Unified management method for third-party access

Abstract

The invention discloses a unified management method for third-party access, which is executed by a trunk system to realize unified management and control of third-party applications, and comprises the following steps: S1, token generation and redirection; s2, unified authentication and information distribution; s3, unified metadata management; s4, collecting a unified log; and S5, performing unified security audit and disposal. According to the invention, safe, efficient and standard third-party access can be realized.

Description

Technical Field

[0001] This invention relates to the field of third-party access management technology, and specifically to a unified management method for third-party access. Background Technology

[0002] In the security industry of departmental organizations, the backbone system is built vertically at multiple levels (ministerial, provincial, and municipal) and horizontally by multiple third parties at each level. Both vertical and horizontal integration require connection to the system at the departmental level. Currently, traditional integration methods are cumbersome, costly, and fail to meet the needs of the evolving information technology and ecosystem of the security industry. Administrators must manage access policies, permissions, logs, and users in multiple systems, leading to inefficiency, slow response to business needs, difficulty in maintaining consistency and coordination across disparate systems, and challenges in effective security monitoring and risk auditing. Due to these fragmented management practices, inconsistent security policies, and inefficiencies, there is an urgent need for an innovative, unified management method specifically designed for third-party access. Summary of the Invention

[0003] The technical problem to be solved by this invention is to provide a unified management method for third-party access, so as to achieve secure, efficient and standardized third-party access.

[0004] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is as follows.

[0005] A unified management method for third-party access, executed by the backbone system to achieve unified control over third-party applications, includes the following steps: S1. Token Generation and Redirection: In response to an authenticated user's access request to a third-party application, the backbone system generates a globally unique one-time security token and redirects the user's request to the third-party application access address that includes the security token. S2. Unified Authentication and Information Distribution: The backbone system receives authentication requests initiated by third-party applications using security tokens, verifies the legality of the requests and the validity of the tokens, and returns complete information of the corresponding user to the third-party applications after successful verification, so that the third-party applications can achieve login-free operation. S3. Unified Metadata Management: The backbone system provides unified metadata services for all connected third-party applications. The metadata services include unified registration, maintenance, approval and release of basic code. S4. Unified Log Collection: The backbone system receives and stores user operation logs reported by all third-party applications in accordance with preset specifications through a unified log collection interface; S5. Unified Security Audit and Handling: The backbone system performs data analysis on the log data collected in step S4 based on the preset security audit model to detect abnormal access behavior and perform corresponding security handling operations on the detected abnormal behavior.

[0006] Preferably, step S1 specifically includes: S11. After logging into the backbone system, the user initiates access to a third-party application through its unified portal interface; S12. After the backbone system confirms that the user session is valid, it dynamically generates a 24-bit string containing only numbers and lowercase letters as a one-time security token; S13. The backbone system redirects user requests to a URL pre-configured for third-party applications and appends a security token as a query parameter to that URL.

[0007] Preferably, step S2 specifically includes: S21. The backbone system receives authentication requests from third-party applications through the provided unified authentication interface. The authentication request includes at least: the application identifier, timestamp, security token, and cryptographic signature generated based on the aforementioned parameters and using the application key corresponding to the application. S22. The backbone system verifies the correctness of the encrypted signature and the timeliness of the timestamp; S23. The backbone system verifies whether the security token exists, is within its validity period, and has not been used. S24. After all verifications are successful, the backbone system returns the complete information of the corresponding user through the unified authentication interface.

[0008] Preferably, in step S21, the unified authentication interface is a REST-type interface based on the HTTP protocol, and the parameters of the third-party application authentication request are encoded in form-data format and submitted using the POST method; in step S24, the complete information is returned in JSON format and transmitted using UTF-8 encoding.

[0009] Preferably, in step S21, the method for generating the encrypted signature of the third-party application is as follows: all request parameters except the signature itself are arranged in ascending lexicographical order by parameter name, concatenated into a string using the '&' symbol in the form of "key=value", and then the string is encrypted using the HMac-SHA256 algorithm with the application key corresponding to the application identifier to generate the signature ciphertext. In step S22, when verifying the encrypted signature, the backbone system uses the application key corresponding to the application identifier and employs the HMac-SHA256 algorithm to verify the string of the received request parameters (excluding the signature itself) arranged in ascending order of parameter names and concatenated.

[0010] Preferably, in step S3, the metadata service provides real-time code query services to the connected third-party applications through the application programming interface.

[0011] Preferably, the security audit model in step S5 includes executing the following detection rules: Detect whether the number of accesses by the same user account exceeds a first threshold within a configurable short time window; Detect whether the number of times a user accesses the service exceeds a second threshold during a predefined non-working period; Detect whether the number of access operations performed by a user account exceeds the third threshold within a configurable nighttime time window; Detect whether the same IP address has been accessed by more than the fourth threshold number of different user accounts within a configurable time period; Detect whether the same user account initiates access from more than the fifth threshold number of different IP addresses within a configurable time period.

[0012] Preferably, the safety handling operation in step S5 includes at least one of the following: Send real-time security alerts to the system administrator; The abnormal session is automatically invalidated on the backbone system side, thereby blocking its access to subsequent third-party applications and reporting it to the system administrator. According to the security policy, the user account's access permissions on the backbone system are temporarily frozen and the system administrator is notified.

[0013] Due to the adoption of the above technical solutions, the technical progress achieved by this invention is as follows.

[0014] This invention achieves unified process control: it abstracts third-party access management into a clear, sequential five-step process, realizing unified management of the entire lifecycle from access initiation, identity authentication, data standards, behavior recording to security auditing.

[0015] This invention improves security by constructing a defense-in-depth system through centralized authentication, log aggregation, and unified auditing and processing. This system can promptly detect and respond to cross-system security threats, resulting in a qualitative improvement in overall security.

[0016] This invention improves management efficiency: it completely changes the situation of decentralized management across multiple systems, allowing administrators to perform unified configuration and monitoring only on the backbone system, greatly reducing the complexity and cost of operation and maintenance.

[0017] This invention achieves ecosystem access standardization: standardized processes and interfaces enable new third-party applications to quickly and systematically access the backbone system, greatly promoting the healthy development and iteration of the system ecosystem. Attached Figure Description

[0018] Figure 1 This is a flowchart of the present invention; Figure 2 This is a flowchart of step S1 of the present invention; Figure 3 This is a flowchart of step S2 of the present invention. Detailed Implementation

[0019] The present invention will now be described in further detail with reference to the accompanying drawings and specific embodiments.

[0020] A unified management method for third-party access, executed by the backbone system to achieve unified control over third-party applications, combined with... Figure 1 As shown, it includes the following steps: S1. Token generation and redirection.

[0021] This step serves as the starting point and security entry point for users accessing third-party applications from the backbone system. When a user already logged into the backbone system clicks a link to a third-party application, the backbone system intervenes. First, in response to an authenticated user's access request to the third-party application, the backbone system generates a globally unique, one-time security token. Then, it redirects the user's request to the actual address of the target third-party application, carrying this token. This mechanism ensures that all access to third-party applications is authorized by the backbone system and carries a secure "temporary pass." Figure 2 As shown, the specific steps include: S11. After logging into the backbone system, the user initiates access to a third-party application through its unified portal interface.

[0022] S12. After the backbone system confirms the validity of the user session, it dynamically generates a 24-bit string containing only numbers and lowercase letters as a one-time security token.

[0023] S13. The backbone system redirects user requests to a URL pre-configured for third-party applications and appends a security token as a query parameter to that URL.

[0024] For example, if the developer enters the address of the functional module as http: / / xz.xxx.ga / zhcx / index.jsp, and the randomly generated security token b_token is abc, the backbone system should redirect to http: / / xz.xxx.ga / zhcx / index.jsp?b_token=abc through a uniformly assigned address.

[0025] S2. Unified authentication and information distribution.

[0026] This step is crucial for establishing trust. Upon receiving a request carrying a token, the third-party application cannot process the user's identity independently; it must initiate verification through the backbone system's unified authentication interface. The backbone system is responsible for verifying the request's signature, timestamp, and the validity of the token itself. Once all verifications are successful, the backbone system retrieves the corresponding user data (such as identity, organization, role permissions) from its centrally managed user information database and returns it to the third-party application. Thus, the third-party application can trust and accept the user without managing user credentials, achieving seamless login-free access. Authentication authority is highly centralized in the backbone system, as detailed below: The backbone system receives authentication requests initiated by third-party applications using security tokens, verifies the legitimacy of the request and the validity of the token, and, upon successful verification, returns complete information about the corresponding user to the third-party application, enabling the third-party application to achieve login-free operation. For example... Figure 3 As shown, the specific steps include: S21. The backbone system receives authentication requests from third-party applications through the provided unified authentication interface. The authentication request includes at least the third-party application's application identifier app_id, timestamp, security token b_token, and cryptographic signature sign generated based on the aforementioned parameters.

[0027] In this step, the unified authentication interface is a REST-type interface based on the HTTP protocol. The parameters of the third-party application authentication request are encoded in form-data format and submitted using the POST method. `app_id` is a unique application identifier for the third-party application, used to identify the source application of the request. One `app_id` strictly corresponds to one application secret `app_secret`. Before connecting to the backbone system, the third-party application needs to register with the backbone system. The backbone system will generate and assign a unique pair of `app_id` and `app_secret` for the application. `app_id` and `app_secret` appear in pairs as authentication parameters between the third-party application and the backbone system, and are stored in both systems. The timestamp is a 13-digit timestamp in milliseconds.

[0028] The method for generating the encrypted signature of a third-party application is as follows: All request parameters except the signature itself are sorted in ascending lexicographical order by parameter name, and concatenated into a string using the '&' symbol in the form of "key=value", such as "key1=value1&key2=value2…". Then, the string is encrypted using the application key app_secret corresponding to the requester's application identifier app_id and the HMac-SHA256 algorithm to generate the signature ciphertext.

[0029] S22. The backbone system verifies the correctness of the encrypted signature and the validity of the timestamp.

[0030] In this step, when verifying the encrypted signature, the backbone system uses the application key app_secret corresponding to the requester's application identifier app_id, and employs the HMac-SHA256 algorithm to verify the string of the received request parameters (excluding the signature itself) arranged in ascending lexicographical order and concatenated.

[0031] S23. The backbone system verifies whether the security token exists, is within its validity period, and has not been used.

[0032] S24. After all verifications are successful, the backbone system returns the complete information of the corresponding user through the unified authentication interface.

[0033] In this step, the complete information is returned in JSON format and transmitted using UTF-8 encoding.

[0034] S3. Unified metadata management.

[0035] To ensure data consistency between all third-party applications and the backbone system, the backbone system establishes and maintains a unified metadata standard (e.g., personnel type codes, organization codes, etc.). The backbone system is the sole authoritative source of this fundamental data, responsible for its entire lifecycle management, and provides it to all third-party applications via API, fundamentally eliminating data ambiguity and interface confusion. Specifically: The backbone system provides a unified metadata service for all connected third-party applications. This metadata service includes unified registration, maintenance, approval, and release of the underlying code. The metadata service provides real-time code query services to connected third-party applications through application programming interfaces (APIs).

[0036] S4. Unified Log Collection.

[0037] To build a global security perspective, the backbone system mandates that all third-party applications record user actions according to a standardized data format and periodically report operation logs (including request paths, request parameters, and exception information) to the backbone system's central log repository. This allows all user behavior data across third-party applications to be aggregated, forming a complete and traceable behavioral trajectory. Specifically: The backbone system receives and stores user operation logs reported by all third-party applications in accordance with preset specifications through a unified log collection interface.

[0038] S5. Unified security audit and handling.

[0039] The backbone system performs data analysis on the log data collected in step S4 based on a preset security audit model to detect abnormal access behavior and execute corresponding security handling operations on the detected abnormal behavior, thereby forming a closed loop of security control from behavior recording to discovery and handling.

[0040] The security audit model includes executing the following detection rules: (1) A large number of queries by the same user in a short period of time: Detect whether the number of accesses by the same user account exceeds a first threshold within a configurable short time window.

[0041] (2) Large-scale queries outside of working hours: Detect whether the number of user visits exceeds a second threshold during predefined non-working hours (such as weekends and / or holidays).

[0042] (3) Frequent nighttime visits: Detect whether the number of access operations performed by a user account exceeds the third threshold within a configurable nighttime time window.

[0043] (4) Multiple users accessing from the same IP address: Detect whether the same IP address has been accessed by more than a fourth threshold number of different user accounts within a configurable time period.

[0044] (5) Access by the same user from different IP addresses: Detect whether the same user account initiates access from more than the fifth threshold number of different IP addresses within a configurable time period.

[0045] It should be noted that all parameters of the detection rules can be flexibly configured, including short time windows, non-working hours, nighttime time windows, and various thresholds.

[0046] Safety procedures include at least one of the following: Send real-time security alerts to the system administrator.

[0047] The abnormal session is automatically invalidated on the backbone system side, thereby blocking its access to subsequent third-party applications and reporting it to the system administrator.

[0048] According to the security policy, the user account's access permissions on the backbone system are temporarily frozen and the system administrator is notified. Example 1

[0049] Taking the example of department staff accessing a third-party document management system through the department's cloud platform, the details are as follows: S1. Token Generation and Redirection: After logging into the department's cloud platform, staff members click on the "Digital Archives Management System" third-party application icon on the platform.

[0050] The department's cloud platform generates a token access_token = "g1h2i3j4k5l6m7n8o9p0q1r2s3t4".

[0051] The platform redirects the browser to: https: / / archive.department.gov.cn / main?access_token=g1h2i3j4k5l6m7n8o9p0q1r2s3t4.

[0052] S2. Unified Authentication and Information Distribution: After receiving the request, the "Digital Records Management System" sends a verification request to the authentication interface of the department's cloud platform, https: / / api.cloud.gov.cn / auth / validate.

[0053] The request parameters include: app_id: "ARCHIVE_APP_2024" access_token: "g1h2i3j4k5l6m7n8o9p0q1r2s3t4" timestamp: "1716350000000" sign: "A signature generated using app_secret and based on the HMac-SHA256 algorithm".

[0054] The departmental cloud platform verified the following in sequence: Signature validity (to prevent data tampering); Timestamp validity period (valid for 5 minutes); Security token status (ensure it is not in use); After successful verification, the personnel information will be returned: { "user_id": "DEPT050201", "user_name": "Wang Jing", "department": "Information Management Department", "position": "archive administrator", "role_level": "3", "permissions": ["file_read", "file_upload", "record_query"], "office_phone": "010-12345678", "email": "wangjing@department.gov.cn" } After receiving the information, the "Digital Archives Management System" automatically establishes a local session, eliminating the need for repeated logins.

[0055] S3. Unified metadata management.

[0056] The departmental cloud platform maintains a unified "departmental coding table" and "document classification standard library".

[0057] When a new department code for the "Ministry of Emergency Management" is added, the platform synchronizes it with the "Digital Archives Management System" in real time via API.

[0058] When processing document archiving, the archive system directly calls the unified department code and document classification standard to ensure data consistency across systems.

[0059] S4. Unified Log Collection.

[0060] Wang Jing, a staff member of the department, performed the "historical archives query" operation in the archives system.

[0061] The system generates standard log records: { "log_id": "GOV202405221430001", "access_time": "2024-05-22 14:30:00", "app_code": "ARCHIVE_APP_2024", "user_id": "DEPT050201", "user_ip": "10.20.30.40", "operation_type": "historical_query", "resource_path": " / api / archive / historical", "response_status": "200", "processing_time": "1.8s", "query_scope": "1990-2000" } The system reports logs to the central log database of the department's cloud platform through a unified log interface.

[0062] S5. Unified Security Audit and Handling: The department's cloud platform security center detected an anomaly: Zhang Wei's account frequently downloaded files in batches during non-working hours (20:00-06:00).

[0063] The same IP address was logged in and used by 10 different accounts within 1 hour.

[0064] The platform automatically triggered a safety response.

Claims

1. A unified management method for third-party access, characterized in that: The method is executed by the backbone system to achieve unified management and control of third-party applications, and includes the following steps: S1. Token Generation and Redirection: In response to an authenticated user's access request to a third-party application, the backbone system generates a globally unique one-time security token and redirects the user's request to the third-party application access address that includes the security token. S2. Unified Authentication and Information Distribution: The backbone system receives authentication requests initiated by third-party applications using security tokens, verifies the legality of the requests and the validity of the tokens, and returns complete information of the corresponding user to the third-party applications after successful verification, so that the third-party applications can achieve login-free operation. S3. Unified Metadata Management: The backbone system provides unified metadata services for all connected third-party applications. The metadata services include unified registration, maintenance, approval and release of basic code. S4. Unified Log Collection: The backbone system receives and stores user operation logs reported by all third-party applications in accordance with preset specifications through a unified log collection interface; S5. Unified Security Audit and Handling: The backbone system performs data analysis on the log data collected in step S4 based on the preset security audit model to detect abnormal access behavior and perform corresponding security handling operations on the detected abnormal behavior.

2. The unified management method for third-party access according to claim 1, characterized in that: Step S1 specifically includes: S11. After logging into the backbone system, the user initiates access to a third-party application through its unified portal interface; S12. After the backbone system confirms that the user session is valid, it dynamically generates a 24-bit string containing only numbers and lowercase letters as a one-time security token; S13. The backbone system redirects user requests to a URL pre-configured for third-party applications and appends a security token as a query parameter to that URL.

3. The unified management method for third-party access according to claim 1, characterized in that: Step S2 specifically includes: S21. The backbone system receives authentication requests from third-party applications through the provided unified authentication interface. The authentication request includes at least: the application identifier, timestamp, security token, and cryptographic signature generated based on the aforementioned parameters and using the application key corresponding to the application. S22. The backbone system verifies the correctness of the encrypted signature and the timeliness of the timestamp; S23. The backbone system verifies whether the security token exists, is within its validity period, and has not been used. S24. After all verifications are successful, the backbone system returns the complete information of the corresponding user through the unified authentication interface.

4. The unified management method for third-party access according to claim 3, characterized in that: In step S21, the unified authentication interface is a REST-type interface based on the HTTP protocol. The parameters of the third-party application authentication request are encoded in form-data format and submitted using the POST method. In step S24, the complete information is returned in JSON format and transmitted using UTF-8 encoding.

5. The unified management method for third-party access according to claim 3, characterized in that: In step S21, the method for generating the encrypted signature of the third-party application is as follows: all request parameters except the signature itself are arranged in ascending lexicographical order by parameter name, concatenated into a string using the '&' symbol in the form of "key=value", and then the string is encrypted using the HMac-SHA256 algorithm with the application key corresponding to the application identifier to generate the signature ciphertext. In step S22, when verifying the encrypted signature, the backbone system uses the application key corresponding to the application identifier and employs the HMac-SHA256 algorithm to verify the string of the received request parameters (excluding the signature itself) arranged in ascending order of parameter names and concatenated.

6. The unified management method for third-party access according to claim 1, characterized in that: In step S3, the metadata service provides real-time code query services to the connected third-party applications through the application programming interface.

7. The unified management method for third-party access according to claim 1, characterized in that: The security audit model in step S5 includes executing the following detection rules: Detect whether the number of accesses by the same user account exceeds a first threshold within a configurable short time window; Detect whether the number of times a user accesses the service exceeds a second threshold during a predefined non-working period; Detect whether the number of access operations performed by a user account exceeds the third threshold within a configurable nighttime time window; Detect whether the same IP address has been accessed by more than the fourth threshold number of different user accounts within a configurable time period; Detect whether the same user account initiates access from more than the fifth threshold number of different IP addresses within a configurable time period.

8. The unified management method for third-party access according to claim 1, characterized in that: The safety handling procedure in step S5 includes at least one of the following: Send real-time security alerts to the system administrator; The abnormal session is automatically invalidated on the backbone system side, thereby blocking its access to subsequent third-party applications and reporting it to the system administrator. According to the security policy, the user account's access permissions on the backbone system are temporarily frozen and the system administrator is notified.

Images