Multi-platform client unified identity authentication and organization structure dynamic synchronization system and method

Abstract

The application relates to the technical field of cross-platform identity authentication, and particularly discloses a multi-platform client unified identity authentication and organization architecture dynamic synchronization system and method, which comprises the following modules: a strategy self-adaptive matching module for matching an optimal data transmission strategy; a third-party authorization authentication module for connecting a third-party authentication platform and triggering an authorization process, and obtaining authorized user information based on the received authorization code; a first authentication module for returning an authentication success feedback result when the authorized user information exists in the user information stored in the back end and the belonging architecture information is consistent with the belonging architecture information stored in the back end; otherwise, an architecture dynamic synchronization module returns an authentication failure feedback result, synchronously obtains dynamic variables of an enterprise organization architecture relationship network, and triggers permission propagation deduction to obtain a user permission update result; and a second authentication module for carrying out identity authentication on the user based on the user permission update result and a hybrid authentication mode; and the multi-platform client unified identity authentication and organization architecture real-time synchronization are realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of cross-platform identity authentication, and in particular to a multi-platform client unified identity authentication and organization architecture dynamic synchronization system and method. BACKGROUND

[0002] Currently, under the trend of digital office and information management, enterprises often use multiple platforms and clients to meet different business needs, covering project management, customer relationship management, office automation and other fields. Although this multi-platform client environment enriches business processing methods, it also brings complexity to identity authentication and organization architecture management. The multi-platform client unified identity authentication and organization architecture dynamic synchronization system is of great significance under this background. Unified identity authentication can provide users with a convenient one-stop login experience, improving work efficiency while enhancing security. Organization architecture dynamic synchronization ensures that real-time updates of enterprise organization architecture can be synchronized to each platform and client, so that permission allocation and business processes always match the actual organization. This helps enterprises achieve efficient internal management and promote collaboration and communication between departments. With the deepening of enterprise digital transformation, this system has broad application prospects in enterprises of all sizes and industries, and is expected to become a core component of enterprise digital management systems.

[0003] However, the existing system cannot accurately match the optimal data transmission strategy according to the network environment perception value and the user-selected third-party authentication method. In terms of identity authentication, it cannot achieve portable unified authentication of multiple clients and third-party platforms, resulting in cumbersome user operations. It also cannot perceive changes in the organization architecture of third-party platforms and synchronize them to multiple clients, so it cannot determine the consistency of multi-end organization architecture information. Ultimately, the inaccuracy of permission management due to cross-platform deviations in architecture information, combined with the lack of effective mechanisms for secondary identity authentication based on multiple authentication methods coexisting, cannot ensure the accuracy and reliability of the final authentication result, making it difficult to meet the increasingly complex digital office needs of enterprises.

[0004] Therefore, the present application proposes a multi-platform client unified identity authentication and organization architecture dynamic synchronization system and method. SUMMARY

[0005] The application provides a multi-platform client unified identity authentication and organizational architecture dynamic synchronization system and method. The system matches the optimal data transmission strategy according to the network environment perception value and the third-party authentication mode selected by the user through the strategy adaptive matching module, ensuring the efficiency and security of data transmission. The third-party authorization authentication module connects the third-party authentication platform through the preset authentication protocol, triggers the authorization process according to the client authentication mode, obtains the authorized user information using the optimal data transmission strategy, and realizes efficient authentication docking. When the authorized user information and the back-end stored information and the architecture information thereof are matched, the first authentication module returns an authentication success feedback to the client based on the optimal strategy. When the information is not matched, the architecture dynamic synchronization module returns an authentication failure feedback, obtains the dynamic variables of the enterprise organizational architecture, and triggers the right propagation deduction to update the user rights. The second authentication module performs identity authentication on the user based on the right update result and the hybrid authentication mode, and obtains the final authentication result. Through reasonable support for multiple coexisting authentication modes, the accuracy and flexibility of authentication are ensured, the dynamic synchronization of multi-platform client unified identity authentication and organizational architecture is realized, and comprehensive considerations are made on the synchronization opportunity, compatibility, security, reliability, and other aspects, so that the system can meet the increasingly complex digital office needs of enterprises.

[0006] The application provides a multi-platform client unified identity authentication and organizational architecture dynamic synchronization system, comprising:

[0007] A strategy adaptive matching module is used to match the optimal data transmission strategy based on the network environment perception value and the third-party authentication mode selected by the user.

[0008] A third-party authorization authentication module is used to connect the third-party authentication platform based on the preset authentication protocol, trigger the authorization process according to the authentication mode of the corresponding client, receive the authorization code of the third-party authentication platform under the corresponding authentication mode through the optimal data transmission strategy, and obtain the authorized user information based on the received authorization code.

[0009] A first authentication module is used to return an authentication success feedback result to the client based on the optimal data transmission strategy when it is determined that the authorized user information is in the user information stored in the back end and that the architecture information in the authorized user information is consistent with the architecture information of the corresponding user in the user information stored in the back end.

[0010] An architecture dynamic synchronization module is used to return an authentication failure feedback result to the client based on the optimal data transmission strategy when it is determined that the authorized user information is not in the user information stored in the back end or that the architecture information in the authorized user information is inconsistent with the architecture information of the corresponding user in the user information stored in the back end, and to synchronize the dynamic variables of the enterprise organizational architecture relationship network and trigger the right propagation deduction to obtain the right update result of the user.

[0011] The second authentication module is configured to perform identity authentication on the user based on the permission update result of the user and the hybrid authentication mode until a final authentication result is obtained.

[0012] Preferably, the policy adaptive matching module comprises:

[0013] The network environment perception submodule is configured to perceive in real time network environment features of each authentication request client simultaneously received by the backend at the current time, and calculate a network environment perception value of the current client based on the real-time network environment features;

[0014] The transmission policy screening submodule is configured to determine all matchable data transmission policies of each authentication request client based on the network environment perception value of each authentication request client simultaneously received by the backend at the current time;

[0015] The authentication busy degree evaluation submodule is configured to calculate a relative authentication busy degree of the current client under each matchable data transmission policy based on all matchable data transmission policies of all authentication request clients simultaneously received by the backend at the current time and authentication protocols corresponding to the selected third-party authentication modes;

[0016] The optimal transmission policy determination submodule is configured to take a matchable data transmission policy with the maximum relative authentication busy degree among all matchable data transmission policies of the current client as an optimal matchable data transmission policy of the current client.

[0017] Preferably, the authentication busy degree evaluation submodule comprises:

[0018] The resource consumption amplification coefficient determination unit is configured to determine resource consumption amplification coefficients of all resource types under each matchable data transmission policy;

[0019] The resource consumption coefficient determination unit is configured to take an average of resource consumption ratios in all authentication instances under an authentication protocol corresponding to each third-party authentication mode as a resource consumption coefficient of each resource type under the authentication protocol corresponding to the third-party authentication mode;

[0020] The resource occupation amount determination unit is configured to determine resource occupation amounts of all resource types under each matchable data transmission policy and an authentication protocol corresponding to the selected third-party authentication mode of each authentication request client simultaneously received by the backend at the current time based on the resource consumption amplification coefficients of all resource types under each matchable data transmission policy and the resource consumption coefficients under the authentication protocol corresponding to each third-party authentication mode;

[0021] a global resource pressure determination unit configured to normalize the sum of the resource occupation amounts of the same resource category under the same matchable data transmission strategy to the maximum resource occupation amount of the corresponding resource category, among all the matchable data transmission strategies of all the authentication request clients simultaneously received by the backend at the current time, and all the resource occupation amounts of all the resource categories under the corresponding authentication protocol corresponding to the selected third-party authentication mode, to obtain the global resource pressure of the corresponding resource category corresponding to the matchable data transmission strategy;

[0022] a relative authentication busy degree determination unit configured to determine the relative authentication busy degree of the current client under each matchable data transmission strategy based on the resource occupation amount of all the resource categories under the corresponding authentication protocol corresponding to each matchable data transmission strategy and the corresponding third-party authentication mode, and the global resource pressure of each resource category corresponding to the matchable data transmission strategy.

[0023] Preferably, the resource consumption amplification coefficient determination unit comprises:

[0024] a consumption value determination subunit configured to perform an idle running system test in an isolated environment, and record the basic resource consumption value of each resource category;

[0025] a resource consumption peak value determination subunit configured to record the resource consumption peak value of each resource category when each matchable data transmission strategy is separately enabled in the isolated environment to perform a preset number of typical authentication requests;

[0026] a resource consumption amplification coefficient determination subunit configured to take the ratio of the resource consumption peak value to the basic resource consumption value of each resource category when each matchable data transmission strategy is separately enabled in the isolated environment to perform a preset number of typical authentication requests as the resource consumption amplification coefficient of the corresponding resource category under each matchable data transmission strategy.

[0027] Preferably, the third-party authorization authentication module comprises:

[0028] a first authorization authentication sub-module configured to, when the client is a desktop terminal, connect to a third-party authentication platform based on a preset authentication protocol, pull up a local browser to request third-party authentication platform login, generate and display a login QR code, receive an authorization code after a user scans the code based on the optimal data transmission strategy, trigger an authorization process based on the authorization code, and call a backend authentication interface to obtain authorized user information;

[0029] a second authorization authentication sub-module configured to, when the client is a mobile terminal, connect to a third-party authentication platform based on a preset authentication protocol, pull up a third-party client to trigger an authorization process, receive a temporary authorization code based on the optimal data transmission strategy and send it to the backend, and call a backend authentication interface to obtain authorized user information.

[0030] Preferably, the architecture dynamic synchronization module comprises:

[0031] The authentication failure feedback submodule is configured to return an authentication failure feedback result to the client based on the optimal data transmission strategy when it is determined that the authorized user information is not in the user information stored in the backend or that the belonging architecture information in the authorized user information is inconsistent with the belonging architecture information of the corresponding user in the user information stored in the backend.

[0032] The architecture relationship variable acquisition submodule is configured to acquire a dynamic variable of the enterprise organizational architecture relationship network.

[0033] The permission update submodule is configured to perform permission propagation deduction based on the dynamic variable of the enterprise organizational architecture relationship network and the permission inheritance rule, and obtain a permission update result of the user.

[0034] Preferably, the second authentication module comprises:

[0035] The hybrid authentication step tree building submodule is configured to build a hybrid authentication step tree based on a multi-factor authentication system under a hybrid authentication mode.

[0036] The behavior risk assessment submodule is configured to assess the behavior risk of the user and obtain a behavior risk assessment value of the user.

[0037] The step tree interception submodule is configured to intercept an actual authentication step tree in the hybrid authentication step tree based on the permission update result and the behavior risk assessment value of the user.

[0038] The identity authentication submodule is configured to perform identity authentication on the user based on the actual authentication step tree until a final authentication result is obtained.

[0039] Preferably, the step tree interception submodule comprises:

[0040] The permission update amount determination unit is configured to determine a permission range relative update factor of all permission update items of the user based on the permission update result of the user, take a ratio of an original weight of each permission update item of the user to a sum of original weights of all permission update items of the user as a current weight of each permission update item of the user, and perform weighted addition on the permission range relative update factor of all permission update items of the user based on the current weights of all permission update items of the user to obtain a total permission relative update amount of the user.

[0041] The required authentication level range determination unit is configured to determine a current belonging node of the user in the enterprise organizational architecture relationship network based on the dynamic variable of the enterprise organizational architecture relationship network, and determine a current required authentication level range of the user based on the current belonging node of the user in the enterprise organizational architecture relationship network.

[0042] The first intercepting unit is configured to intercept a current required authentication step tree of each authentication level within a current required authentication level range of the user in the mixed authentication step tree based on a standard authentication step of each authentication level within the current required authentication level range of the user and a standard incremental step of each authentication level within the current required authentication level range of the user according to an amount of relative update of the total authority of the user.

[0043] The second intercepting unit is configured to intercept a second current required authentication step tree in the mixed authentication step tree based on the behavior risk assessment value.

[0044] The third intercepting unit is configured to intercept an actual authentication step tree in the mixed authentication step tree based on the current required authentication step tree of each authentication level within the current required authentication level range of the user and the second current required authentication step tree intercepted in the mixed authentication step tree.

[0045] Preferably, the third intercepting unit comprises:

[0046] The tree structure merging subunit is configured to merge the current required authentication step tree of each authentication level within the current required authentication level range of the user and the second current required authentication step tree in the mixed authentication step tree respectively to obtain a plurality of merged required authentication step trees, wherein the total number of the merged required authentication step trees is consistent with the total number of the current required authentication step trees.

[0047] The authentication efficiency determining subunit is configured to determine an authentication efficiency of each merged required authentication step tree based on an authentication efficiency and a running resource loss of each merged required authentication step tree.

[0048] The tree structure screening subunit is configured to take the merged required authentication step tree with the maximum authentication efficiency as the actual authentication step tree.

[0049] The present application provides a multi-platform client unified identity authentication and organization architecture dynamic synchronization method, comprising:

[0050] S1: matching an optimal data transmission strategy based on a network environment perception value and a third-party authentication mode selected by a user;

[0051] S2: connecting a third-party authentication platform based on a preset authentication protocol, triggering an authorization process according to an authentication mode of a corresponding client, receiving an authorization code of the third-party authentication platform under the corresponding authentication mode through the optimal data transmission strategy, and obtaining authorized user information by calling a backend interface based on the received authorization code;

[0052] S3: when it is determined that the authorized user information is in user information stored in the backend and that the organization information in the authorized user information is consistent with the organization information of the corresponding user in the user information stored in the backend, returning an authentication success feedback result to the client based on the optimal data transmission strategy.

[0053] When it is determined that the authorized user information is not in the user information stored in the backend, or when it is determined that the architecture information in the authorized user information is inconsistent with the corresponding architecture information in the user information stored in the backend, the authentication failure feedback result is returned to the client based on the optimal data transmission strategy, and the dynamic variables of the enterprise organizational structure relationship network are obtained synchronously and the permission propagation calculation is triggered to obtain the user's permission update result.

[0054] S4: Authenticate the user's identity based on the user's permission update result and the hybrid authentication mode until the final authentication result is obtained.

[0055] The beneficial effects of this invention compared to existing technologies are as follows: From a data transmission perspective, the adaptive matching module determines the optimal data transmission strategy by comprehensively considering network environment perception and the user's selected third-party authentication method. This not only ensures the transmission efficiency and stability of data in complex and ever-changing network environments, reducing packet loss and latency issues during transmission, but also specifically enhances the confidentiality and integrity of data transmission based on the security requirements of different authentication methods, laying a solid foundation for subsequent authentication processes. In the authentication integration phase, the third-party authorization module connects to the third-party authentication platform through a preset authentication protocol, triggering the authorization process according to the client authentication mode. It uses the optimal data transmission strategy to obtain authorized user information. This process not only improves authentication efficiency and reduces user waiting time, but also ensures the standardization and security of the authentication process through standardized protocols, reducing security risks caused by non-standard authentication integration. The first authentication module rigorously compares authorized user information with backend storage information and the associated architecture information. During matching, it returns authentication success feedback based on the optimal strategy, ensuring that only legitimate users with matching architectures can successfully pass authentication, effectively preventing unauthorized users from impersonating others and ensuring system information security. When information mismatches occur, the dynamic architecture synchronization module, in addition to returning authentication failure feedback, retrieves dynamic variables of the enterprise's organizational structure and triggers permission propagation and deduction to update user permissions. This mechanism not only promptly detects the impact of organizational structure changes on user permissions but also rationally adjusts user permissions based on the new organizational structure, achieving dynamic management and optimization of permissions. The second authentication module performs secondary authentication based on the permission update result and a hybrid authentication mode, further ensuring the accuracy of user identities. Simultaneously, the hybrid authentication mode adds authentication dimensions, enhancing the system's ability to cope with complex and ever-changing security threats. Ultimately, it achieves efficient, secure, and intelligent management of unified identity authentication and dynamic organizational structure synchronization across multiple platform clients, providing strong support for enterprise digital operations.

[0056] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures particularly pointed out in this application.

[0057] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0058] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0059] Fig. 1 This is a schematic diagram of a multi-platform client unified identity authentication and dynamic organizational structure synchronization system in an embodiment of the present invention;

[0060] Fig. 2 This is a flowchart illustrating the configuration of DingTalk on the Portal side in an embodiment of the present invention.

[0061] Fig. 3 This is a schematic diagram of the information flow when selecting DingTalk authentication in the desktop system of this embodiment of the invention. Detailed Implementation

[0062] The preferred embodiments of the present invention will be described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit the present invention.

[0063] Example 1:

[0064] This invention provides a unified identity authentication and dynamic organizational structure synchronization system for multi-platform clients, referencing... Figs. 1-3 include:

[0065] The policy adaptive matching module is used to match the optimal data transmission strategy based on network environment awareness values ​​and the third-party authentication method selected by the user.

[0066] The third-party authorization and authentication module is used to connect to the third-party authentication platform based on the preset authentication protocol, trigger the authorization process according to the authentication mode of the corresponding client, receive the authorization code of the third-party authentication platform in the corresponding authentication mode through the optimal data transmission strategy, and obtain the authorized user information based on the received authorization code.

[0067] The first authentication module is used to return a successful authentication feedback result to the client based on the optimal data transmission strategy when it is determined that the authorized user information is in the user information stored in the backend and the architecture information of the authorized user information is consistent with the architecture information of the corresponding user in the user information stored in the backend.

[0068] The architecture dynamic synchronization module is used to return an authentication failure feedback result to the client based on the optimal data transmission strategy when it is determined that the authorized user information is not in the user information stored in the backend or that the architecture information of the authorized user information is inconsistent with the architecture information of the corresponding user in the user information stored in the backend. It also synchronously obtains the dynamic variables of the enterprise organizational structure relationship network and triggers permission propagation inference to obtain the user's permission update result.

[0069] The second authentication module is used to authenticate the user's identity based on the user's permission update result and the hybrid authentication mode until the final authentication result is obtained.

[0070] In this embodiment, the third-party authentication method selected by the user refers to the authentication method chosen by the user from the various third-party authentication methods supported by the system. Taking DingTalk client as an example, other common platforms based on the OAuth2 authentication system include WeChat Work, Lark, OKTA, etc.

[0071] In this embodiment, the optimal data transmission strategy is the strategy with the maximum relative authentication busyness determined by evaluating all matching data transmission strategies based on network environment awareness values ​​and the third-party authentication method selected by the user.

[0072] In this embodiment, the preset authentication protocol is a pre-defined authentication rule and standard used to connect to third-party authentication platforms, such as OAuth2, an open standard for authentication and authorization. It includes authorization code mode, simplified mode, password mode, credential mode, etc. Different third-party authentication platforms may perform authentication based on one or more of these modes.

[0073] In this embodiment, a third-party authentication platform is an external platform that users can choose for identity authentication, in addition to the system's own authentication methods. DingTalk, WeChat Work, Lark, OKTA, etc. are all in this category. These platforms have their own user systems and authentication processes.

[0074] In this embodiment, the client refers to the device used by the user to access the system, including desktop (such as Windows, Mac) and mobile (such as iOS, Android).

[0075] In this embodiment, the client's authentication mode is based on the specific authentication process adopted by the client type. For example, desktop clients may use a local browser to generate a QR code for login, while mobile clients may automatically launch a third-party client to trigger the authorization process.

[0076] In this embodiment, the authorization process refers to a series of steps by which the client completes user identity authentication and authorization after connecting to a third-party authentication platform based on a preset authentication protocol. A series of consecutive operations, such as scanning a QR code to log in on the desktop and launching a third-party client for authorization on the mobile device, constitute the authorization process.

[0077] In this embodiment, receiving the authorization code from the third-party authentication platform under the corresponding authentication mode based on the optimal data transmission strategy means that during the authentication process, the authorization code generated by the corresponding authentication mode is obtained from the third-party authentication platform according to the matched optimal data transmission strategy to ensure stable and efficient data transmission. For example, the authorization code is received through this strategy during desktop QR code login or mobile authorization.

[0078] In this embodiment, the authorization code of the third-party authentication platform under the corresponding authentication mode is a code generated by the third-party authentication platform for authorization after the user completes the relevant authentication operation according to a specific authentication mode. After obtaining this code, the client can further obtain authorized user information, such as the temporary authorization code (Code) generated during the DingTalk authentication process.

[0079] In this embodiment, authorized user information is obtained based on the received authorization code. That is, after receiving the authorization code from the third-party authentication platform, the client uses the authorization code to obtain user-related information, such as the user's account information and organizational structure information on the third-party platform, by calling the backend authentication interface.

[0080] In this embodiment, the authorized user information is relevant data about the user obtained through the authorization code, including the user's account information on the third-party authentication platform, their organization, department, position, etc. This information is used to compare with the backend stored information to confirm the user's identity and permissions.

[0081] In this embodiment, the user information stored in the backend is user data pre-stored in the system backend, including user identity information, architecture information, and permission information, which serves as the basis for comparison during the authentication process to determine the legitimacy of the user currently requesting authentication.

[0082] In this embodiment, the authorized user information is stored in the user information in the backend, which means that the obtained authorized user information matches the user information stored in the backend, indicating that the user is recorded in the system, which is one of the conditions for successful authentication.

[0083] In this embodiment, the organizational structure information in the authorized user information refers to the relevant information of the authorized user in their organizational structure, such as the organization, department, and position, which is used to compare with the corresponding part in the backend stored information to confirm the consistency of the user's organizational structure information.

[0084] In this embodiment, the organizational structure information of the user in the backend stored user information is the relevant information in the organizational structure corresponding to the user currently requesting authentication. By comparing it with the organizational structure information in the authorized user information, it is determined whether the user's organizational structure information matches.

[0085] In this embodiment, an authentication success (failure) feedback result is returned to the client based on the optimal data transmission strategy. This means that after authentication is completed, the authentication result is returned to the client according to the optimal data transmission strategy. If the authorized user information and its associated architecture information match the backend storage information, an authentication success result is returned; otherwise, an authentication failure result is returned.

[0086] In this embodiment, the dynamic variables of the enterprise's organizational structure relationship network are obtained synchronously and permission propagation inference is triggered to obtain the user's permission update result. When authentication fails, the dynamic change information of the enterprise's organizational structure relationship is obtained, and inference is performed according to the permission inheritance rules to determine the user's permission update due to organizational structure changes, ensuring that permissions are synchronized with structure changes.

[0087] In this embodiment, the user's identity is authenticated based on the user's permission update result and the hybrid authentication mode until the final authentication result is obtained. This means that after obtaining the user's permission update result, the user's identity is authenticated again by combining the hybrid authentication mode (such as local authentication + DingTalk authentication and other combinations). Through multi-dimensional authentication, the accuracy of the user's identity is ensured, and finally, a conclusion is drawn as to whether the authentication was successful.

[0088] In this embodiment, it should be noted that the current system supports the following rules for hybrid authentication modes: Currently, the system only allows customers to enable local authentication or LDAP; both authentication methods are not allowed to coexist. The existing logic for these two authentication methods remains unchanged. Both local authentication + DingTalk authentication and LDAP + DingTalk authentication are supported. In the future, local authentication, LDAP, and DingTalk authentication will all coexist as hybrid authentication methods. The backend performs authentication according to the user-specified authentication type (Local / DingTalk / LDAP) until one type succeeds or all types fail. If all types fail, the client authentication fails. If any one of the configured authentication methods succeeds, the authentication is considered successful.

[0089] In this embodiment, the third-party authentication method takes the DingTalk client as an example, referring to... Figs. 2-3In the client's mobile configuration, the DingTalk authentication login function can be enabled, binding the corresponding client's DingTalk organization ID and organization name. After enabling DingTalk authentication login, users can configure organizational structure information as a policy Matcher item, such as "R&D Department" and "Testing Department," allowing users to select. Manual synchronization of DingTalk account information and automatic synchronization when changes occur during login are supported. In the client's mobile configuration, add the "OAuth2-DingTalk Authentication" option to allow users to enable DingTalk login. After enabling DingTalk login, users need to create an enterprise application on the DingTalk SDK embedding page, bind the corresponding organization, and provide the relevant organization ID and organization name to bind on the Portal page to obtain the user's organizational structure information. A user is allowed to add one or more organizations, and multiple clients can have the same organization. After enabling DingTalk login and binding the corresponding organization ID, the backend should automatically add the organizational structure fields "Organization," "Department," and "Position" for that client and display them in the policy Matcher. This allows users under that client to automatically fill in the organization, department, and position in their automatically created DingTalk accounts when logging in, facilitating the configuration of policy Matcher matching rules. After enabling the DingTalk login function, the backend obtains the user's organizational structure information through the enterprise ID provided by the user, and the organizational structure fields such as department and position in the strategy Matcher provide drop-down menus for selection.

[0090] OAuth2 is an open standard for authentication and authorization, including authorization methods such as: Authorization Code Mode, Simplified Mode, Password Mode, and Token Mode. OAuth2 Authorization Code Mode is the most secure of the four OAuth2 authentication and authorization methods. It requires sending a two-step request to the authentication server: first, requesting an authorization code with the user information; second, obtaining a token using the authorization code. For security reasons, the user information (username, password, etc.) cannot be directly entered on the client side when requesting the authorization code; it must be sent to the authentication server through a third party such as a browser. Common platforms such as DingTalk, WeChat Work, Lark, and OKTA all belong to the OAuth2 authentication system.

[0091] Example 2:

[0092] Based on Example 1, the policy adaptive matching module includes:

[0093] The network environment awareness submodule is used to perceive the network environment characteristics of each authentication request client received simultaneously by the backend at the current moment in real time, and calculate the current client's network environment awareness value based on the real-time network environment characteristics.

[0094] The transmission strategy filtering submodule is used to determine all matching data transmission strategies for each authentication request client based on the network environment awareness value of each authentication request client received simultaneously by the backend at the current moment.

[0095] The authentication busyness assessment submodule is used to calculate the relative authentication busyness of the current client under each matching data transmission strategy based on all matching data transmission strategies of all authentication request clients received by the backend at the current moment and the authentication protocol corresponding to the selected third-party authentication method.

[0096] The optimal transmission strategy determination submodule is used to determine the optimal matching data transmission strategy for the current client among all matching data transmission strategies that has the highest relative authentication busyness.

[0097] In this embodiment, the authentication request client refers to the device that initiates the authentication request, including desktop (such as Win, Mac) and mobile (such as iOS, Android).

[0098] In this embodiment, the network environment awareness value of the current client is calculated based on real-time network environment characteristics. For example, it is calculated using the formula: Network Environment Awareness Value = 0.4 × Network Bandwidth Normalized Value + 0.3 × Latency Normalized Value + 0.3 × Packet Loss Rate Normalized Value. For example, with a network bandwidth of 100Mbps (maximum 1000Mbps), the normalized value is 0.1; with a latency of 50ms (maximum 200ms), the normalized value is 0.25; and with a packet loss rate of 2% (maximum 10%), the normalized value is 0.2, resulting in a network environment awareness value of 0.175.

[0099] In this embodiment, all matching data transmission strategies are determined based on the network environment awareness value of each authentication request client. The system presets rules, dividing the data transmission into different ranges according to the awareness value. Different ranges correspond to different strategy combinations. For example, when the network environment awareness value is greater than 0.6 and less than 0.9, a high-speed direct transmission strategy is adopted, and when the network environment awareness value is greater than 0 and less than or equal to 0.6, a priority encrypted transmission strategy is adopted.

[0100] In this embodiment, all matching data transmission strategies of the authentication request client are data transmission methods selected based on network environment awareness values. For example, the high-speed direct transmission strategy focuses on fast data transmission, but may have high requirements for network stability and relatively weak security; the priority encryption transmission strategy emphasizes the confidentiality of data transmission, but may reduce the transmission speed.

[0101] In this embodiment, the authentication protocol corresponding to the third-party authentication method is the standard and process followed by a specific third-party authentication platform to perform authentication. For example, different authentication modes under the OAuth2 protocol have their own request and verification steps, including: Step 1: The authentication server verifies the client information and user authorization. If successful, it sends an authorization code to the redirected URI. After receiving the authorization code, the application client sends an access token to the authentication server along with the authorization code, client ID, and client key. The authentication server verifies this information. If correct, it returns an access token. Step 2: The authentication server verifies the client credentials. If verification is successful, it returns an access token. This mode is commonly used for authentication between server-side applications and does not involve user participation.

[0102] In this embodiment, the relative authentication busyness of the current client under each matching data transmission strategy reflects the relative busyness of the current client when authenticating using that strategy.

[0103] The beneficial effects of the above technologies are as follows: The network environment awareness submodule perceives the network environment characteristics of the authentication request client in real time, calculates the network environment awareness value, accurately grasps the real-time network status of each client, provides a reliable basis for subsequent policy formulation, and enables the system to adapt to dynamic network changes. The transmission policy selection submodule determines all matching data transmission policies based on the awareness value, expands the policy selection range, and greatly enhances the system's adaptability to complex and diverse network environments. The authentication busyness assessment submodule calculates the relative authentication busyness by comprehensively considering the matching policies and authentication protocols, taking into account both network and authentication characteristics, making policy evaluation more in line with actual authentication scenarios. The optimal transmission policy determination submodule selects the policy with the highest relative authentication busyness as the optimal one, effectively balancing authentication efficiency and resource utilization, avoiding unreasonable resource use, achieving optimized configuration of network resources and authentication processes, and significantly improving the data transmission stability and authentication efficiency of unified identity authentication for multi-platform clients.

[0104] Example 3:

[0105] Based on Example 2, the authentication busyness assessment submodule includes:

[0106] The resource consumption amplification factor determination unit is used to determine the resource consumption amplification factor for all resource types under each matchable data transmission strategy.

[0107] The resource consumption coefficient determination unit is used to take the average of the resource consumption ratios of all authentication instances under the authentication protocol corresponding to each third-party authentication method for each resource type as the resource consumption coefficient of the corresponding resource type under the authentication protocol corresponding to the corresponding third-party authentication method.

[0108] The resource consumption determination unit is used to determine the resource consumption of all resource types under each matching data transmission strategy and the corresponding authentication protocol of each third-party authentication method received by the backend at the current moment, based on the resource consumption amplification coefficient of all resource types under each matching data transmission strategy and the resource consumption coefficient under each third-party authentication protocol. For example, if the CPU resource consumption coefficient is 0.2 under a certain authentication protocol and the consumption amplification coefficient is 3 under a certain matching data transmission strategy, and the total CPU resource is 100 (assuming unit), then the CPU resource consumption of this client under this strategy and authentication protocol is 100 × 0.2 × 3 = 60.

[0109] The global resource pressure determination unit is used to normalize the sum of the resource occupancy of the same resource type under the same matching data transmission strategy and the corresponding third-party authentication protocol of all authentication request clients simultaneously received by the backend at the current moment to the maximum resource occupancy of the corresponding resource type, and obtain the global resource pressure of the corresponding resource type under the corresponding matching data transmission strategy; for example, if the total CPU resource occupancy of all clients under a certain matching data transmission strategy is 200 (assuming unit), and the maximum CPU resource occupancy of the system is 500, then the global resource pressure of CPU resources under this matching data transmission strategy is 200 ÷ 500 = 0.4.

[0110] The relative authentication busyness determination unit is used to determine the relative authentication busyness of the current client under each matching data transmission strategy based on the resource consumption of all resource types under each matching data transmission strategy and the authentication protocol corresponding to the corresponding third-party authentication method, and the global resource pressure of each resource type under each matching data transmission strategy.

[0111] In this embodiment, all resource types refer to various resources involved in the system authentication process, such as CPU resources, memory resources, and network bandwidth resources.

[0112] In this embodiment, all authentication instances under the authentication protocol corresponding to each third-party authentication method refer to all authentication operation records processed by the system under a specific third-party authentication method (such as DingTalk OAuth2 authentication) and its corresponding authentication protocol. These instances include the usage of various resources during the authentication process.

[0113] In this embodiment, the resource consumption ratio of each resource type across all authentication instances under the authentication protocol corresponding to each third-party authentication method refers to the ratio of the actual usage of each type of resource to the total amount of that resource in each authentication instance under the authentication protocol corresponding to each third-party authentication method. For example, in an authentication instance under the DingTalk OAuth2 authentication protocol, the total memory is 100M, and the actual usage is 20M, then the memory resource consumption ratio in this instance is 20÷100=0.2.

[0114] In this embodiment, the relative authentication busyness is determined as follows: based on the current client's resource usage under the corresponding matchable data transmission strategy and authentication protocol, and the global resource pressure of each resource type under the matchable data transmission strategy, it is calculated using the following formula: Relative authentication busyness = 0.4 × (client CPU resource usage + global CPU resource pressure) + 0.3 × (client memory resource usage + global memory resource pressure) + 0.3 × (client network bandwidth resource usage + global network bandwidth resource pressure).

[0115] The beneficial effects of the above technologies are as follows: The resource consumption amplification factor determination unit clarifies the consumption amplification factor of various resources under different matchable data transmission strategies, providing basic parameters for assessing changes in resource usage and enabling strategy evaluation to consider the impact of different strategies on resource consumption. The resource consumption factor determination unit calculates the average value to obtain the consumption factor of each resource under different authentication protocols, quantifying resource consumption during the authentication process and making the evaluation more scientific and accurate. The resource occupancy determination unit combines the above two to determine the resource occupancy of each authentication request client under different strategies and authentication protocols, clearly presenting the resource occupancy of each client. The global resource pressure determination unit normalizes the resource occupancy to obtain the global resource pressure, reflecting the resource pressure status under different strategies from an overall perspective, which helps the system to allocate resources rationally. The relative authentication busyness determination unit comprehensively considers client resource occupancy and global resource pressure to accurately determine the relative authentication busyness, providing a comprehensive and realistic reference for selecting the optimal transmission strategy, and ultimately optimizing resource configuration and authentication efficiency in the unified identity authentication process for multi-platform clients.

[0116] Example 4:

[0117] Based on Example 3, the resource consumption amplification factor determination unit includes:

[0118] The consumption value determination subunit is used to perform no-load system testing in an isolated environment and record the basic resource consumption value for each resource type.

[0119] The resource consumption peak determination subunit is used to record the resource consumption peak reached by each resource type when each matching data transmission strategy is individually enabled to execute a preset subtypical authentication request in an isolated environment.

[0120] The resource consumption amplification factor determination subunit is used to take the ratio of the peak resource consumption reached when each resource type is individually enabled in an isolated environment to execute a preset subtypical authentication request with each matching data transmission strategy to the basic resource consumption value, as the resource consumption amplification factor for the corresponding resource type under each matching data transmission strategy.

[0121] In this embodiment, an idle system test is performed in an isolated environment, recording the basic resource consumption value for each resource type. This involves building a test environment isolated from external interference factors. The system runs in this environment without performing any additional authentication-related operations. Resource usage values ​​for various resources, such as CPU, memory, and network bandwidth, are recorded under idle conditions. These values ​​serve as a benchmark for subsequent evaluation of resource consumption changes. For example, the basic resource consumption value recorded for CPU is 10% (utilization rate), and for memory is 200MB (occupancy).

[0122] In this embodiment, the preset sub-typical authentication requests refer to a pre-defined number and type of representative authentication requests used to simulate real-world authentication scenarios. These requests cover common third-party authentication methods and typical operation procedures under their corresponding authentication protocols, in order to test the system's resource consumption under different data transmission strategies. For example, 10 login requests based on the DingTalk OAuth2 authentication protocol are set as preset sub-typical authentication requests.

[0123] In this embodiment, the peak resource consumption of each resource type is recorded when each matching data transmission strategy is individually enabled to execute a preset sub-typical authentication request in an isolated environment. Specifically, in the isolated environment, only one matching data transmission strategy is enabled each time, and a preset sub-typical authentication request is executed. The highest resource consumption values ​​reached during execution are monitored and recorded. For example, when the fast direct connection transmission strategy is enabled to execute 10 DingTalk OAuth2 authentication login requests, the peak CPU resource consumption is observed to reach 50% (utilization), and the peak memory resource consumption is 500M (occupancy).

[0124] The beneficial effects of the above technologies are as follows: The resource consumption value determination subunit records the basic resource consumption value of each resource type by performing idle system tests in an isolated environment. This provides a stable and reliable benchmark for subsequent evaluation, giving resource consumption assessment a clear reference starting point, eliminating other interfering factors, and making the evaluation more accurate. The resource consumption peak value determination subunit records the peak resource consumption reached by each resource type when each matching data transmission strategy is used individually in an isolated environment to execute a preset sub-typical authentication request. This provides detailed information on the extreme resource consumption under different strategies, helping to comprehensively understand the maximum resource demand of each strategy. The resource consumption amplification factor determination subunit uses the ratio of the peak resource consumption value to the basic resource consumption value as the resource consumption amplification factor. This quantitative calculation method can intuitively reflect the amplification degree of each matching data transmission strategy on various resource consumption types. It provides the system with clear and comparable quantitative indicators when considering different strategies, enabling the system to select the optimal transmission strategy more scientifically and rationally based on these accurate indicators, optimize resource utilization in the unified identity authentication process of multi-platform clients, and improve overall authentication efficiency and stability.

[0125] Example 5:

[0126] Based on Example 1, the third-party authorization and authentication module includes:

[0127] The first authorization and authentication submodule is used to connect to a third-party authentication platform based on a preset authentication protocol when the client is a desktop client. It also launches the local browser to request login from the third-party authentication platform, generates and displays a login QR code, and receives the authorization code after the user scans the code based on the optimal data transmission strategy. Based on the authorization code, it triggers the authorization process and calls the backend authentication interface to obtain the authorized user information.

[0128] The second authorization and authentication submodule is used to connect to a third-party authentication platform based on a preset authentication protocol when the client is a mobile device. It then launches the third-party client to trigger the authorization process, receives a temporary authorization code based on the optimal data transmission strategy and sends it to the backend, and calls the backend authentication interface to obtain authorized user information.

[0129] In this embodiment, when the client is a desktop device (such as a Windows or Mac system device), the system establishes a connection with a third-party authentication platform according to a preset authentication protocol. Then, the local browser is launched, a login request is sent to the third-party authentication platform, a QR code for login is generated, and displayed on the browser page. The user scans the QR code using a mobile device. After a successful scan, the system receives the authorization code generated by the third-party authentication platform according to the optimal data transmission strategy. Next, this authorization code triggers the authorization process, obtaining authorized user information by calling the backend authentication interface, thereby completing the authentication process. For example, if DingTalk is used as the third-party authentication platform, the desktop system connects to the DingTalk platform according to preset authentication protocols such as OAuth2. After the user scans the QR code, the system receives the authorization code to obtain the user's relevant information on DingTalk for authentication.

[0130] In this embodiment, when the client is a mobile device (such as an iOS or Android device), it connects to the third-party authentication platform according to a preset authentication protocol. The third-party client (such as the DingTalk client) is then automatically launched, and an authorization interface pops up on the mobile device, triggering the authorization process. Once the user agrees to authorization, the system receives the temporary authorization code generated by the third-party client based on the optimal data transmission strategy and sends it to the backend. Upon receiving the temporary authorization code, the backend obtains the authorized user information by calling the authentication interface and completes the authentication. For example, when using DingTalk authentication on a mobile device, the system connects to DingTalk based on a preset protocol, launches the DingTalk client to obtain the temporary authorization code, sends it to the backend, and the backend uses this code to obtain user information and complete the authentication.

[0131] The beneficial effects of the above technologies are as follows: For desktop devices, the first authorization and authentication submodule connects to a third-party authentication platform based on a preset protocol. It launches a local browser to request login, generates and displays a login QR code, facilitating user scanning. This approach aligns with the characteristics of desktop devices, improving user authentication convenience. Simultaneously, it receives the authorization code based on an optimal data transmission strategy, ensuring efficient and stable data transmission and a smooth authorization process. It can also call backend interfaces to obtain authorized user information, achieving a closed-loop authentication process. For mobile devices, the second authorization and authentication submodule also connects based on a preset protocol, launching a third-party client to trigger authorization. This aligns with mobile usage habits and, based on an optimal strategy, receives and sends temporary authorization codes to the backend before obtaining authorized user information, ensuring a smooth mobile authentication process. Overall, this module provides adapted authentication methods for different client types, utilizes optimal data transmission strategies to ensure stable and efficient data interaction, and comprehensively improves the user experience and authentication efficiency of unified identity authentication across multiple platforms.

[0132] Example 6:

[0133] Based on Example 1, a dynamic synchronization module is constructed, including:

[0134] The authentication failure feedback submodule is used to return an authentication failure feedback result to the client based on the optimal data transmission strategy when it is determined that the authorized user information is not in the user information stored in the backend, or when the organizational structure information of the authorized user information is inconsistent with the corresponding organizational structure information of the user in the user information stored in the backend. This means that during the authentication process, the system compares the authorized user information obtained from the third-party authentication platform with the user information and corresponding organizational structure information stored in the backend. If it finds that the authorized user is a new user (the information is not in the backend storage), or that a user already exists but their organizational structure information (such as department, position, etc.) does not match the backend record, subsequent processes will be triggered. For example, a user in the backend storage belongs to the "Sales Department," but the authorized user information obtained through third-party authentication shows that the user has been transferred to the "Marketing Department," which results in inconsistent organizational structure information.

[0135] The submodule for obtaining architectural relationship variables is used to obtain dynamic variables of the enterprise's organizational structure relationship network;

[0136] The permission update submodule is used to perform permission propagation deduction based on dynamic variables and permission inheritance rules of the enterprise's organizational structure relationship network, and obtain the user's permission update results.

[0137] In this embodiment, acquiring dynamic variables of the enterprise's organizational structure network refers to capturing real-time changes in the enterprise's organizational structure during its operation. These variables may include the addition, deletion, or merger of departments, changes in employee positions, and adjustments to reporting relationships. For example, if the enterprise establishes a new "digital transformation project team," or if an employee is promoted from "development team" to "technical lead," these changes are dynamic variables.

[0138] In this embodiment, the permission inheritance rules are a set of pre-defined criteria used to determine the permissions that a user should inherit based on their position and role in the enterprise's organizational structure. For example, in a certain enterprise, it is stipulated that a department manager automatically inherits the viewing permissions of all employees in the department, and additionally has approval permissions; or specific project team members inherit the read and write permissions of project-related documents, etc. These rules clarify the permission allocation method corresponding to different organizational structure positions.

[0139] In this embodiment, permission propagation is deduced based on the dynamic variables of the enterprise's organizational structure relationship network and permission inheritance rules to obtain the user's permission update result. This involves recalculating the user's due permissions based on the obtained information about dynamic changes in the organizational structure and the permission inheritance rules. For example, if a department in the enterprise is split up and some employees are transferred to the new department, according to the permission inheritance rules, the employees transferred to the new department may gain specific permissions corresponding to the new department, while losing some permissions that are no longer applicable in their original department. The new scope of the user's permissions is derived through this deduction, which is the permission update result.

[0140] The beneficial effects of the above technologies are as follows: The authentication failure feedback submodule, when the authorized user information does not match the backend stored information, can quickly return the authentication failure feedback result to the client using the optimal data transmission strategy, promptly informing the user of the authentication status, avoiding unnecessary waiting for the user, improving the user experience, and maintaining the accuracy and rigor of the system authentication process. The architecture relationship variable acquisition submodule is responsible for acquiring the dynamic variables of the enterprise's organizational structure relationship network, providing real-time data support for the system to keep up with organizational structure changes, enabling the system to adapt to the dynamic adjustment of the enterprise architecture. The permission update submodule performs permission propagation deduction based on the above dynamic variables and permission inheritance rules, deriving the user permission update result, ensuring that user permissions remain synchronized with changes in the enterprise architecture, guaranteeing the rationality and effectiveness of system permission management, thereby maintaining the orderly operation of the entire system based on the enterprise's organizational structure, and improving the system's adaptability to changes in the enterprise's actual business scenarios.

[0141] Example 7:

[0142] Based on Example 1, the second authentication module includes:

[0143] The Hybrid Authentication Step Tree Construction Submodule is used to build a hybrid authentication step tree for a multi-factor authentication system based on a hybrid authentication mode.

[0144] The behavioral risk assessment submodule is used to assess the user's behavioral risk and obtain the user's behavioral risk assessment value.

[0145] The step tree extraction submodule is used to extract the actual authentication step tree from the hybrid authentication step tree based on the user's permission update results and behavioral risk assessment values.

[0146] The identity authentication submodule is used to authenticate users based on the actual authentication steps tree until the final authentication result is obtained.

[0147] In this embodiment, a multi-factor authentication system is a mechanism that verifies a user's identity by combining multiple different types of authentication factors. These factors are typically divided into three categories: known factors (such as passwords and PIN codes), all factors (such as mobile phones and smart cards), and inherent factors (such as fingerprints and facial recognition). For example, when logging in, a user may not only need to enter a password (known factors), but may also need to obtain a dynamic verification code via mobile phone (all factors), or even perform fingerprint recognition (inherent factors). The combination of multiple factors improves the security of authentication.

[0148] In this embodiment, building a hybrid authentication step tree based on a multi-factor authentication system under a hybrid authentication mode refers to constructing a tree structure based on the hybrid authentication modes supported by the system (such as local authentication + DingTalk authentication) and various authentication factors in the multi-factor authentication system. This tree structure uses different authentication steps as nodes, showing a series of operation processes and sequences required to complete user identity authentication. For example, starting from the root node, local password verification may be performed first. After successful verification, the user proceeds to the next level node, such as selecting a third-party authentication method (DingTalk authentication), and then continues with subsequent authentication steps such as scanning QR codes or authorization, forming an ordered authentication process tree.

[0149] In this embodiment, the user's behavioral risk assessment value is obtained by analyzing the user's operational behavior in the system, such as login frequency, operation time, and operation type. A specific algorithm or model is used to quantify the degree of risk that the user's behavior may bring, resulting in a specific numerical value. Assume a weighted summation algorithm is used to assess user behavioral risk. Login frequency has a weight of 0.4, operation time has a weight of 0.3, and operation type has a weight of 0.3. The normal login frequency range is set to 1-5 times per week, operation time is weekdays from 9:00 AM to 6:00 PM, and operation type is divided into ordinary (weight 0.2) and sensitive (weight 0.8). A user logs in 3 times a week, with a score of (3-1) / (5-1)×0.4=0.2; 80% of the operation time is during normal hours, with a score of 0.8×0.3=0.24; 80% of the operation type is ordinary, and 20% is sensitive, with a score of (0.2×0.8+0.8×0.2)×0.3=0.096. Behavioral risk assessment value = 0.2 + 0.24 + 0.096 = 0.536. The closer the value is to 1, the higher the risk.

[0150] In this embodiment, the actual authentication step tree is an authentication process tree extracted from the hybrid authentication step tree based on the user's permission update result and behavioral risk assessment value, tailored to the user's specific situation. For example, if the user's permission update involves access to more confidential information and the behavioral risk assessment value is high, the actual authentication step tree may add additional identity verification steps, such as secondary facial recognition or superior approval.

[0151] In this embodiment, user authentication is performed based on the actual authentication step tree until a final authentication result is obtained. That is, the user is guided to complete each authentication step sequentially according to the process and order determined by the actual authentication step tree. After each authentication step is completed, the system verifies whether the authentication result is successful. If all steps pass the verification, the final authentication result is successful; if the authentication fails at any step, the authentication failure result is obtained.

[0152] The beneficial effects of the above technologies are as follows: The second authentication module optimizes the authentication process from multiple aspects, improving authentication security and adaptability. The hybrid authentication step tree construction submodule builds a hybrid authentication step tree based on a multi-factor authentication system, constructing a comprehensive and hierarchical authentication framework that provides systematic support for complex authentication needs. The behavior risk assessment submodule assesses user behavior risk to obtain an evaluation value, introducing a dynamic risk assessment mechanism that allows authentication to be adjusted according to real-time user behavior characteristics, enhancing authentication targeting. The step tree extraction submodule combines user permission update results and behavior risk assessment values ​​to extract the actual authentication step tree, enabling personalized customization of the authentication process. This considers both the impact of organizational structure changes on permissions and user behavior risks, avoiding over- or under-authentication. The identity authentication submodule performs authentication based on the actual authentication step tree to obtain the final result, ensuring a rigorous and orderly authentication process. Through the above collaboration, while ensuring authentication security, user experience is improved, adapting to diverse authentication scenario needs, and strengthening the overall security and flexibility of the system.

[0153] Example 8:

[0154] Based on Example 7, the step tree is truncated into sub-modules, including:

[0155] The permission update determination unit is used to determine the relative update factor of the permission range for all user permission update items based on the user's permission update results. That is, for each item whose user permissions have changed, it calculates the proportion of change in its permission range relative to the previous one. For example, if a user originally only had read permission for a certain type of file, and after the permission update, write permission is added, assuming the read permission range is set to 1, and the permission range becomes 2 after adding write permission, then the relative update factor of the permission range for this permission update item is (2-1) / 1 = 1.

[0156] The ratio of the original weight of each user's permission update item (set according to factors such as the importance of the permission and its impact on business) to the sum of the original weights of all the user's permission update items is used as the current weight of each user's permission update item. Based on the current weights of all the user's permission update items, the relative update factors of the permission range of all the user's permission update items are weighted and summed to obtain the user's total relative update amount of permissions. Assuming that the user has two permission update items with relative update factors of permission range of 1 and 0.5 respectively, and current weights of 0.6 and 0.4 respectively, then the total relative update amount of permissions = 1 × 0.6 + 0.5 × 0.4 = 0.8.

[0157] The required authentication level range determination unit is used to determine a user's current node in the enterprise's organizational structure relationship network based on dynamic variables. As the enterprise's organizational structure changes, such as departmental adjustments or job promotions, the user's position in the latest organizational structure can be clearly defined; this position is the current node. For example, if a new project team is established within the enterprise and a user is transferred to that project team, then that project team is the user's current node in the organizational structure relationship network.

[0158] The system determines the user's required authentication level range based on their current node within the enterprise's organizational structure network. According to a pre-defined node-authentication level range mapping table, different organizational structure nodes may correspond to different security requirements, thus determining the required authentication level range. For example, senior management nodes may require the highest level of authentication, while ordinary employee nodes may require a lower level. If the user is in a key position within a core business department, the required authentication level range may be from advanced to top-level authentication.

[0159] The first extraction unit is used to extract the current required authentication step tree for each authentication level within the user's current required authentication level range from the hybrid authentication step tree, based on the standard authentication steps for each authentication level within the user's current required authentication level range and the standard incremental steps for the user's total permissions relative update amount within the user's current required authentication level range. In other words, based on the aforementioned standard authentication steps and standard incremental steps, it extracts an authentication process tree suitable for the user's current required authentication level range and permission update situation from the general hybrid authentication step tree. For example, if the user's current required authentication level is from intermediate to advanced, based on the standard authentication steps and the standard incremental steps generated by the relative update amount of total permissions, it determines and extracts the corresponding authentication step sequences for intermediate and advanced authentication levels respectively from the hybrid authentication step tree to form the current required authentication step tree.

[0160] The second extraction unit is used to extract a second currently required authentication step tree from the hybrid authentication step tree based on the behavioral risk assessment value. This extraction is also based on a preset correspondence. The hybrid authentication step tree is adjusted according to the assessed user behavioral risk value to extract an authentication step tree that matches the behavioral risk situation. If the behavioral risk assessment value is high, more risk prevention-related authentication steps may be added to the hybrid authentication step tree, such as identity verification and operation confirmation steps, thus forming the second currently required authentication step tree.

[0161] The third interception unit is used to extract the current required authentication step tree and the second current required authentication step tree for each authentication level within the range of the user's current required authentication level from the hybrid authentication step tree, and to obtain the actual authentication step tree from the hybrid authentication step tree.

[0162] In this embodiment, the standard authentication steps for each authentication level are pre-defined and standardized authentication operation procedures for different authentication levels. For example, a low-level authentication level may only require entering a password; an intermediate-level authentication level requires SMS verification in addition to a password; and a high-level authentication level may require a combination of multiple biometric technologies such as fingerprint recognition and facial recognition.

[0163] In this embodiment, the standard incremental steps for each authentication level within the range of the user's total relative update of permissions refer to the specified number or difficulty of authentication steps that should be added to each authentication level within the range of the current required authentication levels, based on the user's total relative update of permissions. For example, when the total relative update of permissions is high, additional security question answering steps may be required as standard incremental steps at the intermediate authentication level.

[0164] The beneficial effects of the above technologies are as follows: The step tree extraction submodule optimizes the authentication process from multiple aspects, improving the scientific nature and adaptability of authentication. The permission update quantity determination unit uses complex calculations to calculate the total relative update quantity of permissions based on the user permission update results, accurately quantifying permission changes and providing a precise basis for adjusting authentication steps. The required authentication level range determination unit determines the user's node in the architecture and the required authentication level range based on the dynamic variables of the enterprise organizational structure, ensuring that the authentication level is closely linked to the organization's actual situation. The first extraction unit combines standard authentication steps, standard incremental steps, and the total relative update quantity of permissions to extract the current required authentication step tree for each authentication level from the hybrid authentication step tree, realizing the customization of authentication steps based on permissions and architecture. The second extraction unit extracts another authentication step tree based on behavioral risk assessment values, incorporating behavioral risk into consideration and strengthening risk prevention. Finally, the third extraction unit integrates the results of the first two to obtain the actual authentication step tree, comprehensively integrating multi-dimensional information such as permissions, architecture, and behavioral risk, allowing the authentication process to better adapt to complex scenarios, significantly improving the scientific nature, security, and adaptability of authentication, and ensuring the accuracy and efficiency of the authentication process.

[0165] Example 9:

[0166] Based on embodiment 8, the third interception unit includes:

[0167] The tree structure merging subunit is used to merge the current required authentication step tree and the second current required authentication step tree under each authentication level within the range of the user's current required authentication level extracted from the hybrid authentication step tree, to obtain multiple merged required authentication step trees, wherein the total number of merged required authentication step trees is the same as the total number of current required authentication step trees.

[0168] The authentication efficiency determination subunit is used to determine the authentication efficiency of each authentication step tree required for merging based on the authentication effectiveness and runtime resource consumption of each merging authentication step tree.

[0169] The tree structure filtering sub-unit is used to treat the tree of authentication steps required for maximizing authentication efficiency as the actual authentication step tree.

[0170] In this embodiment, merging the required authentication step trees involves merging the current required authentication step trees for each authentication level within the user's current required authentication level range from the mixed authentication step trees, and the second current required authentication step tree extracted based on the behavioral risk assessment value. For example, the current required authentication step tree for the intermediate authentication level is merged with the second current required authentication step tree for the corresponding intermediate authentication portion extracted based on the behavioral risk assessment value to generate a merged required authentication step tree for the intermediate authentication level. This process is repeated to generate merged required authentication step trees for each authentication level, and the total number of merged required authentication step trees is consistent with the total number of current required authentication step trees for the current required authentication level.

[0171] In this embodiment, the authentication efficiency of each required authentication step tree is determined based on its authentication effectiveness and runtime resource consumption. Authentication effectiveness refers to the tree's ability to accurately verify a user's identity; for example, the sum of the preset authentication effectiveness of all authentication steps in each required authentication step tree can be considered as the overall authentication effectiveness of the tree. Runtime resource consumption refers to the sum of the system resource consumption (CPU, memory, network bandwidth, etc.) of all authentication steps in each required authentication step tree. Authentication efficiency is determined by comprehensively considering these two factors, for example, using the formula: Authentication Efficiency = Authentication Effectiveness / Runtime Resource Consumption.

[0172] The beneficial effects of the above technologies are as follows: The tree structure merging subunit merges authentication step trees extracted based on different criteria, generating multiple authentication step trees required for merging. This integration method fully incorporates the impact of factors such as permissions, organizational structure, and behavioral risks on authentication steps, forming a more comprehensive and targeted set of authentication steps. The authentication efficiency determination subunit determines the authentication efficiency of each required authentication step tree for merging based on authentication effectiveness and runtime resource consumption. It not only focuses on the accuracy and security of authentication but also takes into account the resource consumption during system operation, making the evaluation of authentication step trees more comprehensive and scientific. The tree structure filtering subunit selects the authentication step tree required for merging with the highest authentication efficiency as the actual authentication step tree, ensuring that the final adopted authentication step tree can maximize the use of system resources, improve authentication efficiency, and avoid resource waste while guaranteeing authentication quality. Through this series of operations, the accuracy, efficiency, and rationality of resource utilization of the authentication process are further improved, better adapting to diverse and complex authentication scenarios and providing users with higher-quality and more secure authentication services.

[0173] Example 10:

[0174] This invention provides a method for unified identity authentication and dynamic synchronization of organizational structure across multiple platform clients, including:

[0175] S1: Match the optimal data transmission strategy based on network environment awareness values ​​and the third-party authentication method selected by the user;

[0176] S2: Connect to a third-party authentication platform based on a preset authentication protocol, trigger the authorization process according to the authentication mode of the corresponding client, receive the authorization code of the third-party authentication platform in the corresponding authentication mode through the optimal data transmission strategy, and obtain the authorized user information based on the received authorization code;

[0177] S3: When it is determined that the authorized user information is in the user information stored in the backend and the architecture information of the authorized user information is consistent with the architecture information of the corresponding user in the user information stored in the backend, the authentication success feedback result is returned to the client based on the optimal data transmission strategy.

[0178] When it is determined that the authorized user information is not in the user information stored in the backend, or when it is determined that the architecture information in the authorized user information is inconsistent with the corresponding architecture information in the user information stored in the backend, the authentication failure feedback result is returned to the client based on the optimal data transmission strategy, and the dynamic variables of the enterprise organizational structure relationship network are obtained synchronously and the permission propagation calculation is triggered to obtain the user's permission update result.

[0179] S4: Authenticate the user's identity based on the user's permission update result and the hybrid authentication mode until the final authentication result is obtained.

[0180] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of this invention and its equivalents, this invention also intends to include these modifications and variations.

Claims

1. A multi-platform client unified identity authentication and dynamic organizational structure synchronization system, characterized in that: include: The policy adaptive matching module is used to match the optimal data transmission strategy based on network environment awareness values ​​and the third-party authentication method selected by the user. The third-party authorization and authentication module is used to connect to the third-party authentication platform based on the preset authentication protocol, trigger the authorization process according to the authentication mode of the corresponding client, receive the authorization code of the third-party authentication platform in the corresponding authentication mode through the optimal data transmission strategy, and obtain the authorized user information based on the received authorization code. The first authentication module is used to return a successful authentication feedback result to the client based on the optimal data transmission strategy when it is determined that the authorized user information is in the user information stored in the backend and the architecture information of the authorized user information is consistent with the architecture information of the corresponding user in the user information stored in the backend. The architecture dynamic synchronization module is used to return an authentication failure feedback result to the client based on the optimal data transmission strategy when it is determined that the authorized user information is not in the user information stored in the backend or that the architecture information of the authorized user information is inconsistent with the architecture information of the corresponding user in the user information stored in the backend. It also synchronously obtains the dynamic variables of the enterprise organizational structure relationship network and triggers permission propagation inference to obtain the user's permission update result. The second authentication module is used to authenticate the user's identity based on the user's permission update result and the hybrid authentication mode until the final authentication result is obtained.

2. The multi-platform client unified identity authentication and dynamic organizational structure synchronization system according to claim 1, characterized in that, The strategy adaptive matching module includes: The network environment awareness submodule is used to perceive the network environment characteristics of each authentication request client received simultaneously by the backend at the current moment in real time, and calculate the current client's network environment awareness value based on the real-time network environment characteristics. The transmission strategy filtering submodule is used to determine all matching data transmission strategies for each authentication request client based on the network environment awareness value of each authentication request client received simultaneously by the backend at the current moment. The authentication busyness assessment submodule is used to calculate the relative authentication busyness of the current client under each matching data transmission strategy based on all matching data transmission strategies of all authentication request clients received by the backend at the current moment and the authentication protocol corresponding to the selected third-party authentication method. The optimal transmission strategy determination submodule is used to determine the optimal matching data transmission strategy for the current client among all matching data transmission strategies that has the highest relative authentication busyness.

3. The multi-platform client unified identity authentication and dynamic organizational structure synchronization system according to claim 2, characterized in that, The authentication busyness assessment submodule includes: The resource consumption amplification factor determination unit is used to determine the resource consumption amplification factor for all resource types under each matchable data transmission strategy. The resource consumption coefficient determination unit is used to take the average of the resource consumption ratios of all authentication instances under the authentication protocol corresponding to each third-party authentication method for each resource type as the resource consumption coefficient of the corresponding resource type under the authentication protocol corresponding to the corresponding third-party authentication method. The resource consumption determination unit is used to determine the resource consumption of all resource types under each matching data transmission strategy and the corresponding authentication protocol of each third-party authentication method, based on the resource consumption amplification coefficient of all resource types under each matching data transmission strategy and the resource consumption coefficient of each third-party authentication method. The global resource pressure determination unit is used to normalize the sum of the resource occupancy of the same resource type under the same matching data transmission strategy of all authentication request clients simultaneously received by the backend at the current moment to the maximum resource occupancy of the corresponding resource type, and obtain the global resource pressure of the corresponding resource type of the corresponding matching data transmission strategy. The relative authentication busyness determination unit is used to determine the relative authentication busyness of the current client under each matching data transmission strategy based on the resource consumption of all resource types under each matching data transmission strategy and the authentication protocol corresponding to the corresponding third-party authentication method, and the global resource pressure of each resource type under each matching data transmission strategy.

4. The multi-platform client unified identity authentication and dynamic organizational structure synchronization system according to claim 3, characterized in that, The resource consumption amplification factor determination unit includes: The consumption value determination subunit is used to perform no-load system testing in an isolated environment and record the basic resource consumption value for each resource type. The resource consumption peak determination subunit is used to record the resource consumption peak reached by each resource type when each matching data transmission strategy is individually enabled to execute a preset subtypical authentication request in an isolated environment. The resource consumption amplification factor determination subunit is used to take the ratio of the peak resource consumption reached when each resource type is individually enabled in an isolated environment to execute a preset subtypical authentication request with each matching data transmission strategy to the basic resource consumption value, as the resource consumption amplification factor for the corresponding resource type under each matching data transmission strategy.

5. The multi-platform client unified identity authentication and dynamic organizational structure synchronization system according to claim 1, characterized in that, The third-party authorization and authentication module includes: The first authorization and authentication submodule is used to connect to a third-party authentication platform based on a preset authentication protocol when the client is a desktop client. It also launches the local browser to request login from the third-party authentication platform, generates and displays a login QR code, and receives the authorization code after the user scans the code based on the optimal data transmission strategy. Based on the authorization code, it triggers the authorization process and calls the backend authentication interface to obtain the authorized user information. The second authorization and authentication submodule is used to connect to a third-party authentication platform based on a preset authentication protocol when the client is a mobile device. It then launches the third-party client to trigger the authorization process, receives a temporary authorization code based on the optimal data transmission strategy and sends it to the backend, and calls the backend authentication interface to obtain authorized user information.

6. The multi-platform client unified identity authentication and dynamic organizational structure synchronization system according to claim 1, characterized in that, The architecture dynamic synchronization module includes: The authentication failure feedback submodule is used to return an authentication failure feedback result to the client based on the optimal data transmission strategy when it is determined that the authorized user information is not in the user information stored in the backend or when it is determined that the architecture information of the authorized user information is inconsistent with the architecture information of the corresponding user in the user information stored in the backend. The submodule for obtaining architectural relationship variables is used to obtain dynamic variables of the enterprise's organizational structure relationship network; The permission update submodule is used to perform permission propagation deduction based on dynamic variables and permission inheritance rules of the enterprise's organizational structure relationship network, and obtain the user's permission update results.

7. The multi-platform client unified identity authentication and dynamic organizational structure synchronization system according to claim 1, characterized in that, The second authentication module includes: The Hybrid Authentication Step Tree Construction Submodule is used to build a hybrid authentication step tree for a multi-factor authentication system based on a hybrid authentication mode. The behavioral risk assessment submodule is used to assess the user's behavioral risk and obtain the user's behavioral risk assessment value. The step tree extraction submodule is used to extract the actual authentication step tree from the hybrid authentication step tree based on the user's permission update results and behavioral risk assessment values. The identity authentication submodule is used to authenticate users based on the actual authentication steps tree until the final authentication result is obtained.

8. The multi-platform client unified identity authentication and dynamic organizational structure synchronization system according to claim 7, characterized in that, The step tree extracts sub-modules, including: The permission update quantity determination unit is used to determine the relative update factor of the permission range of all permission update items of the user based on the user's permission update result. The ratio of the original weight of each permission update item of the user to the sum of the original weights of all permission update items of the user is used as the current weight of each permission update item of the user. Based on the current weight of all permission update items of the user, the relative update factor of the permission range of all permission update items of the user is weighted and summed to obtain the total relative update quantity of the user's permissions. The required authentication level range determination unit is used to determine the current node of the user in the enterprise organizational structure relationship network based on the dynamic variables of the enterprise organizational structure relationship network, and to determine the current required authentication level range of the user based on the current node of the user in the enterprise organizational structure relationship network. The first interception unit is used to extract the current required authentication step tree for each authentication level within the user's current required authentication level range from the hybrid authentication step tree, based on the standard authentication steps for each authentication level within the user's current required authentication level range and the standard incremental steps for each authentication level within the user's current required authentication level range of the total permissions relative to the user's current required authentication level range of the hybrid authentication step tree. The second extraction unit is used to extract the second currently required authentication step tree from the hybrid authentication step tree based on the behavioral risk assessment value; The third interception unit is used to extract the current required authentication step tree and the second current required authentication step tree for each authentication level within the range of the user's current required authentication level from the hybrid authentication step tree, and to obtain the actual authentication step tree from the hybrid authentication step tree.

9. The multi-platform client unified identity authentication and dynamic organizational structure synchronization system according to claim 8, characterized in that, The third interception unit includes: The tree structure merging subunit is used to merge the current required authentication step tree and the second current required authentication step tree under each authentication level within the range of the user's current required authentication level extracted from the hybrid authentication step tree, to obtain multiple merged required authentication step trees, wherein the total number of merged required authentication step trees is the same as the total number of current required authentication step trees. The authentication efficiency determination subunit is used to determine the authentication efficiency of each authentication step tree required for merging based on the authentication effectiveness and runtime resource consumption of each merging authentication step tree. The tree structure filtering sub-unit is used to treat the tree of authentication steps required for maximizing authentication efficiency as the actual authentication step tree.

10. A method for unified identity authentication and dynamic synchronization of organizational structure across multiple platform clients, characterized in that: include: S1: Match the optimal data transmission strategy based on network environment awareness values ​​and the third-party authentication method selected by the user; S2: Connect to a third-party authentication platform based on a preset authentication protocol, trigger the authorization process according to the authentication mode of the corresponding client, receive the authorization code of the third-party authentication platform in the corresponding authentication mode through the optimal data transmission strategy, and obtain the authorized user information based on the received authorization code; S3: When it is determined that the authorized user information is in the user information stored in the backend and the architecture information of the authorized user information is consistent with the architecture information of the corresponding user in the user information stored in the backend, the authentication success feedback result is returned to the client based on the optimal data transmission strategy. When it is determined that the authorized user information is not in the user information stored in the backend, or when it is determined that the architecture information in the authorized user information is inconsistent with the corresponding architecture information in the user information stored in the backend, the authentication failure feedback result is returned to the client based on the optimal data transmission strategy, and the dynamic variables of the enterprise organizational structure relationship network are obtained synchronously and the permission propagation calculation is triggered to obtain the user's permission update result. S4: Authenticate the user's identity based on the user's permission update result and the hybrid authentication mode until the final authentication result is obtained.

Images