypt the encrypted data based on the private key of the target data service to obtain the first character sequence.

[0076] In this application, when an enterprise user enters login information for logging into a target data service on a terminal device, the target data service can encrypt this information (i.e., the first character sequence). Specifically, the key used in the encryption process can be the public key of the target data service. In this way, even if the first character sequence is intercepted during transmission, an attacker cannot easily obtain the first character sequence.

[0077] For example, if a user inputs the first character sequence "userA123", the terminal device can encrypt it using the target data service's public key before sending it to the target data service. This generates seemingly random encrypted data, which is then sent to the target data service to ensure the security of the first character sequence during transmission. Next, upon receiving the encrypted data, the target data service uses its private key to decrypt it. The private key is paired with the public key, and only the target data service can use it. By decrypting the encrypted data, the target data service can recover the first character sequence input by the user. In this example, the target data service can decrypt the previously encrypted "userA123" using its private key, thus obtaining the original first character sequence input by the user.

[0078] In this application, the mechanism of public key encryption and private key decryption can effectively prevent the first character sequence from being illegally intercepted or tampered with, enabling the target data service to securely obtain the first character sequence entered by the enterprise user when logging in, ensuring that only authorized enterprise users can access the resources of the target data service, thereby improving the security of user information in overseas oil and gas operation systems.

[0079] In this application, the number of mapping algorithms may include only one. For example, it may only include the SHA-256 algorithm (i.e., a one-way hash function) in the above embodiments.

[0080] In this application, the number of mapping algorithms may also include multiple algorithms. Specifically, it may include at least two independent mapping sub-algorithms. In this case, as in... Figure 1 In step 220, the first character sequence is mapped using a preset mapping algorithm to obtain the first verification information. This can be performed according to steps 221 to 222 as follows:

[0081] Step 221: Using the at least two mapping sub-algorithms, the character sequences at preset positions in the first character sequence are mapped to obtain at least two verification sub-information.

[0082] Step 222: Determine the first verification information based on the at least two verification sub-information.

[0083] It should be noted that, in this application, the at least two mapping algorithms can be identical, such as all being symmetric mapping algorithms, or all being asymmetric mapping algorithms; they can also be completely different, such as all being asymmetric and completely different mapping algorithms; or they can be partially identical and partially different. Specifically, this application does not impose further limitations in this regard.

[0084] It should also be noted that, in this application, the preset positions corresponding to each mapping sub-algorithm can be the same; they can be completely different; or they can be partially the same and partially different. Specifically, this application does not impose any further restrictions on this.

[0085] In this application, to enable those skilled in the art to better understand step 221 above, a specific embodiment will be described below.

[0086] In one specific embodiment, the mapping algorithm includes three distinct mapping sub-algorithms, namely... F 1( x ), F 2( x ), F 3( x ), where the mapper algorithm F 1( x The corresponding preset position is: the first to the third character in the first character sequence; Mapper algorithm F 2 ( x The corresponding preset position is: the 4th to 6th characters in the first character sequence; Mapper Algorithm F 3 ( x The corresponding preset position is from the 7th character to the last character in the first character sequence.

[0087] Assuming the first character sequence is "userA123", then the character sequences at preset positions in the first character sequence are mapped using at least two mapping sub-algorithms, i.e., respectively through... F 1( x ), F 2( x ), F 3( x The character sequences “use”, “rA1”, and “23” are mapped to obtain three verification sub-information, which are as follows: F 1 (use), F 2(rA1), F 3(23).

[0088] In another specific embodiment, the mapping algorithm includes three identical mapping sub-algorithms, namely F 1( x ), F 1( x ), F 1( x ), where the mapper algorithm F 1( x The corresponding preset position is: the first to the third character in the first character sequence; Mapper algorithmF 1( x The corresponding preset position is: the 4th to 6th characters in the first character sequence; Mapper Algorithm F 1( x The corresponding preset position is from the 7th character to the last character in the first character sequence.

[0089] Assuming the first character sequence is "userA123", then the character sequences at preset positions in the first character sequence are mapped using at least two mapping sub-algorithms, i.e., respectively through... F 1( x ), F 1( x ), F 1( x The character sequences “use”, “rA1”, and “23” are mapped to obtain three verification sub-information, which are as follows: F 1 (use), F 1(rA1), F 1(23).

[0090] In another specific embodiment, the mapping algorithm includes four distinct mapping sub-algorithms, namely F 1( x ), F 2( x ), F 3( x ), F 3( x ), where the mapper algorithm F 1( x The corresponding preset position is: all characters in the first character sequence; Mapper algorithm F 2 ( x The corresponding preset position is: all characters in the first character sequence; Mapper algorithm F 3( x The corresponding preset position is: all characters in the first character sequence; Mapper algorithm F 4( x The preset position corresponding to ) is: all characters in the first character sequence.

[0091] Assuming the first character sequence is "userA123", then the character sequences at preset positions in the first character sequence are mapped using at least two mapping sub-algorithms, i.e., respectively through... F 1( x ), F 2( x ), F 3( x), F 4( x The character sequence "userA123", "userA123", "userA123", "userA123" is mapped to obtain four verification sub-information, which are as follows: F 1(userA123), F 2(userA123), F 3(userA123), F 4(userA123).

[0092] In this application, based on the technical solution of step 221 above, when the characters at the preset positions corresponding to each mapping sub-algorithm are partial characters in the first character sequence, and each mapping sub-algorithm is a symmetric algorithm, if a certain mapping sub-algorithm is leaked or attacked by an attacker, the attacker can only crack a partial character in the first character sequence based on that mapping sub-algorithm and its corresponding verification sub-information, but cannot crack the entire character sequence and its arrangement order. This multi-layered protection measure can effectively limit the attacker's ability to obtain the complete first character sequence, especially in overseas oil and gas operation systems, and can significantly reduce the risk of leakage of sensitive information of enterprise users. Therefore, it not only enhances the flexibility and accuracy of information processing, but also improves the security of user information in overseas oil and gas operation systems.

[0093] Furthermore, in this application, each mapping sub-algorithm can be independently isolated within a container of the target data service. Specifically,

[0094] By placing each mapper algorithm in a separate container, the following security enhancements can be achieved:

[0095] Isolation: Each mapping algorithm runs in an independent environment. Even if an attacker successfully compromises one container, they cannot directly access the mapping algorithms in other containers. This isolation effectively limits the scope of the attack and reduces the risk of the overall mapping algorithm being compromised.

[0096] Dynamic deployment: Containerization technology allows for the dynamic deployment and updating of mapping sub-algorithms, enabling rapid patching of vulnerabilities or replacement of affected algorithms without impacting the operation of the entire target data service. This flexibility allows the target data service to better cope with potential security threats.

[0097] Resource limitations: Containers can be configured with resource limits, such as CPU and memory usage, further restricting the operations an attacker can perform. These limitations make it more challenging for attackers attempting to crack the mapper algorithm.

[0098] Monitoring and Auditing: Isolated container environments make monitoring and auditing much easier, allowing for the timely detection of anomalous behavior or signs of attack. This monitoring capability facilitates rapid response to security incidents, further enhancing the security of targeted data services.

[0099] Overall, by isolating each mapping algorithm independently within a container, it is possible to effectively increase the difficulty for attackers to compromise the mapping algorithms, thereby enhancing the overall security of the target data service for authenticating logged-in users and protecting the privacy and integrity of user information.

[0100] In step 222 above, determining the first verification information based on the at least two verification sub-information can be achieved by concatenating the at least two verification sub-information and using the concatenated character sequence as the first verification information; or it can be achieved by directly using the at least two verification sub-information as the first verification information. Specifically, this application does not impose further limitations on this approach.

[0101] In this application, the verification of the legitimacy of the enterprise user based on the first verification information and the first comparison information reserved in the target data service can be performed according to the following steps 231 to 232:

[0102] Step 231: If the first verification information matches the first comparison information reserved in the target data service, then the enterprise user is determined to be legitimate.

[0103] Step 232: If the first verification information and the first comparison information reserved in the target data service are inconsistent, the enterprise user is determined to be illegitimate.

[0104] In this application, verifying the legitimacy of enterprise users based on first verification information and first comparison information stored in the target data service effectively improves the accuracy and security of user authentication. For example, the target data service can compare the first verification information with the stored first comparison information. If they match, the target data service can determine that the enterprise user is a legitimate user, allowing them to log in successfully and access data resources in the target data service. However, if the first verification information submitted by the enterprise user does not match the stored first comparison information, the target data service will determine that the user is an illegitimate user and reject their access request.

[0105] In this application, the aforementioned solution not only effectively prevents unauthorized access and reduces potential security risks, but also promptly identifies and responds to possible identity theft or fraud. The target data service, while ensuring the identity of enterprise users, also provides strong protection for their legitimacy, laying a solid foundation for the overall security of the target data service.

[0106] In this application, when the first verification information is the verification sub-information obtained by mapping each mapping sub-algorithm, the first comparison information includes the comparison sub-information corresponding to each mapping sub-algorithm.

[0107] Furthermore, the verification of the legitimacy of the enterprise user based on the first verification information and the first comparison information reserved in the target data service can be performed according to the following steps 233 to 234:

[0108] Step 233: If the number of identical verification sub-information in the first verification information and the number of identical comparison sub-information in the first comparison information is greater than or equal to a preset number, then the enterprise user is determined to be legitimate.

[0109] Step 234: If the number of identical verification sub-information in the first verification information and the number of identical comparison sub-information in the first comparison information is less than a preset number, then the enterprise user is determined to be illegitimate.

[0110] In this application, the first verification information consists of verification sub-information generated by each mapping sub-algorithm, while the first comparison information includes comparison sub-information corresponding to these mapping sub-algorithms. For example, suppose there are three mapping sub-algorithms. F 1( x ), F 2( x ) and F 3( x ), respectively generate corresponding verification sub-information F 1(a), F 2(b) and F 3(c). Meanwhile, the target data service reserves corresponding control sub-information A, B, and C. During verification, the target data service will compare the consistency between the verification sub-information and the control sub-information.

[0111] If during the verification process, F 1(a) is consistent with A. F 2(b) is consistent with B, while F If 3(c) is inconsistent with C, then the number of consistent values ​​is 2. Assuming the preset number is 2, since the number of consistent values ​​is greater than or equal to the preset number, the target data service will determine that the enterprise user is a legitimate user. Conversely, if... F 1(a) is consistent with A. F 2(b) is inconsistent with B, and F If 3(c) is inconsistent with C, the number of consistent values ​​is 1, which is lower than the preset number. The target data service will then determine that the enterprise user is an illegitimate user.

[0112] The advantage of the above scheme lies in its enhanced robustness of the target data service. Since each mapping algorithm is independent, if one mapping algorithm is attacked or malfunctions, the user's legitimacy can still be verified using the verification sub-information generated by the other mapping algorithms. Thus, even if some mapping algorithms are attacked, the target data service can still verify the user's identity normally, preventing the entire user login function from being paralyzed due to the failure of a single mapping algorithm. In this way, this multi-factor authentication mechanism not only enhances the security of the target data service but also improves the user experience, ensuring that users can successfully access the resources they need, thereby improving the reliability and stability of the target data service.

[0113] Furthermore, in this application, if there is a discrepancy between some verification sub-information in the first verification information and the corresponding comparison sub-information, it is possible to check whether the mapping algorithm has been tampered with, so as to change the mapping algorithm in each business data service of the overseas oil and gas operation system.

[0114] In this application, before obtaining the first character sequence entered by the enterprise user when requesting to log in to the target data service, the following steps 201 to 202 may also be performed:

[0115] Step 201: Obtain the communication time when the enterprise user establishes communication with the target data service, and the communication environment data of the enterprise user.

[0116] Step 202: If a broadcast event of other data services in the overseas oil and gas operation system broadcasting data about the communication environment exists within a set time period prior to the communication time, then the enterprise user is directly allowed to log in to the target data service. The broadcast event is triggered by the other data service when the enterprise user logs out.

[0117] In this application, the communication environment data may include the IP address of the enterprise user terminal device, may include the device code of the enterprise user terminal device, or may include both the IP address and the device code of the enterprise user terminal device. Specifically, this application does not impose excessive limitations on this.

[0118] In this application, before an enterprise user requests to log in to a target data service, the target data service first obtains the time and communication environment data of the communication established between the enterprise user and the target data service. The key to this process is that if, within a set time period, the target data service receives a broadcast event indicating that the enterprise user has logged in to other target data services, then the enterprise user can be directly allowed to log in to the target data service without additional authentication. This significantly improves the efficiency and experience of enterprise user login.

[0119] To enable those skilled in the art to better understand this application, the following is combined with Figure 1 Let's illustrate this with a specific example.

[0120] Taking enterprise user A as an example, such as Figure 1 As shown, when user A attempted to log in to the Procurement Target Data Service 111 at 10:10:10, the Target Data Service detected that at 10:10:01, the Inventory Data Service 121 had already broadcast the same device terminal information as user A (IP address: 192.168.1.100, device code: DEV-0012345678). This indicates that user A was logged in to the Inventory Data Service 121 before 10:10:01 and successfully logged out after this time (assuming the set duration is 20 seconds). Therefore, the Procurement Data Service 111 can reasonably infer that user A is a legitimate user and directly allow them to log in without requiring user A to re-enter the first character sequence.

[0121] This approach not only reduces the cumbersome login process for enterprise users when switching between different target data services, but also improves the response speed of target data services, reduces user login time, and optimizes the user experience. Enterprise users no longer need to repeatedly enter identity information, enabling them to access the required business data services more smoothly, thereby improving work efficiency. This method is particularly effective in scenarios requiring frequent switching between different target data services, significantly reducing the operational burden on enterprise users, making the overall business process smoother, and reducing the resource consumption of repeated verification of data services in overseas oil and gas operation systems.

[0122] It should be noted in this application that the set duration can be dynamically adjusted according to security needs and user habits. For example, the set duration can be shortened during periods of high user activity to improve the response speed of the target data service; the set duration can be extended during periods of low user activity.

[0123] In this application, it should also be noted that when an enterprise user logs out of the overseas oil and gas operation system, other data services may broadcast not only the communication environment data of the enterprise user's equipment terminal, but also the first comparison information corresponding to the enterprise user, so that when the enterprise user logs into the next data service, the first comparison information broadcast can be used to quickly determine the identity of the enterprise user.

[0124] In this application, the overseas oil and gas operation system may further include a relay service, which is used to connect the target data service and non-enterprise users. The relay service communicates with the target data service via an intranet, and communicates with the non-enterprise users via an extranet.

[0125] Furthermore, steps 251 to 254 can also be performed:

[0126] Step 251: When a non-enterprise user logs into the relay service, the second character sequence entered by the non-enterprise user is obtained and forwarded by the relay service. The target data service does not save the second character sequence, and the second character sequences of each non-enterprise user are different from each other.

[0127] Step 252: The second character sequence is mapped using a preset mapping algorithm to obtain the second verification information.

[0128] Step 253: Based on the second verification information and the second comparison information reserved in the target data service, verify whether the non-enterprise user is legitimate.

[0129] Step 254: Send the verification result to the relay service so that the relay service can determine whether to allow the non-enterprise user to log in to the relay service based on the verification result.

[0130] In this application, by introducing a relay service, the system can effectively connect data services with non-enterprise users and ensure data transmission security through intranet and extranet communication. When a non-enterprise user logs into the relay service, the relay service obtains and forwards the second character sequence entered by the non-enterprise user. The target data service does not store these character sequences, thus ensuring that each non-enterprise user's character sequence is unique. A preset mapping algorithm is used to map the second character sequence to obtain second verification information. Then, based on the second verification information and the second comparison information reserved in the target data service, the legitimacy of the non-enterprise user is verified. Finally, the verification result is sent to the relay service, allowing the relay service to determine whether to allow the non-enterprise user to log in based on the verification result.

[0131] In this application, to enable those skilled in the art to better understand the above content, the following is combined with... Figure 3 The following is an illustration using a specific example.

[0132] like Figure 3 As shown, when supplier node 1115 (i.e., a non-enterprise user) attempts to log in to the relay service 1114 of the procurement data service 111, the procurement data service 111 can obtain the second character sequence (e.g., "IuserA123") entered by supplier node 1115 and forwarded by the relay service 1114. It is important to emphasize that this second character sequence is not saved by the procurement data service 111, and each supplier node's second character sequence is unique to ensure information security.

[0133] Subsequently, the procurement data service 111 processes the second character sequence using a preset mapping algorithm to generate second verification information. Next, the procurement data service 111 compares this verification information with the second comparison information reserved within the procurement data service 111 to verify the legitimacy of the supplier node 1115. If the verification result is valid, the procurement data service 111 sends this verification result to the relay service 1114. The relay service 1114 can then determine whether to allow the supplier node 1115 to log in to the relay service 1114 based on the verification result, so that the supplier node 1115 can access the corresponding business data from the relay service 1114.

[0134] In practical applications, various methods can be used to ensure the security of communication between relay services and target data services, such as using encrypted communication protocols and setting up firewalls. Furthermore, the design of mapping algorithms can be diversified to improve the security and reliability of non-enterprise user identity verification.

[0135] In this application, the aforementioned scheme significantly enhances the security and flexibility of the target data service, as well as the security of non-enterprise user information within the target data service. Since the second character sequence is not stored in the target data service, the risk of potential leakage of non-enterprise user identity information is effectively reduced. Furthermore, the second character sequences of each non-enterprise user are unique, further improving the uniqueness and accuracy of non-enterprise user authentication. By connecting the relay service to the target data service via the internal network and to non-enterprise users via the external network, the target data service can effectively isolate internal and external communications, preventing external network attacks on overseas oil and gas operation systems and enhancing the overall network security of overseas oil and gas operation systems. Ultimately, this scheme not only improves the login security of non-enterprise users to the target data service but also provides a reliable authentication mechanism for the effective management of the target data service, ensuring the stability and sustainability of overseas oil and gas operation systems.

[0136] This application provides a login method for an overseas oil and gas operation system. It obtains the first character sequence entered by the enterprise user, processes it using a preset mapping algorithm to obtain first verification information, and compares this information with pre-reserved first comparison information to verify the user's legitimacy, thus achieving user login verification. This method does not directly store the user's login information; instead, it verifies through mapping algorithms and comparison information, significantly improving user information security and enhancing the anti-attack capability of the overseas oil and gas operation system. Furthermore, by introducing relay services and broadcast event mechanisms, it achieves differentiated processing for enterprise users and non-enterprise users, and improves system efficiency in frequent login scenarios. It offers advantages such as improved user information security, enhanced system anti-attack capability, and increased login efficiency.

[0137] The following describes an embodiment of the apparatus described in this application, which can be used to execute the login method for the overseas oil and gas operation system described in the above embodiments of this application. For details not disclosed in the apparatus embodiments of this application, please refer to the embodiments of the login method for the overseas oil and gas operation system described above.

[0138] Figure 4 A block diagram of a login device for an overseas oil and gas operation system according to an embodiment of this application is shown.

[0139] Reference Figure 4 As shown, the overseas oil and gas operation system includes multiple data services. The device is set on a target data service, which is any one of the data services in the overseas oil and gas operation system. According to an embodiment of this application, the login device 400 of the overseas oil and gas operation system includes an acquisition unit 401, a mapping unit 402, and a verification unit 403.

[0140] The acquisition unit 401 is used to acquire the first character sequence entered by the enterprise user when requesting to log in to the target data service. The target data service does not store the first character sequence, and the first character sequences of each enterprise user are different. The mapping unit 402 is used to map the first character sequence through a preset mapping algorithm to obtain first verification information. The verification unit 403 is used to verify whether the enterprise user is legitimate based on the first verification information and the first comparison information reserved in the target data service. If the enterprise user is legitimate, the enterprise user is allowed to log in to the target data service; if the enterprise user is illegitimate, the enterprise user is denied access to the target data service.

[0141] In some embodiments of this application, based on the foregoing scheme, the acquisition unit 401 is configured to: acquire encrypted data sent by the terminal where the enterprise user is located, wherein the encrypted data is the data after the first character sequence has been encrypted by the public key of the target data service; and decrypt the encrypted data based on the private key of the target data service to obtain the first character sequence.

[0142] In some embodiments of this application, based on the foregoing scheme, the mapping algorithm includes at least two independent mapping sub-algorithms, each of which is independently isolated within a container in the target data service. The mapping unit 402 is configured to: perform mapping processing on the character sequence at a preset position in the first character sequence through the at least two mapping sub-algorithms to obtain at least two verification sub-information; and determine the first verification information based on the at least two verification sub-information.

[0143] In some embodiments of this application, based on the foregoing scheme, the verification unit 403 is configured to: if the first verification information is consistent with the first comparison information reserved in the target data service, then the enterprise user is determined to be legitimate; if the first verification information is inconsistent with the first comparison information reserved in the target data service, then the enterprise user is determined to be illegitimate.

[0144] In some embodiments of this application, based on the foregoing scheme, the first comparison information includes comparison sub-information corresponding to each mapping sub-algorithm, and the verification unit 403 is configured to: if the number of times the verification sub-information in the first verification information matches the comparison sub-information in the first comparison information is greater than or equal to a preset number, then the enterprise user is determined to be legitimate; if the number of times the verification sub-information in the first verification information matches the comparison sub-information in the first comparison information is less than the preset number, then the enterprise user is determined to be illegitimate.

[0145] In some embodiments of this application, based on the foregoing scheme, the verification unit 403 is further configured to: before acquiring the first character sequence entered by the enterprise user when requesting to log in to the target data service, acquire the communication time when the enterprise user establishes communication with the target data service, and the communication environment data of the enterprise user; if there is a broadcast event of other data services in the overseas oil and gas operation system on the communication environment data within a set time before the communication time, then the enterprise user is directly allowed to log in to the target data service, and the broadcast event is triggered by the other data service when the enterprise user logs out.

[0146] In some embodiments of this application, based on the foregoing scheme, the overseas oil and gas operation system further includes a relay service. The relay service is used to connect the target data service and non-enterprise users. The relay service communicates with the target data service via an intranet, and communicates with the non-enterprise users via an extranet. The acquisition unit 401 is configured to: when a non-enterprise user logs into the relay service, acquire a second character sequence forwarded by the non-enterprise user and entered by the non-enterprise user. The target data service does not store the second character sequence, and the second character sequences of each non-enterprise user are different. The mapping unit 402 is configured to: perform mapping processing on the second character sequence using a preset mapping algorithm to obtain second verification information. The verification unit 403 is configured to: verify whether the non-enterprise user is legitimate based on the second verification information and the second comparison information reserved in the target data service; and send the verification result to the relay service so that the relay service can determine whether to allow the non-enterprise user to log into the relay service based on the verification result.

[0147] In some embodiments of this application, the mapping algorithm is asymmetric based on the foregoing scheme.

[0148] As another embodiment of this application, a computer program product or computer program is also provided, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the methods described in the above embodiments.

[0149] As another embodiment of this application, a computer-readable storage medium is also provided. This computer-readable storage medium may be included in the electronic device described in the above embodiments; or it may exist independently and not assembled into the electronic device. The aforementioned computer-readable storage medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to perform the methods described in the above embodiments.

[0150] Based on the same inventive concept, embodiments of this application also provide an electronic device. (Reference) Figure 5 The diagram shows a schematic of the structure of an electronic device according to an embodiment of this application. The electronic device includes one or more memories 504, one or more processors 502, and at least one computer program (program code) stored in the memory 504 and executable on the processor 502. When the processor 502 executes the computer program, it implements the method described above.

[0151] Among them, Figure 5 In this document, a bus architecture (represented by bus 500) is used. Bus 500 may include any number of interconnected buses and bridges, linking various circuits including one or more processors represented by processor 502 and memory represented by memory 504. Bus 500 may also link various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. Bus interface 505 provides an interface between bus 500 and receiver 501 and transmitter 503. Receiver 501 and transmitter 503 may be the same element, i.e., a transceiver, providing a unit for communicating with various other devices over a transmission medium. Processor 502 is responsible for managing bus 500 and general processing, while memory 504 can be used to store data used by processor 502 during operation.

[0152] The functions described herein may be implemented in hardware, software executed by a processor, firmware, or any combination thereof. If implemented in software executed by a processor, the functions may be stored as one or more instructions or codes on or transmitted via a computer-readable medium. Other examples and embodiments are within the scope and spirit of this application and the appended claims. For example, due to the nature of software, the functions described above may be implemented using software executed by a processor, hardware, firmware, hardwired, or any combination thereof. Furthermore, the functional units may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit.

[0153] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0154] The units described as separate components may or may not be physically separate. Similarly, the components of the control device may or may not be physical units; they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0155] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium, including instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0156] The above description is merely an embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A login method for an overseas oil and gas operation system, characterized in that, The overseas oil and gas operation system includes multiple data services. The method is executed on a target data service, which is any one of the data services in the overseas oil and gas operation system. The method includes: Obtain the first character sequence entered by the enterprise user when requesting to log in to the target data service. The target data service does not save the first character sequence, and the first character sequences of each enterprise user are different. At least two asymmetric and distinct mapping sub-algorithms are used to map the character sequences at preset positions in the first character sequence to obtain at least two verification sub-information. Each mapping sub-algorithm is independently isolated within a container in the target data service. Based on the at least two verification sub-information, first verification information is determined. The mapping sub-algorithms and their corresponding first verification information are updated periodically or non-periodically and synchronized to various data services in the overseas oil and gas operation system through a blockchain network. Based on the first verification information and the first comparison information reserved in the target data service, verify whether the enterprise user is legitimate; If the enterprise user is legitimate, then the enterprise user is allowed to log in to the target data service; if the enterprise user is illegitimate, then the enterprise user is denied access to the target data service. The step of obtaining the first character sequence entered by the enterprise user when requesting to log in to the target data service includes: obtaining encrypted data sent by the terminal where the enterprise user is located, wherein the encrypted data is the data after the first character sequence has been encrypted by the public key of the target data service; and decrypting the encrypted data based on the private key of the target data service to obtain the first character sequence.

2. The method according to claim 1, characterized in that, The first comparison information includes comparison sub-information corresponding to each mapping sub-algorithm. The step of verifying the legitimacy of the enterprise user based on the first verification information and the first comparison information reserved in the target data service includes: If the number of identical verification sub-information in the first verification information and the number of identical comparison sub-information in the first comparison information is greater than or equal to a preset number, then the enterprise user is determined to be legitimate. If the number of identical verification sub-information in the first verification information and the number of identical comparison sub-information in the first comparison information is less than a preset number, then the enterprise user is determined to be illegitimate.

3. The method according to claim 1, characterized in that, The step of verifying the legitimacy of the enterprise user based on the first verification information and the first comparison information reserved in the target data service includes: If the first verification information matches the first comparison information reserved in the target data service, then the enterprise user is determined to be legitimate; If the first verification information is inconsistent with the first comparison information reserved in the target data service, the enterprise user is determined to be illegitimate.

4. The method according to claim 1, characterized in that, Before obtaining the first character sequence entered by the enterprise user when requesting to log in to the target data service, the method further includes: Obtain the communication time when the enterprise user establishes communication with the target data service, and the communication environment data of the enterprise user; If, within a set time period prior to the communication time, another data service in the overseas oil and gas operation system broadcasts data about the communication environment, the enterprise user is directly allowed to log in to the target data service. The broadcast event is triggered by the other data service when the enterprise user logs out.

5. The method according to claim 1, characterized in that, The overseas oil and gas operation system further includes a relay service, which connects the target data service and non-enterprise users. The relay service communicates with the target data service via an intranet, and with the non-enterprise users via an extranet. The method further includes: When a non-enterprise user logs into the relay service, the second character sequence entered by the non-enterprise user is obtained and forwarded by the relay service. The target data service does not save the second character sequence, and the second character sequences of each non-enterprise user are different from each other. The second character sequence is mapped using a preset mapping algorithm to obtain the second verification information; Based on the second verification information and the second comparison information reserved in the target data service, verify whether the non-enterprise user is legitimate; The verification result is sent to the relay service so that the relay service can determine whether to allow the non-enterprise user to log in to the relay service based on the verification result.

6. A login device for an overseas oil and gas operation system, characterized in that, The overseas oil and gas operation system includes multiple data services. The device is installed at a target data service, which is any one of the data services in the overseas oil and gas operation system. The device includes: The acquisition unit is used to acquire the first character sequence entered by the enterprise user when requesting to log in to the target data service. The target data service does not save the first character sequence, and the first character sequences of each enterprise user are different. The mapping unit is used to map the character sequence at a preset position in the first character sequence using at least two asymmetric and distinct mapping sub-algorithms to obtain at least two verification sub-information. Each mapping sub-algorithm is independently isolated in a container in the target data service. Based on the at least two verification sub-information, a first verification information is determined. The mapping sub-algorithms and their corresponding first verification information are updated periodically or non-periodically and synchronized to various data services in the overseas oil and gas operation system through a blockchain network. The verification unit is used to verify whether the enterprise user is legitimate based on the first verification information and the first comparison information reserved in the target data service; if the enterprise user is legitimate, the enterprise user is allowed to log in to the target data service; if the enterprise user is illegitimate, the enterprise user is denied access to the target data service. The step of obtaining the first character sequence entered by the enterprise user when requesting to log in to the target data service includes: obtaining encrypted data sent by the terminal where the enterprise user is located, wherein the encrypted data is the data after the first character sequence has been encrypted by the public key of the target data service; and decrypting the encrypted data based on the private key of the target data service to obtain the first character sequence.

7. An electronic device, characterized in that, The electronic device includes one or more processors and one or more memories, wherein at least one piece of program code is stored in the one or more memories, and the at least one piece of program code is loaded and executed by the one or more processors to implement the method as claimed in any one of claims 1 to 5.

Images