Webpage access control method and device, electronic equipment and program product

Abstract

The invention discloses a webpage access control method, which can be implemented by a first platform or by an access control system arranged on the side of the first platform, and comprises the following steps: acquiring a first session token generated after a user performs first identity authentication on the first platform, the webpage of the first platform is provided with an embedding framework used for embedding webpage contents of the second platform; acquiring a second session token generated after the user performs second identity authentication on a second platform; verifying simultaneous validity and user identity consistency of the first session token and the second session token; and controlling the access to the webpage content of the second platform according to the verification results of the simultaneous validity and the user identity consistency. According to the webpage access control method disclosed by the invention, unauthorized access caused by the fact that the fixed link in the embedded framework is forwarded and reused can be avoided, the leakage risk of the page and the data in a cross-platform access scene is remarkably reduced, and the data security in cross-platform access is enhanced.

Description

Technical Field

[0001] This disclosure relates to the field of computer access control technology, specifically to web page access control methods and devices, and also to related electronic devices and program products. Background Technology

[0002] Currently, cross-platform content embedding frameworks are widely used. These frameworks allow for the convenient loading of page content from another platform into a page on one platform.

[0003] However, the embedded page content is usually loaded through links in the embedded frame. These links are easily obtained illegally, which can lead to unauthorized access and dissemination of the embedded page content by third parties, resulting in data security issues such as data leaks.

[0004] In response, some protective measures have been proposed, such as protecting embedded links through front-end encryption or hiding the links. However, these measures often have a high risk of being cracked, and once the permalink is exposed, third parties can freely and illegally reuse it.

[0005] Therefore, it is necessary to provide a new access control scheme to enhance page access control in cross-platform embedded scenarios and thereby reduce information security risks.

[0006] The background description is provided for the purpose of understanding the relevant technologies in this field and is not intended as an admission of prior art. Summary of the Invention

[0007] Accordingly, this disclosure provides a web page access control method, apparatus, electronic device, and program product, which at least partially solves the above-mentioned technical problems.

[0008] In a first aspect, embodiments of this disclosure provide a webpage access control method, implemented by a first platform or by an access control system deployed on the first platform, the method including:

[0009] Obtain the first session token generated after the user performs first identity authentication on the first platform, wherein the webpage of the first platform has an embedding frame for embedding webpage content of the second platform.

[0010] Obtain the second session token generated after the user performs second identity authentication on the second platform;

[0011] Verify the validity and consistency of the user identity of both the first and second session tokens;

[0012] Based on the verification results of simultaneous validity and user identity consistency, access to the web page content of the second platform is controlled.

[0013] Optionally, before obtaining the first session token and the second session token, the method further includes:

[0014] In response to a trigger event that accesses web page content on the second platform, the authentication process of the first platform and the second platform is executed, and the first session token and the second session token are generated respectively.

[0015] Optionally, the step of executing the identity authentication process of the first platform and the second platform, and generating the first session token and the second session token respectively, includes:

[0016] Obtain and verify the first login credentials provided by the user, and obtain the first verification result;

[0017] Based on the first verification result, generate a first session token bound to the user's identity;

[0018] The first session token is stored in the session management system of the first platform or locally.

[0019] Optionally, the step of executing the identity authentication process of the first platform and the second platform, and generating the first session token and the second session token respectively, includes:

[0020] Obtain and verify the second login credentials provided by the user to obtain a second verification result;

[0021] Based on the second verification result, a second session token bound to the user's identity is generated;

[0022] The second session token is stored in the session management system of the second platform.

[0023] Optionally, verifying the simultaneous validity of the first session token and the second session token, and the consistency of the user identity, includes:

[0024] A cross-domain message is sent from the embedded framework to the authentication interface of the first platform via a cross-domain messaging channel, the cross-domain message including a second session token;

[0025] Extract the second session token from the received cross-domain message and verify the validity of the second session token;

[0026] Verify the validity of the first session token maintained by the first platform;

[0027] The user identity is determined by comparing the user identifier associated with the first session token and the second session token.

[0028] Optionally, the method further includes:

[0029] Establish a session verification service, which is used to store the mapping relationship between the first and second session tokens and the user identity;

[0030] The verification of the simultaneous validity of the first session token and the second session token, and the consistency of the user identity, includes:

[0031] Submit a query request containing the user identifier to the session verification service;

[0032] The session verification service retrieves the corresponding first session token and second session token from the session mapping relationship based on the user identifier;

[0033] Verify that both retrieved session tokens are still valid;

[0034] Confirm that the two session tokens are mapped to the same user unique identifier to complete the consistency verification.

[0035] Optionally, controlling access to the webpage content of the second platform based on the verification results of simultaneous validity and user identity consistency includes:

[0036] When the first session token and the second session token are both valid and the user identities are consistent, the webpage content of the second platform is loaded into the webpage of the first platform;

[0037] Loading of the webpage content is prohibited if either the first session token or the second session token is invalid or the user identity is inconsistent.

[0038] Optionally, the method further includes:

[0039] While loading the webpage content of the second platform, continuously verify the validity of the first session token and the second session token;

[0040] In response to the detection that either the first session token or the second session token has expired, access to the web page content is terminated.

[0041] Optionally, the validity of continuously acquiring the first session token and the second session token includes:

[0042] A first push channel is established between the webpage and the first platform server;

[0043] A second push channel is established between the loaded webpage content and the second platform server;

[0044] The webpage receives a first failure notification pushed by the first platform server when the first session expires through the first push channel.

[0045] Based on the first invalidation notification, the first session token is marked as invalid;

[0046] The loaded webpage content receives a second failure notification pushed by the second platform server when the second session expires through the second push channel.

[0047] If the loaded webpage content receives a second failure notification, the loaded webpage content shall transmit the second failure notification to the webpage.

[0048] According to the second invalidation notification, the second session token is marked as invalid.

[0049] In a second aspect, embodiments of this disclosure provide a webpage access control device, which may include:

[0050] The first acquisition module is configured to acquire the first session token generated by the user after performing first identity authentication on the first platform, wherein the webpage of the first platform has an embedding frame for embedding webpage content of the second platform.

[0051] The second acquisition module is configured to acquire the second session token generated by the user after performing second identity authentication on the second platform;

[0052] The verification module is configured to verify the validity of the first session token and the second session token, as well as the consistency of the user's identity.

[0053] The access control module is configured to control access to the webpage content of the second platform based on the verification results of simultaneous validity and user identity consistency.

[0054] In a third aspect, embodiments of this disclosure provide an electronic device that may include: a processor and a memory storing a computer program, the processor being configured to implement the method as described in the first aspect when the computer program is executed.

[0055] In a fourth aspect, embodiments of this disclosure provide a program product including a computer program, wherein the computer program, when executed by a processor, implements the method as described in the first aspect.

[0056] The method of this disclosure obtains a first session token generated after the user performs first identity authentication on a first platform; obtains a second session token generated after the user performs second identity authentication on a second platform; verifies the simultaneous validity of the first and second session tokens and the consistency of the user's identity; and controls access to the webpage content on the second platform based on the verification results of the simultaneous validity and the consistency of the user's identity. This method obtains a first session token and a second session token on the first platform carrying the embedded frame and the second platform to which the embedded page belongs, respectively. It only allows loading of the webpage content corresponding to the embedded frame when both tokens are valid and correspond to the same user in the same verification. If either the first or second session token expires, is revoked, or the identities corresponding to the two tokens are inconsistent, loading of the webpage content is immediately blocked. This achieves access control based on simultaneous online verification and identity consistency verification on both ends, thereby avoiding unauthorized access caused by the forwarding and reuse of fixed links in the embedded frame, significantly reducing the risk of page and data leakage in cross-platform access scenarios, and enhancing data security in cross-platform access.

[0057] Other optional features and technical effects of the embodiments of this disclosure are described in part below, and in part will be apparent from reading this document. Attached Figure Description

[0058] The embodiments of this disclosure will now be described in detail with reference to the accompanying drawings. The elements shown are not limited to the scale shown in the drawings, and the same or similar reference numerals in the drawings denote the same or similar elements, wherein:

[0059] Figure 1 A first flowchart of a webpage access control method according to an embodiment of the present disclosure is shown;

[0060] Figure 2 A second flowchart of a webpage access control method according to an embodiment of the present disclosure is shown;

[0061] Figure 3 A third flowchart of a web page access control method according to an embodiment of the present disclosure is shown;

[0062] Figure 4 A fourth flowchart of a web page access control method according to an embodiment of the present disclosure is shown;

[0063] Figure 5 A fifth flowchart of a webpage access control method according to an embodiment of the present disclosure is shown;

[0064] Figure 6 A sixth flowchart of a web page access control method according to an embodiment of the present disclosure is shown;

[0065] Figure 7 An exemplary block diagram of a web page access control device according to an embodiment of the present disclosure is shown; and

[0066] Figure 8 An exemplary structural diagram of an electronic device for implementing the methods of embodiments of the present disclosure is shown. Detailed Implementation

[0067] To make the objectives, technical solutions, and advantages of this disclosure clearer, the disclosure will be further described in detail below with reference to specific embodiments and accompanying drawings. Here, the illustrative embodiments and descriptions of this disclosure are used to explain this disclosure, but are not intended to limit this disclosure.

[0068] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0069] All information, data, and signals disclosed herein are authorized by the user or by all parties, and the collection, use, and processing of such data comply with the relevant laws, regulations, and standards of the relevant countries and regions.

[0070] In this embodiment of the disclosure, an embedded frame is a standard tag element in web development technology, used to embed and display content from another page that is logically independent of the current page. Specifically, when the current page loads an embedded frame, it accesses the link address contained in the embedded frame, thereby rendering page content from another platform within the current page.

[0071] As mentioned earlier, embedded frames are widely used in cross-platform embedding scenarios, including but not limited to cross-platform internet access systems, multi-device access control systems for the Industrial Internet of Things (IIoT), financial business systems, and enterprise security control systems. For example, a page on platform A can embed an embedded frame pointing to a page on platform B, allowing users on platform A to conveniently access page information provided by platform B through the embedded frame. Understandably, platform B may not want users outside of platform A to access the page information provided indiscriminately, for example, if the page contains non-public information or data, or involves critical control pages. However, since embedded pages are typically loaded via links within the embedded frame, these links may be obtained and reused by third parties using developer tools or network packet sniffing, potentially leading to the risk of unauthorized access and dissemination of the embedded page's data.

[0072] In response, this disclosure provides a webpage access control method in some embodiments, which can be widely applied to cross-platform content embedding scenarios. It can achieve access control of cross-platform embedded content based on multi-terminal verification, thereby avoiding unauthorized access caused by the reuse of fixed links, reducing the risk of data leakage and improving data security.

[0073] In some embodiments of this disclosure, the webpage access control method may be implemented by a first platform or by an access control system deployed on the first platform. In this embodiment, the first platform refers to the platform where the page with the embedded frame resides, and the platform providing the page content for embedding the embedded frame may be referred to as the second platform. In some embodiments, the embedded frame may include an HTML (HyperText Markup Language) iframe element. In other embodiments, the embedded frame may also include... <object>Label, <embed> Tags or other containers that dynamically retrieve and insert external page content via scripts fall within the scope of this disclosure. In some embodiments, the access control system on the first platform side includes, but is not limited to, security / access control modules or proxy services for uniformly enforcing access control policies.

[0074] In some embodiments of this disclosure, reference is made to Figure 1 The webpage access control method may include the following 110, 120, 130, 140 and 150.

[0075] 110: In response to the triggering event of accessing web page content on the second platform, execute the identity authentication process of the first platform and the second platform, and generate the first session token and the second session token respectively.

[0076] In different embodiments of this disclosure, step 110 and its sub-steps are optional. In some embodiments, the first session token and the second session token may be generated before accessing web page content on the second platform. In one example, a user may complete an authentication process and generate a first session token when logging into the first platform. Similarly, a user may complete an authentication process on the second platform and generate a second session token before accessing web page content.

[0077] In other embodiments, particularly when applying the methods of this disclosure to access control scenarios for web page content, the execution of step 110 described above can be triggered when accessing web page content on a second platform to generate a first session token and a second session token. In some embodiments, even if a first session token and a second session token already exist, step 110 described above can still be performed as an enhanced verification step to generate (latest) first and second session tokens, and this disclosure does not impose any limitations on this.

[0078] In some embodiments of this disclosure, the authentication processes of the first platform and the second platform may be performed sequentially. In optional embodiments, it may be determined whether the authentication process of the second platform is required based on the authentication result of the first platform, which will be described in detail below.

[0079] In some embodiments of this disclosure, the session token includes a data credential generated by the platform or a trusted component for the user to characterize the platform login / authentication status. Verifying the session token can determine whether the user is in a legitimate login state on the platform and execute subsequent access control accordingly. In this embodiment, the first session token and the second session token include, but are not limited to, opaque tokens or encrypted structured tokens. In some embodiments, the first session token may be stored on the first platform or in an access control system deployed on the first platform, and stored on the user's terminal using restricted cookies or protected local storage for subsequent querying and verification.

[0080] In one specific embodiment, after User 1 logs into the first platform (i.e., the platform where the page carrying the embedded frame is located) using an account and password and completes identity authentication, the first platform generates a first session token (referred to as Session A) bound to User 1's identity and stores Session A in the form of a cookie (small text file) on the user's terminal. Thus, during subsequent accesses, the first platform can verify User 1's login status and maintain session validity based on Session A. For explanation, the session tokens in this embodiment include, but are not limited to, opaque tokens and structured tokens. The opaque token value itself can serve as the session ID, and session attributes such as permissions / expiration are stored in the server-side session record, which can be verified through the mapping between the token value and the session record. The encrypted structured token can carry user identifier (UID), permissions, issuance / expiration time, etc., and can be verified through the decryption field. In some embodiments of this disclosure, the first session token and the second session token are generated by different platforms, and the first session token and the second session token are stored on different platforms (sides), which will be described in detail below.

[0081] In some embodiments of this disclosure, reference is made to Figure 2 Step 110 may include the following steps 111, 112, 113, 114, 115 and 116.

[0082] 111: Obtain and verify the first login credentials provided by the user, and obtain the first verification result.

[0083] In some embodiments of this disclosure, the first login credential includes, but is not limited to, a username, password, and hardware key signature. In this embodiment, verification can be performed based on the first login credential, including but not limited to the existence of the account corresponding to the first login credential, authorization status, and authorization validity period, thereby obtaining a first verification result. In this embodiment, the verification process in step 111 can also be referred to as the (first) identity authentication step. In some embodiments, the first verification result may include at least one verification item and the corresponding verification result. In a specific embodiment, the first verification result R1 is "user_id:1234, account: valid, password: correct, user_level: L2, scope: embed-read,expiry date: 20260101". It is understood that in other embodiments, other items can also be verified based on the first login credential, and this disclosure does not limit this.

[0084] 112: Based on the first verification result, generate the first session token bound to the user's identity.

[0085] In some embodiments of this disclosure, as previously described, the first session token can be constructed as a structured token, including a user identifier, a unique identifier, an issuance time, an expiration time, a validity flag, and a scope of permissions. Accordingly, in this embodiment, the binding of the first session token to the user identity can be achieved by writing the user identifier into the token. In an optional embodiment, as previously described, the first session token can also be constructed as an opaque token that does not contain user information. Instead, the binding of the first session token to the user identity is achieved by recording the mapping relationship between the token's unique identifier and the user identity, thereby further enhancing security.

[0086] In one specific embodiment, after receiving the first verification result R1 = "user_id: 1234, account: valid, password: correct, user_level: L2, scope: embed-read, expirydate: 20260101", the first platform generates a first session token T1 based on the opaque token method: firstly, a 32-byte random value is generated and encoded into the string "1a2d…eeff", which serves as the token value; then, based on the first verification result R1, the session data to be written "user_id=1234, scope=embed-read, user_level=L2, status=Active" is filled to form a session record rec={jti: "1a2d…eeff", user_id: "1234", authorization_valid_to: "2026-01-01T00:00:00Z", status: "Active", scope: "embed-read", user_level: "L2"}. It is understood that, in this embodiment, the first session token T1 can be interpreted as an encrypted index value. During token verification, the corresponding record rec can be found in the stored session table based on the first session token T1. If no record is found, the token is deemed invalid. If a record is found, the status and validity period are checked, and the token is deemed valid only if predetermined judgment rules are met. This disclosure does not limit the specific judgment rules. In other embodiments, the token may also directly store the data in the first verification result R1, in which case verification can be performed directly based on the data stored in the token.

[0087] 113: Store the first session token in the session management system of the first platform or locally.

[0088] In some embodiments of this disclosure, the session management system of the first platform may store a first session token and optionally save the mapping relationship between the first session token and the user's identity. In some embodiments, the first session token may also be stored on the first platform (i.e., the user's client) in the form of a restricted cookie or the like.

[0089] 114: Obtain and verify the second login credentials provided by the user, and obtain the second verification result.

[0090] In different embodiments of this disclosure, the step of obtaining and verifying the second login credential provided by the user is optional. In some embodiments, whether to perform step 114 can be determined based on whether the first verification result / first token has been generated. In some embodiments, a detailed description of verifying the second login credential and obtaining the second verification result in step 114 can be found in the description of the login credential and verification result in step 111 above, and will not be repeated here. In some embodiments, the verification process in step 114 can also be referred to as the (second) identity authentication step. However, it is understood that this does not mean that step 114 needs to adopt the same specific implementation means as step 113. In some embodiments, different means than step 111 are used to generate the verification result, that is, the second identity authentication step being different from the first identity authentication step can be advantageous.

[0091] 115: Based on the second verification result, generate a second session token bound to the user's identity.

[0092] In some embodiments of this disclosure, a detailed description of step 115 can be found in the description of step 112 above, and will not be repeated here. In this embodiment, the user includes the same user as in step 114 above.

[0093] 116: Store the second session token in the session management system of the second platform.

[0094] In some embodiments of this disclosure, the specific description of step 116 is similar to that described in step 114 above, except that the second session token can be stored in the session management system of the second platform. It should be understood that the second session token is stored independently of the first platform. In this embodiment, the second session token is not stored in the user's local browser. This minimizes the possibility of simultaneous leakage of both the first and second session tokens, ensuring the security and reliability of multi-terminal verification based on the session token.

[0095] 120: Obtain the first session token generated after the user completes the first identity authentication on the first platform.

[0096] In some embodiments of this disclosure, the first session token may reflect the user's current session state on the first platform and be associated with the user's authentication result. In this embodiment, a detailed description of the first session token can be found in steps 111-113 above, and will not be repeated here.

[0097] 130: Obtain the second session token generated after the user performs second identity authentication on the second platform.

[0098] In some embodiments of this disclosure, similarly, the second session token can reflect the user's current session state on the second platform and is associated with the user's authentication result. Therefore, by verifying the second session token, it can be determined whether the user is in a legitimate login state on the second platform. In this embodiment, for example, in step 130 above, the second session token is generated by the user after performing second identity authentication on the second platform and then stored on the second platform. The specific format of the second session token can be referred to the description in steps 115-116 above, and will not be repeated here.

[0099] 140: Verify the validity of both the first and second session tokens and the consistency of the user identity.

[0100] In some embodiments of this disclosure, simultaneous validity means that both the first session token and the second session token are determined to be valid in the same verification process, wherein the term "valid" includes that the session tokens meet the validity rules of their respective platforms. It is understood that in some embodiments, it may be advantageous for the validity rules for the first and second session tokens to be different.

[0101] In some embodiments of this disclosure, the generation interval of the two tokens can be verified during or after verifying the simultaneous validity and user identity consistency of the first and second session tokens. Specifically, the generation time of the first and second session tokens can be obtained, the time difference between the two generation times can be calculated, and it can be verified whether the time difference is within a preset time window. In this embodiment, if the time difference is within the preset time window, the generation interval verification is deemed successful; otherwise, the generation interval verification is deemed unsuccessful, and access to the webpage content is denied. In a specific embodiment, the preset time window is set to, for example, 120 seconds (2 minutes), requiring that the generation time interval between the first and second session tokens does not exceed 2 minutes. In some embodiments, the preset time window can be adjusted according to actual security needs and business scenarios, for example, set to 30 seconds, 60 seconds, 180 seconds, etc., and this disclosure does not limit this.

[0102] In some embodiments of this disclosure, a strong association between two session tokens is established in the time dimension through the above-described generation interval verification. This ensures that the two tokens are specifically paired and generated by the same user for this embedded access, thereby effectively preventing unauthorized third parties from illegally accessing the embedded page by piecing together valid first and second session tokens from their respective platforms. This further enhances access control security in cross-platform embedded scenarios. In some embodiments of this disclosure, user identity consistency refers to the same user associated with the first and second session tokens in the same verification. In one example, user identity consistency verification is confirmed as successful if the user identifier determined by the first session token matches the user identifier determined by the second session token.

[0103] In some embodiments of this disclosure, the steps of verifying the simultaneous validity of the first session token and the second session token and the consistency of the user identity may include steps 141, 142, 143 and 144 below.

[0104] 141: Send cross-domain messages from the embedded framework to the authentication interface of the first platform via a cross-domain messaging channel.

[0105] In some embodiments of this disclosure, cross-domain messaging includes a mechanism for exchanging data between window objects from different origins via an interface under the same-origin policy of page components (such as browsers). In one example, for instance, an embedded frame (second platform page) may pass cross-domain messages to an authentication interface on the first platform page side without directly accessing its parent page (first platform page). In some embodiments, the cross-domain message may include the aforementioned second session token.

[0106] 142: Extract the second session token from the received cross-domain message and verify the validity of the second session token.

[0107] In some embodiments of this disclosure, the second session token may include, for example, the aforementioned encrypted structured token. In one specific embodiment, the second session token is a structured token encrypted using the public key of the first platform. After receiving the second session token, the first platform can use the private key paired with the public key to decrypt it and obtain the information in the token, and then determine whether the second session token is valid based on this information.

[0108] 143: Verify the validity of the first session token maintained by the first platform.

[0109] In some embodiments of this disclosure, the first session token is in the form of an opaque token, and the verification process is performed, for example, by a session management system on the first platform side. In this embodiment, the session management system can attempt to search whether a corresponding record is stored in the session management system based on the first session token value and further determine the validity of the first session token value. The determination steps of the session management system in this embodiment can refer to the description in step 112 above, and will not be repeated here. In other embodiments, the first session token is in the form of an encrypted structured token. The session management system can perform signature verification on the structured token and decrypt it to obtain the information contained in the token, and perform validity verification based on the token information. The verification process includes, but is not limited to, whether the current token has exceeded its authorization period, etc., and this disclosure does not impose any restrictions on this.

[0110] 144: Compare the user identifiers associated with the first session token and the second session token to determine the consistency of the user identity.

[0111] In some embodiments of this disclosure, the user identifiers associated with the first session token and the second session token can be obtained separately. In these embodiments, the specific acquisition method varies depending on the form of the token, for example, referring to the aforementioned descriptions of opaque tokens and encrypted structured tokens, which will not be repeated here. In some embodiments of this disclosure, the first platform and the second platform can maintain the same (unique) user identifier. Therefore, if the user identifiers associated with the first session token and the second session token are the same, the user identity is determined to be consistent; otherwise, the user identity is determined to be inconsistent. In other embodiments of this disclosure, the user identifiers associated with the first session token and the second session token may be inconsistent, but a unique correspondence may exist between the user identifiers of the same user on different platforms (e.g., when the first platform and the second platform have a pre-set cross-platform ID mapping table). In this case, if the user identifiers corresponding to the two tokens satisfy the correspondence, the user identity is determined to be consistent; otherwise, the user identity is determined to be inconsistent.

[0112] In some embodiments of this disclosure, the simultaneous validity of the first session token and the second session token and the verification of user identity consistency can also be based on a separately configured session verification service. This approach can further improve the security of the verification process, which will be described in detail below.

[0113] Accordingly, in some embodiments of this disclosure, the webpage access control method may further include: establishing a session verification service, wherein the session verification service is used to store the mapping relationship between the first and second session tokens and the user identity. In this embodiment, when executing the identity authentication process of the first platform and the second platform, the webpage access control method may further include the following A1, A2, and A3.

[0114] A1: After generating the first session token, register the first session information with the session verification service.

[0115] In some embodiments of this disclosure, the first platform or its session management system may register first session information associated with a first session token with a session verification service. In this embodiment, the first session information may include a first platform identifier, a first session token (value), and a user identifier in the first platform.

[0116] A2: After generating the second session token, register the second session information with the session verification service.

[0117] In some embodiments of this disclosure, the second platform may register second session information with a session verification service. It is understood that step A2 uses the same session verification service as in step A1 for session information registration. In this embodiment, the second session information may include a second platform identifier, a second session token, and a user identifier in the second platform. It should be understood that the user identifiers of the same user in the second platform and the first platform may optionally be different, as described in step 144 above.

[0118] A3: The session authentication service establishes two mapping records between session tokens and user identifiers.

[0119] In some embodiments of this disclosure, the session verification service can establish mapping records (mapping relationships) between a first session token (value) and its corresponding user identifier, and a mapping record (mapping relationship) between a second session token (value) and its corresponding user identifier. In some embodiments, the same user identifier is the same on the second platform and the first platform. In this case, the user identifier can also be called the user unique identifier. The session verification service can maintain a mapping table between the user unique identifier (UID) and its corresponding session token, and manage the mapping and verification with the UID as the primary key. In a specific embodiment, a mapping record in the mapping table of the session verification service is: {UID:"1001", tokens:{P1:[{id:"1a2d…",authorization_expiration_time:"2025-01-01T10:30:00Z", status:"Active"}]}}, where P1 is used to identify the platform, UID represents the user unique identifier, tokens represent the token corresponding to the user, authorization_expiration_time represents the expiration time of the user token, and status represents the current status of the token. In other embodiments, as previously described, the user identifiers of the same user on the second platform and the first platform may optionally be different. In this case, the platform side can submit only the user identifier of its own platform. The session verification service internally maintains a mapping table that maps different user identifiers belonging to the same user on different platforms to the service's internally generated user unique identifier (UID), thereby achieving mapping and verification management with UID as the primary key. By way of explanation and not limitation, this method can complete the consistency judgment without disclosing the identifier or UID of the other platform to both platforms, further enhancing security.

[0120] In this embodiment, the step of verifying the simultaneous validity of the first session token and the second session token and the consistency of the user identity may further include steps 145, 146, 147 and 148 below.

[0121] 145: Submit a query request containing the user's identifier to the session authentication service.

[0122] In some embodiments of this disclosure, in response to access to page content provided by a second platform for embedding inline frames, the accessing end (also referred to as the client) is required to submit a query request to the session authentication service. In this embodiment, the query request may carry a user identifier in the request parameters, which is used to characterize the user identity requesting access to the page content provided by the second platform, such as characterizing the user currently operating / logged in on the first platform.

[0123] 146: The session verification service searches the session mapping relationship to find whether there is a first session token and a second session token corresponding to the user identifier, and completes the user identity consistency verification.

[0124] In some embodiments of this disclosure, such as in step 146 above, the session mapping relationship is pre-established. A detailed description of the session mapping relationship can be found in the description of the mapping record in step A3 above, and will not be repeated here. In this embodiment, the session verification service can retrieve whether a corresponding first session token and second session token exist based on the user identifier carried in the query request. In some embodiments, the user identity can be confirmed to be consistent if both the corresponding first session token and second session token exist simultaneously; if no session token is found, or only the first session token / second session token is found, the user identity can be confirmed to be inconsistent.

[0125] 147: In the case of both a first session token and a second session token, verify whether both the first session token and the second session token are valid, and complete the simultaneous validity verification.

[0126] In some embodiments of this disclosure, the validity periods of the first session token and the second session token can be verified. In one example, it can be determined whether both session tokens are valid based on the current time and the validity period in the corresponding record of the session token.

[0127] 150: Control access to web page content on the second platform based on the verification results of simultaneous validity and user identity consistency.

[0128] In some embodiments of this disclosure, access control decisions for web page content may be executed by a first platform or an access control system on the first platform side. In some embodiments, the steps of controlling access to web page content on a second platform based on the verification results of simultaneous validity and user identity consistency may include steps 151 and 152 below.

[0129] 151: When the first session token and the second session token are both valid and the user identities match, load the webpage content of the second platform into the webpage of the first platform.

[0130] In some embodiments of this disclosure, access to webpage content on a second platform can be based on access credentials. In this embodiment, access credentials can be generated if the verification results of the first session token and the second session token are both valid and the user identity matches. Based on the access credentials, webpage content is requested from the second platform, and then the content data returned by the second platform is received and displayed in an embedded frame on the first platform page.

[0131] 152: If either the first session token or the second session token is invalid or the user identity is inconsistent, the loading of web page content is prohibited.

[0132] In some embodiments of this disclosure, when the verification result of any session token is invalid or the verification result of the user identity is inconsistent, access credentials may not be generated and an access failure prompt may be presented in the embedded frame to guide the user to complete the authentication process of the first platform and / or the second platform.

[0133] In some embodiments of this disclosure, the step of controlling access to web page content on a second platform based on simultaneous validity and user identity consistency may further include the following 153.

[0134] 153: When loading web page content on a second platform, continuously verify the validity of the first session token and the second session token.

[0135] In some embodiments of this disclosure, query requests can be sent to the session verification service at predetermined time intervals to verify the validity of the first session token and the second session token, thereby further ensuring legitimate access to web page content.

[0136] In some embodiments of this disclosure, the validity of the first session token and the second session token can be determined based on the continuous sending of query requests by the detection script. Accordingly, the step of continuously obtaining the validity of the first session token and the second session token may include B1, B2, and B3 below.

[0137] B1: Inject monitoring scripts into the webpage of the first platform.

[0138] In some embodiments of this disclosure, the monitoring script may execute a session verification function at predetermined time intervals, the session verification function being able to verify the user's authentication status on the first platform and the second platform, respectively. In this embodiment, the monitoring script includes, but is not limited to, a JavaScript monitoring script.

[0139] B2: Validate the first session token obtained from the first platform at a first predetermined time interval by monitoring the script.

[0140] In some embodiments of this disclosure, a monitoring script can send query requests to the first platform or the aforementioned session verification service at a first predetermined time interval, and then parse the returned session status response to determine the validity of the first session token.

[0141] B3: Validate the second session token obtained from the second platform at a second predetermined time interval by monitoring the script.

[0142] In some embodiments of this disclosure, the second predetermined time interval may be different from the aforementioned first predetermined time interval, i.e., the monitoring script may send query requests asynchronously.

[0143] In some embodiments of this disclosure, the step of continuously obtaining the validity of the first session token and the second session token may include the following C1, C2, C3, C4, C5, C6 and C7.

[0144] C1: The first push channel established between the webpage and the first platform server.

[0145] In some embodiments of this disclosure, the first push channel may be initiated and maintained by a first platform page. In one example, the first push channel may be established using protocols such as WebSocket or SSE (Server-Sent Events). In some embodiments, the first push channel may be bound to the (parent) webpage, and optionally further to an embedded frame specified in the (parent) webpage, to receive events sent to the webpage by a first platform server (e.g., a session management system), including but not limited to session / token expiration notifications.

[0146] C2: A second push channel established between the loaded webpage content and the second platform server.

[0147] In some embodiments of this disclosure, the loaded webpage refers to a webpage loaded within an embedded frame. The second push channel can be initiated by the embedded frame and connect to the second platform server. It is understood that the second push channel cannot be read by the (parent) page of the first platform. In this embodiment, when the embedded frame receives a session / token expiration notification, it can send a notification to the parent page via a cross-domain message, so that the (parent) page of the first platform can control access based on this notification event.

[0148] Accordingly, in some embodiments of this disclosure, after establishing a first push channel and / or a second push channel, a corresponding session failure notification can be received through the first push channel and / or the second push channel.

[0149] C3: Enables the webpage to receive the first failure notification pushed by the first platform server when the first session expires via the first push channel.

[0150] In some embodiments of this disclosure, the first invalidation notification may be sent, for example, by the session management system of the first platform or the first platform server. The first platform session management system may generate and send the first invalidation notification after updating the status of the first session token to invalid on the server side. The first invalidation notification may include event type, token unique identifier, timestamp, etc.

[0151] C4: Mark the first session token as invalid based on the first invalidation notification.

[0152] In some embodiments of this disclosure, when a local web client receives a first invalidation notification sent by the server, the web page reads the notification accordingly and sets the local first session state to invalid. In some embodiments, the locally stored first session token may also be deleted or its state may be modified to invalid.

[0153] C5: The loaded web page content receives a second failure notification pushed by the second platform server when the second session expires via the second push channel.

[0154] In some embodiments of this disclosure, the second platform server may update the status of the second session token to invalid on the server side, and then send an invalidation notification to the embedded page through the second push channel.

[0155] C6: If the loaded webpage content receives a second failure notification, cause the loaded webpage content to pass the second failure notification to the webpage.

[0156] In some embodiments of this disclosure, when the loaded web page content, i.e. the embedded frame, receives a second failure notification, it can transmit the second failure notification to the (parent) page of the first platform via a cross-domain message.

[0157] C7: Mark the second session token as invalid based on the second invalidation notification.

[0158] In some embodiments of this disclosure, the first platform or the session management system on the first platform side may mark the local second session token as invalid and trigger a termination process based on the second invalidation notification.

[0159] In some embodiments of this disclosure, steps C1 to C4 and steps C5 to C7 may optionally be partially executed and may be executed asynchronously. For example, if one of steps C4 and C7 (e.g., C4) has been executed, and the first platform has terminated the loading of the page in the embedded frame, then the other of steps C5 to C7 (e.g., C7) and its preceding steps (e.g., C5 and C6) may no longer need to be executed.

[0160] 154: In response to the detection of either the first session token or the second session token being invalid, access to the web page content is terminated.

[0161] In some embodiments of this disclosure, terminating access to webpage content may include, but is not limited to, resetting embedded frames to a blank page or error page, clearing cookies held locally on the client, etc. In optional embodiments, a session expiration message may also be displayed in a predetermined area, and the user may be redirected to the login page of the first platform / second platform, etc.

[0162] The method of this disclosure obtains a first session token generated after the user performs first identity authentication on a first platform; obtains a second session token generated after the user performs second identity authentication on a second platform; verifies the simultaneous validity of the first and second session tokens and the consistency of the user's identity; and controls access to the webpage content on the second platform based on the verification results of the simultaneous validity and the consistency of the user's identity. This method obtains a first session token and a second session token on the first platform carrying the embedded frame and the second platform to which the embedded page belongs, respectively. It only allows loading of the webpage content corresponding to the embedded frame when both tokens are valid and correspond to the same user in the same verification. If either the first or second session token expires, is revoked, or the identities corresponding to the two tokens are inconsistent, loading of the webpage content is immediately blocked. This achieves access control based on simultaneous online verification and identity consistency verification on both ends, thereby avoiding unauthorized access caused by the forwarding and reuse of fixed links in the embedded frame, significantly reducing the risk of page and data leakage in cross-platform access scenarios, and enhancing data security in cross-platform access.

[0163] In some embodiments of this disclosure, such as Figure 7 As shown, a webpage access control device 700 is provided, which may include a first acquisition module 701, a second acquisition module 702, a verification module 703, and an access control module 704. Among them,

[0164] The first acquisition module 701 is configured to acquire the first session token generated by the user after performing first identity authentication on the first platform, wherein the webpage of the first platform has an embedding frame for embedding webpage content of the second platform.

[0165] The second acquisition module 702 is configured to acquire the second session token generated by the user after performing second identity authentication on the second platform;

[0166] The verification module 703 is configured to verify the validity of the first session token and the second session token, as well as the consistency of the user's identity.

[0167] The access control module 704 is configured to control access to the webpage content of the second platform based on the verification results of simultaneous validity and user identity consistency.

[0168] The apparatus, components, modules, units, and features described in the embodiments of this disclosure can be incorporated into the methods of the embodiments of this disclosure in a non-contradictory manner, and the methods, steps, sub-steps, and features described in the embodiments of this disclosure can also be incorporated into the apparatus of the embodiments of this disclosure in a non-contradictory manner.

[0169] In embodiments of this disclosure, an electronic device may also be provided, including: a processor and a memory storing a computer program, the processor being configured to perform the method of any of the embodiments of this disclosure when running the computer program.

[0170] Figure 8 The illustration shows a method or electronic device 800 that can implement embodiments of the present disclosure. In some embodiments, it may include more or fewer electronic devices than illustrated. In some embodiments, it may be implemented using a single or multiple electronic devices. In some embodiments, it may be implemented using cloud-based or distributed electronic devices.

[0171] like Figure 8 As shown, the electronic device 800 includes a processor 801, which can perform various appropriate operations and processes based on programs and / or data stored in read-only memory (ROM) 802 or programs and / or data loaded from storage portion 808 into random access memory (RAM) 803. The processor 801 can be a multi-core processor or may contain multiple processors. In some embodiments, the processor 801 may include a general-purpose main processor and one or more special coprocessors, such as a graphics processing unit (GPU), a neural network processor (NPU), a digital signal processor (DSP), etc. The RAM 803 also stores various programs and data required for the operation of the electronic device 800. The processor 801, ROM 802, and RAM 803 are interconnected via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0172] The processor and memory described above are used together to execute a program stored in the memory. When the program is executed by a computer, it can implement the steps or functions of the methods described in the above embodiments.

[0173] The following components are connected to I / O interface 805: an input section 806 including a keyboard, mouse, touchscreen, etc.; an output section 807 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 808 including a hard disk, etc.; and a communication section 809 including a network interface card such as a LAN card, modem, etc. The communication section 809 performs communication processing via a network such as the Internet. A drive 810 is also connected to I / O interface 805 as needed. A removable medium 811, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 810 as needed so that computer programs read from it can be installed into storage section 808 as needed. Figure 8 The diagram only shows a portion of the components and does not imply that the computer system 800 only includes... Figure 8 The components shown.

[0174] In some embodiments, the electronic device refers to a mobile terminal or computer, including mobile phones, vehicle terminals, smart TVs, etc. Taking a mobile phone as an example, the electronic device also includes a touch screen, external speaker, gyroscope, camera, 4G / 5G antenna, and other device modules.

[0175] The systems, devices, modules, or units described in the above embodiments can be implemented by a computer or its associated components. The computer may be, for example, a mobile terminal, smartphone, personal computer, laptop computer, in-vehicle human-machine interface device, personal digital assistant, media player, navigation device, game console, tablet computer, wearable device, smart TV, Internet of Things system, smart home, industrial computer, server, or a combination thereof.

[0176] Although not shown, in embodiments of this disclosure, a program product is provided, the program product comprising a computer program configured to be run to implement the methods of any embodiment of this disclosure.

[0177] Although not shown, in embodiments of this disclosure, a storage medium is provided storing a computer program configured to be executed to implement the methods of any of the embodiments of this disclosure.

[0178] The storage media in embodiments of this disclosure include articles that are permanent and non-permanent, removable and non-removable, capable of storing information by any method or technology. Examples of storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device.

[0179] The methods, programs, systems, apparatuses, etc., of the embodiments of this disclosure can be executed or implemented in a single or multiple networked computers, or practiced in a distributed computing environment. In the embodiments of this specification, in these distributed computing environments, tasks can be performed by remote processing devices connected via a communication network.

[0180] Those skilled in the art will understand that the embodiments described in this specification can be provided as methods, systems, or computer program products. Therefore, those skilled in the art will realize that the functional modules / units or controllers and related method steps described in the above embodiments can be implemented in software, hardware, or a combination of both.

[0181] Unless explicitly stated otherwise, the actions or steps of the methods or procedures described in the embodiments of this disclosure do not necessarily have to be performed in a specific order and can still achieve the desired results. In some implementations, multitasking and parallel processing are also possible or may be advantageous.

[0182] This document describes various embodiments of the present disclosure; however, for the sake of brevity, the descriptions of the embodiments are not exhaustive, and identical or similar features or portions between the embodiments may be omitted. In this document, "one embodiment," "some embodiments," "example," "specific example," or "some examples" refer to embodiments applicable to at least one, but not all, of the embodiments according to this disclosure. The above terms do not necessarily refer to the same embodiments or examples. Without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of the different embodiments or examples.

[0183] The exemplary systems and methods of this disclosure have been specifically shown and described with reference to the foregoing embodiments, and are merely examples of the best mode for implementing the systems and methods. Those skilled in the art will understand that various changes can be made to the embodiments of the systems and methods described herein without departing from the spirit and scope of this disclosure as defined in the appended claims when implementing the systems and / or methods.< / object>

Claims

1. A webpage access control method, characterized in that, The method, implemented by a first platform or by an access control system deployed on the first platform, includes: Obtain the first session token generated after the user performs first identity authentication on the first platform, wherein the webpage of the first platform has an embedding frame for embedding webpage content of the second platform. Obtain the second session token generated after the user performs second identity authentication on the second platform; Verify the validity and consistency of the user identity of both the first and second session tokens; Based on the verification results of simultaneous validity and user identity consistency, access to the web page content of the second platform is controlled.

2. The webpage access control method according to claim 1, characterized in that, Before obtaining the first session token and the second session token, the method further includes: In response to a trigger event that accesses web page content on the second platform, the authentication process of the first platform and the second platform is executed, and the first session token and the second session token are generated respectively.

3. The webpage access control method according to claim 2, characterized in that, The step of executing the identity authentication process of the first platform and the second platform, and generating the first session token and the second session token respectively, includes: Obtain and verify the first login credentials provided by the user, and obtain the first verification result; Based on the first verification result, generate a first session token bound to the user's identity; The first session token is stored in the session management system of the first platform or locally.

4. The webpage access control method according to claim 3, characterized in that, The step of executing the identity authentication process of the first platform and the second platform, and generating the first session token and the second session token respectively, includes: Obtain and verify the second login credentials provided by the user to obtain a second verification result; Based on the second verification result, a second session token bound to the user's identity is generated; The second session token is stored in the session management system of the second platform.

5. The webpage access control method according to any one of claims 1 to 4, characterized in that, The verification of the simultaneous validity of the first session token and the second session token, and the consistency of the user identity, includes: A cross-domain message is sent from the embedded framework to the authentication interface of the first platform via a cross-domain messaging channel, the cross-domain message including a second session token; Extract the second session token from the received cross-domain message and verify the validity of the second session token; Verify the validity of the first session token maintained by the first platform; The user identity is determined by comparing the user identifier associated with the first session token and the second session token.

6. The webpage access control method according to any one of claims 2 to 4, characterized in that, The method further includes: Establish a session verification service, which is used to store the mapping relationship between the first and second session tokens and the user identity; The verification of the simultaneous validity of the first session token and the second session token, and the consistency of the user identity, includes: Submit a query request containing the user identifier to the session verification service; The session verification service searches the session mapping relationship to see if there is a first session token and a second session token corresponding to the user identifier, and completes the user identity consistency verification. If both the first session token and the second session token exist, verify whether both the first session token and the second session token are valid to complete the simultaneous validity verification.

7. The webpage access control method according to claim 1, characterized in that, The step of controlling access to the webpage content of the second platform based on the verification results of simultaneous validity and user identity consistency includes: When the first session token and the second session token are both valid and the user identities are consistent, the webpage content of the second platform is loaded into the webpage of the first platform; Loading of the webpage content is prohibited if either the first session token or the second session token is invalid or the user identity is inconsistent.

8. The webpage access control method according to claim 7, characterized in that, Also includes: While loading the webpage content of the second platform, continuously verify the validity of the first session token and the second session token; In response to the detection that either the first session token or the second session token has expired, access to the web page content is terminated.

9. The webpage access control method according to claim 8, characterized in that, The validity of continuously acquiring the first session token and the second session token includes: A first push channel is established between the webpage and the first platform server; A second push channel is established between the loaded webpage content and the second platform server; The webpage receives a first failure notification pushed by the first platform server when the first session expires through the first push channel. Based on the first invalidation notification, the first session token is marked as invalid; And / or, The loaded webpage content receives a second failure notification pushed by the second platform server when the second session expires through the second push channel. If the loaded webpage content receives a second failure notification, the loaded webpage content shall transmit the second failure notification to the webpage. According to the second invalidation notification, the second session token is marked as invalid.

10. A webpage access control device, characterized in that, include: The first acquisition module is configured to acquire the first session token generated by the user after performing first identity authentication on the first platform, wherein the webpage of the first platform has an embedding frame for embedding webpage content of the second platform. The second acquisition module is configured to acquire the second session token generated by the user after performing second identity authentication on the second platform; The verification module is configured to verify the validity of the first session token and the second session token, as well as the consistency of the user's identity. The access control module is configured to control access to the webpage content of the second platform based on the verification results of simultaneous validity and user identity consistency.

11. An electronic device, characterized in that, include: A processor and a memory storing a computer program, the processor being configured to implement the method as described in any one of claims 1 to 9 when the computer program is executed.

12. A program product comprising a computer program, wherein, When the computer program is executed by a processor, it implements the method as described in any one of claims 1 to 9.

Images