A method of user cascading login

Abstract

The application discloses a user cascade login method, and relates to the technical field of authentication and authorization; the method divides a superior business system and a subordinate business system, the superior business system uniformly distributes user departments and roles to the subordinate business system, and uniformly maintains the user departments, organizations and roles; after successfully logging in the superior business system or the subordinate business system, an encrypted login token is acquired, and the encrypted login token carries username, mobile phone number and business system code information; the browser is switched to the business system that needs to be logged in on a page, the current business system identifies the business system code that needs to be logged in according to the encrypted login token, and calls a user information interface of the business system that needs to be logged in; the user information is received by the business system that needs to be logged in, database user department and role permission comparison is carried out, if the user department and the role permission allow to access the business system that needs to be logged in, then permission verification is passed, the business system that needs to be logged in is normally logged in, if the permission verification fails, then the business system that needs to be logged in cannot be accessed, and the user is forced to return to the original system.

Description

Technical Field

[0001] This invention discloses a method relating to the field of authentication and authorization technology, specifically a method for user cascading login. Background Technology

[0002] In recent years, the number of business systems has increased, and most of these systems operate independently, each maintaining its own user system. This forces residents to switch between multiple systems to log in and use usernames and passwords from each system, which greatly affects the user experience.

[0003] Meanwhile, under the existing OAuth 2.0 model, after the system obtains user information, there is still a problem with system permission verification when binding or creating users for the system, which is not conducive to improving the efficiency of business system usage. Summary of the Invention

[0004] This invention addresses the problems of existing technologies by providing a user cascading login method. This method enables unified login, unified authentication, and data cascading across multiple systems in different locations under a unified departmental role framework. It ensures seamless user switching between different business systems, providing a better user experience.

[0005] The specific solution proposed in this invention is as follows:

[0006] This invention provides a method for user cascading login:

[0007] The system is divided into upper-level and lower-level business systems. The upper-level business system uniformly distributes user departments and roles to the lower-level business systems and uniformly maintains user departments, organizational structures and roles.

[0008] After successfully logging in through a superior or subordinate business system, you will obtain an encrypted login token. The encrypted login token carries your username, mobile phone number, and business system code information.

[0009] Switch to the business system that needs to be logged in through the browser on the page, identify the code of the business system that needs to be logged in based on the encrypted login token, and call the user information interface of the business system that needs to be logged in.

[0010] The system receives user information from the business system that requires login, and compares the user's department and role permissions in the database. If the user's department and role permissions allow access to the business system that requires login, the permission verification passes and the user can log in to the business system normally. If the permission verification fails, the user cannot access the business system that requires login and is forced to return to the original system.

[0011] Furthermore, in the aforementioned method for cascading user login, user department and role information is synchronized between the upper-level business system and the lower-level business system through database table exchange or interface interaction.

[0012] Furthermore, in the aforementioned method of user cascading login, the upper-level business system manages all user departments and roles, creates or deletes user departments and roles, and synchronizes them to the lower-level business system in real time via an interface. The lower-level business system only manages internal user departments and roles, and only manages the access permissions of internal user departments and roles.

[0013] Furthermore, in the aforementioned method for user cascading login, the user departments and roles of the subordinate business systems that can access the superior business system are set by the superior business system, and the user departments and roles of the subordinate business systems that can access the superior business system are added to a whitelist.

[0014] Access to sensitive locations can be restricted by higher-level business systems by setting them in lower-level business systems.

[0015] Furthermore, in the aforementioned method for cascading user login, the login token is encrypted using the username and mobile phone number, but the business system code is not encrypted, thus preventing the leakage of user information and simultaneously identifying the business system that the user needs to log in to.

[0016] The present invention also provides a device for user cascading login, including a system management module, a token management module, a login switching module, and an access control module.

[0017] The system management module divides the upper-level business system into lower-level business systems. The upper-level business system uniformly distributes user departments and roles to the lower-level business systems and uniformly maintains user departments, organizational structures, and roles.

[0018] After successfully logging in through a superior or subordinate business system, the token management module obtains an encrypted login token, which carries the username, mobile phone number, and business system code information.

[0019] The login switching module switches to the business system that needs to be logged in through the browser on the page. It identifies the code of the business system that needs to be logged in based on the encrypted login token and calls the user information interface of the business system that needs to be logged in.

[0020] The access control module receives user information from the business system that requires login, compares the user's department and role permissions in the database, and if the user's department and role permissions allow access to the business system that requires login, the permission verification passes and the user can log in to the business system normally. If the permission verification fails, the user cannot access the business system that requires login and is forced to return to the original system.

[0021] Furthermore, the user cascading login device also includes a data synchronization module, which synchronizes user department and role information between the upper-level business system and the lower-level business system through database table exchange or interface interaction.

[0022] Furthermore, in the aforementioned user cascading login device, the system management module manages all user departments and roles through the upper-level business system, creates or deletes user departments and roles, and synchronizes them to the lower-level business system in real time via an interface. The lower-level business system only manages internal user departments and roles, and only manages the access permissions of internal user departments and roles.

[0023] Furthermore, in the aforementioned user cascading login device, the access control module sets the user departments and roles of the lower-level business systems that can access the upper-level business system through the upper-level business system, and adds the user departments and roles of the lower-level business systems that can access the upper-level business system to the whitelist.

[0024] Access to sensitive locations can be restricted by higher-level business systems by setting them in lower-level business systems.

[0025] Furthermore, the aforementioned user cascading login device also includes an encryption module. The encryption module encrypts the login token using the username and mobile phone number, but does not encrypt the business system code, thus preventing the leakage of user information. At the same time, it can identify the business system that the user needs to log in to.

[0026] The advantages of this invention are:

[0027] This invention enables users across multiple systems in different locations to achieve unified login, unified authentication, and data cascading under a unified departmental role planning. It ensures seamless system switching for users across different business systems in different cities, providing a better user experience. Attached Figure Description

[0028] Figure 1 This is a schematic diagram of the interactive process of the method of the present invention.

[0029] Figure 2 This is a schematic diagram of the application framework of the present invention. Detailed Implementation

[0030] The present invention will be further described below with reference to the accompanying drawings and specific embodiments, so that those skilled in the art can better understand and implement the present invention. However, the embodiments described are not intended to limit the present invention.

[0031] Example 1

[0032] This invention provides a method for user cascading login, comprising:

[0033] The system is divided into upper-level and lower-level business systems. The upper-level business system uniformly distributes user departments and roles to the lower-level business systems and uniformly maintains user departments, organizational structures, and roles.

[0034] After successfully logging in through a superior or subordinate business system, an encrypted login token is obtained. This token carries the username, mobile phone number, and business system code information. The login token is encrypted using the username and mobile phone number, but the business system code is not encrypted, thus preventing user information leakage and simultaneously identifying the business system the user needs to log in to.

[0035] The browser switches to the business system that needs to be logged in on the page. The current business system identifies the code of the business system that needs to be logged in based on the encrypted login token, and calls the user information interface of the business system that needs to be logged in.

[0036] The system receives user information from the business system that requires login, and compares the user's department and role permissions in the database. If the user's department and role permissions allow access to the business system that requires login, the permission verification passes and the user can log in to the business system normally. If the permission verification fails, the user cannot access the business system that requires login and is forced to return to the original system.

[0037] This invention enables unified login, unified authentication, and data cascading for users across multiple systems in different locations, under a unified departmental role framework. It ensures seamless user switching between different business systems, providing a better user experience.

[0038] Example 2

[0039] Based on Embodiment 1, the method of the present invention can further synchronize user department and role information by using database table exchange or interface interaction between the upper-level business system and the lower-level business system.

[0040] The upper-level business system manages all user departments and roles, and creates or deletes user departments and roles. The data is synchronized to the lower-level business system in real time via an interface. The lower-level business system only manages internal user departments and roles, and only manages the access permissions of internal user departments and roles.

[0041] The system can further configure the user departments and roles of the subordinate business systems that can access the superior business system through the superior business system, and add the user departments and roles of the subordinate business systems that can access the superior business system to the whitelist;

[0042] This involves setting up sensitive locations in lower-level business systems to prevent higher-level business systems from accessing them, similar to a blacklist.

[0043] Example 3

[0044] The present invention also provides a device for user cascading login, including a system management module, a token management module, a login switching module, and an access control module.

[0045] The system management module divides the upper-level business system into lower-level business systems. The upper-level business system uniformly distributes user departments and roles to the lower-level business systems and uniformly maintains user departments, organizational structures, and roles.

[0046] After successfully logging in through a superior or subordinate business system, the token management module obtains an encrypted login token, which carries the username, mobile phone number, and business system code information.

[0047] The login switching module switches to the business system that needs to be logged in through the browser on the page. It identifies the code of the business system that needs to be logged in based on the encrypted login token and calls the user information interface of the business system that needs to be logged in.

[0048] The access control module receives user information from the business system that requires login, compares the user's department and role permissions in the database, and if the user's department and role permissions allow access to the business system that requires login, the permission verification passes and the user can log in to the business system normally. If the permission verification fails, the user cannot access the business system that requires login and is forced to return to the original system.

[0049] The information interaction and execution process between the modules in the above-mentioned device are based on the same concept as the method embodiment of the present invention, and the specific details can be found in the description in the method embodiment of the present invention, and will not be repeated here.

[0050] Similarly, the device of this invention enables unified login, unified authentication, and data cascading for users across multiple systems in different locations under a unified departmental role planning. This ensures seamless switching of users between different business systems in different cities, providing a better user experience.

[0051] It should be noted that not all steps and modules in the above processes and device structures are mandatory; some steps or modules can be omitted as needed. The execution order of each step is not fixed and can be adjusted as required. The system structure described in the above embodiments can be a physical structure or a logical structure. That is, some modules may be implemented by the same physical entity, or some modules may be implemented by multiple physical entities, or they may be jointly implemented by certain components in multiple independent devices.

[0052] The above-described embodiments are merely preferred embodiments provided to fully illustrate the present invention, and the scope of protection of the present invention is not limited thereto. Equivalent substitutions or modifications made by those skilled in the art based on the present invention are all within the scope of protection of the present invention. The scope of protection of the present invention is defined by the claims.

Claims

1. A method for user cascading login, characterized by: The system is divided into upper-level and lower-level business systems. The upper-level business system uniformly distributes user departments and roles to the lower-level business systems and uniformly maintains user departments, organizational structures, and roles. The upper-level business system manages all user departments and roles, creates or deletes user departments and roles, and synchronizes them to the lower-level business systems in real time via an interface. The lower-level business systems only manage internal user departments and roles, and only manage the access permissions of internal user departments and roles. After successfully logging in through a superior or subordinate business system, you will obtain an encrypted login token. The encrypted login token carries your username, mobile phone number, and business system code information. Switch to the business system that needs to be logged in through the browser on the page, identify the code of the business system that needs to be logged in based on the encrypted login token, and call the user information interface of the business system that needs to be logged in. The system configures the user departments and roles of the subordinate business systems that can access the superior business system, and adds the user departments and roles of the subordinate business systems that can access the superior business system to the whitelist. By setting sensitive locations in lower-level business systems to prevent higher-level business systems from accessing them; The system receives user information from the business system that requires login, and compares the user's department and role permissions in the database. If the user's department and role permissions allow access to the business system that requires login, the permission verification passes and the user can log in to the business system normally. If the permission verification fails, the user cannot access the business system that requires login and is forced to return to the original system.

2. The user cascading login method according to claim 1, characterized in that: User department and role information is synchronized between the upper-level and lower-level business systems through database table exchange or interface interaction.

3. The user cascading login method according to claim 1, characterized in that: The login token is encrypted using the username and mobile phone number, but the business system code is not encrypted, which avoids the leakage of user information and can identify the business system that the user needs to log in to.

4. A device for user cascading login, characterized in that: It includes a system management module, a token management module, a login switching module, and an access control module. The system management module divides the system into upper-level and lower-level business systems. The upper-level business system uniformly distributes user departments and roles to the lower-level business systems and uniformly maintains user departments, organizational structures, and roles. The system management module manages all user departments and roles through the upper-level business system, creates or deletes user departments and roles, and synchronizes them to the lower-level business systems in real time via an interface. The lower-level business systems only manage internal user departments and roles, and only manage the access permissions of internal user departments and roles. After successfully logging in through a superior or subordinate business system, the token management module obtains an encrypted login token, which carries the username, mobile phone number, and business system code information. The login switching module switches to the business system that needs to be logged in through the browser on the page. It identifies the code of the business system that needs to be logged in based on the encrypted login token and calls the user information interface of the business system that needs to be logged in. The access control module sets the user departments and roles of the subordinate business systems that can access the superior business system through the superior business system, and adds the user departments and roles of the subordinate business systems that can access the superior business system to the whitelist; By setting sensitive locations in lower-level business systems to prevent higher-level business systems from accessing them; The access control module receives user information from the business system that requires login, compares the user's department and role permissions in the database, and if the user's department and role permissions allow access to the business system that requires login, the permission verification passes and the user can log in to the business system normally. If the permission verification fails, the user cannot access the business system that requires login and is forced to return to the original system.

5. The user cascading login device according to claim 4, characterized in that: It also includes a data synchronization module, which synchronizes user department and role information between the upper-level business system and the lower-level business system through database table exchange or interface interaction.

6. The user cascading login device according to claim 4, characterized in that: It also includes an encryption module that uses the username and mobile phone number to encrypt the login token but does not encrypt the business system code, thus preventing the leakage of user information. At the same time, it can identify the business system that the user needs to log in to.

Images