Safety access control method and system

Abstract

The invention aims to provide the secure access control method and system, the data connection with the target resource is established only after the authentication of the user request is passed, and the legality of access can be controlled. Wherein the authentication passing comprises the following steps: the token authentication is passed firstly and then the resource authentication is passed, and when the token authentication is not passed, a user authentication process and a token creation process are provided, so that the security authentication of the user identity can be realized. And an authorization resource determination mode based on the user identity and the role is designed, so that the influence of a resource strategy on a user request can be avoided to the greatest extent when the identity is legal, and the response efficiency can be improved.

Description

Technical Field

[0001] This invention belongs to the field of secure access technology, and in particular relates to a secure access control method based on identity authentication and a system that applies this method. Background Technology

[0002] With the development of information technology, more and more network devices and terminals are connected to the Internet. In particular, for organizations' critical business resources, they face massive access pressure from internal threats, branch offices, visitors, and remote work. Professional hackers who target business resources often exploit security vulnerabilities to gain unauthorized access to important resources, thereby launching attacks on core business systems, causing data theft or corruption, and even security incidents such as business interruption, malicious code, and information leakage.

[0003] Zero Trust is a next-generation cybersecurity concept centered on resource protection. Its key lies in its default distrust of any person, device, or system, inside or outside the network. Instead, it rebuilds the trust foundation of access control based on identity authentication and authorization, ensuring trustworthy identities, devices, applications, and links—in other words, "continuous verification, never trust." By employing continuous verification, least privilege, and dynamic risk assessment, it addresses the pain points of traditional security models, safeguarding the endpoint security, link security, and access control security of enterprise office systems. The "continuous verification" of user access requests hinges on effective control over authorized resource access and efficient execution of authentication policies. Summary of the Invention

[0004] In view of the above background, the present invention aims to provide a guest security access control method and system based on tokens, authentication and resource control.

[0005] Firstly, a secure access control method is proposed, which establishes a data connection between the user and the target resource after the user's access request is authenticated. Specifically, it includes the following technical contents: Authentication of user requests includes determining whether the access request carries a token. If the request does not carry a token, the mapping relationship of the current user is obtained from the mapping relationship list, and a token is generated and returned to the user based on the mapping relationship. If no mapping relationship of the user is found, the current user is authenticated. After successful authentication, the association relationship between the user and the authentication tag and authorized resources is added to the mapping relationship list.

[0006] The aforementioned token is obtained by encrypting the mapping relationship and the validity period. Correspondingly, the authentication of the token includes determining whether the user information and authentication tag match the request response information, and determining whether the token is valid based on the validity period.

[0007] Once a user establishes a connection with the target resource, the data interaction between the two is monitored, including recording access logs and performing anomaly detection on the content of the behavior. If an anomaly is detected, the user is forced offline or re-authenticated.

[0008] Preferably, the user authentication described in the above technical solution includes: first, establishing a hierarchical list based on the organizational structure hierarchy, with each level of the list including the auxiliary authentication policy and associated resources associated with the current directory; querying the hierarchical list based on user information to see if there is an auxiliary authentication policy directly associated with the current user; if so, executing that policy; otherwise, executing the auxiliary authentication policy inherited by the current user from the parent directory.

[0009] Further preferably, before executing the above-mentioned auxiliary authentication strategy, it is first determined whether the user environment meets the preset access policy. If it does, a security check is performed; otherwise, the request is rejected. If the security check passes, the primary authentication is performed; if the security check fails, the request is rejected. If the primary authentication passes, the auxiliary authentication strategy is executed; otherwise, the request is rejected.

[0010] In addition, the auxiliary authentication strategy includes: if enhanced authentication, no-secondary authentication and one-click online are enabled at the same time, one-click online will be performed first, then enhanced authentication will be matched. If enhanced authentication fails to match, no-secondary authentication will be matched. If enhanced authentication and secondary authentication are enabled at the same time, secondary authentication will be performed first. After the secondary authentication is passed, enhanced authentication will be performed.

[0011] Preferably, at least one role is added to both the user and the user's directory, and the role is associated with the resource. After both the primary and secondary authentication of the user are passed, the resources directly associated with the user, the resources associated with the user's corresponding role, the resources associated with the user's directory, and the resources associated with the user's directory and corresponding role are aggregated to obtain the user's authorized resources and stored in the mapping relationship list.

[0012] Preferably, the aforementioned authorized resources include the resource's IP address, port, URL, and APP information. Based on this, the user's access request is authenticated, which further includes determining whether the target resource requested by the user each time matches the authorized resources. If the match fails, the request is terminated.

[0013] Secondly, a secure access control system is proposed to implement the above-mentioned secure access control method, including: The authentication module determines whether to allow access based on whether a token is carried and whether the target resource is authorized, and generates a token for the user based on the authentication result of the authentication module. The authentication module is used to perform primary and secondary authentication for users. The policy module is used to specify auxiliary authentication policies for users and their directories; The resource module is used to aggregate the user's authorized resources based on the user, the user's directory, and the associated resources of their respective roles; The connection module is used to establish or block access requests based on authentication and security check results; The security check module is used to perform security checks on the user's environment before authentication, and to detect anomalies in access behavior and data after authentication is successful.

[0014] Preferably, the system controls access by including the following steps: Establish a hierarchical list based on the organizational structure hierarchy. Each level of the list includes the auxiliary authentication policies and associated resources of the current directory. Add at least one role to the user and the directory to which the user belongs. The role and the resource are associated. Determine whether the access request carries a token. If the request does not carry a token, retrieve the current user's mapping relationship from the mapping relationship list, and generate a token based on the mapping relationship and return it to the user. If no user mapping relationship is found, determine whether the user environment meets the preset access control policy. If it does, perform a security check; otherwise, reject the request. If the security check passes, perform primary authentication; if the security check fails, reject the request. If the primary authentication passes, the system queries the hierarchical list to see if there is an auxiliary authentication strategy directly associated with the current user. If there is, the strategy is executed; otherwise, the auxiliary authentication strategy inherited by the current user from the parent directory is executed. After the auxiliary authentication is passed, the resources directly associated with the user, the resources associated with the user's corresponding role, the resources associated with the user's directory, and the resources associated with the user's directory and corresponding role are aggregated to obtain the user's authorized resources; Add the association between users and authentication tags and authorized resources to the mapping list; The mapping relationship and validity period are encrypted to obtain a token, which is then returned to the user. If the user information and authentication tag of the token match the request, the token is within its valid time, and the IP, port, URL and APP information of the target resource and the authorized resource are consistent, then the authentication is successful and a data connection between the user and the target resource is established.

[0015] The present invention, employing the above technical solution, has the following beneficial effects: a data connection with the target resource is established only after the user's request has been authenticated, thus controlling the legitimacy of access. Authentication includes first authenticating the token and then authenticating the resource; and when token authentication fails, a user authentication and token creation process is implemented, enabling secure authentication of the user's identity. Furthermore, an authorization resource determination method based on user identity and role is designed, which minimizes the impact of resource policies on user requests when the identity is legitimate, thereby improving response efficiency. Attached Figure Description

[0016] Figure 1 This is a schematic diagram of the overall process of an embodiment of a secure access control method proposed in this invention; Figure 2 A schematic diagram illustrating the process of determining user-authorized resources in an embodiment of a control method for secure access; Figure 3 This is an embodiment of a secure access control system proposed in this invention, showing its module composition and data flow diagram. Detailed Implementation

[0017] The present application will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the scope of the application. Furthermore, it should be noted that, for ease of description, only the parts relevant to the application are shown in the accompanying drawings.

[0018] To facilitate understanding, some technical background information that helps in understanding the technical solutions of the embodiments of the present invention will be explained first: IAM (Identity and Access Management) features single sign-on, authentication management, policy-based centralized authorization and auditing, dynamic authorization, and enterprise manageability. It is a comprehensive set of business processes and management tools for establishing and maintaining digital identities, and providing effective and secure access to IT resources, thereby achieving unified identity authentication, authorization, and centralized management and auditing of organizational information assets.

[0019] MFA (Multi-Factor Authentication) is a security mechanism that requires users to provide two or more independent authentication factors to access resources. Its core principle is to overcome the vulnerability of a single password, significantly improving account security through layered defense. MFA combines multiple authentication methods such as passwords, SMS authentication, hardware tokens, and dynamic verification codes to significantly enhance system security and effectively prevent risks caused by stolen credentials.

[0020] First, an embodiment of a secure access control method is proposed. After the user's access request is authenticated, a data connection is established between the user and the target resource, such as... Figure 1 As shown, the specific steps include: S1. Create a token for the user, which includes encrypting user information, authentication tags, and validity period. For example, encrypting the username, authentication method tag, IP address, port, and URL of the authorized resource, and validity period. The encryption method is not limited here. The token can be stored locally by the user after creation so that it can be used to initiate a request for resources, or the token can be obtained from the server before initiating the request.

[0021] S2. Determine whether the user's access request carries a token. If it does, parse the token content and determine if it matches the current user. If the match is successful, allow access to the corresponding target resource for response. The matching can involve matching the decrypted and parsed token information with information stored on the server. In a preferred implementation, the server stores the information in the form of a mapping table, which contains authenticated user information, authentication tags, authorized resources, etc.

[0022] If a user's access request does not include a token, the system will query the mapping table based on the user information to see if a corresponding mapping relationship exists. If it exists, a token will be generated for the user. If it does not exist, user authentication will be initiated. After successful authentication, the mapping relationship will be added to the mapping relationship list, and a token will be generated based on the mapping relationship. The token will then be returned to the user or stored on the server.

[0023] S3. For requests that pass token verification, establish a connection with the target resource, monitor the data interaction between the two in real time, record access logs, and perform anomaly detection on the behavior content. If an anomaly is detected, force the user offline or require re-authentication. How to perform anomaly detection on user behavior content and how to perform log auditing are not limited to the scope of this embodiment of the invention and will not be elaborated here.

[0024] In the above-described embodiment of the secure access control method, the token includes user information, authentication label, authorized resources, and validity period. Each user request carries the token. By authenticating the token, continuous verification of user requests can be achieved, and real-time monitoring of user behavior can be maintained after the data connection is established. Once abnormal behavior is detected, the request is blocked in time, thereby realizing secure control of user access.

[0025] In the above embodiments of the secure access control method, a preferred implementation of user authentication includes the following process: Establish a hierarchical list based on the organizational structure hierarchy. Each level of the list includes the auxiliary authentication policies and associated resources of the current directory. Add at least one role to the user and the directory to which the user belongs. The role and the resource are associated.

[0026] For example, based on the organizational structure of headquarters, second-level departments, and third-level departments, a three-level directory is established. Each level directory contains the auxiliary authentication policies and associated resources corresponding to the current level department. Under the third-level department, there are also auxiliary authentication policies and associated resources directly corresponding to specific users. Associated resources can refer to applications that the current user or directory has the right to access in advance.

[0027] In a preferred implementation, the authentication process includes: determining whether the user environment conforms to a preset access policy; if it does, a security check is performed; otherwise, the request is rejected; if the security check passes, primary authentication is performed; if the security check fails, the request is rejected; if the primary authentication passes, the auxiliary authentication policy is executed; otherwise, the request is rejected.

[0028] It's important to clarify here that the access control policy addresses the basic security requirements of the user environment, such as whether the user's system version, device IP address, and MAC address comply with the preset access control policy. Security detection, on the other hand, checks for security risks on the user's terminal device, including whether security software is installed, system vulnerabilities, and whether access behavior includes activities like phishing or credential theft.

[0029] In a preferred implementation, the users in this embodiment can be manually created by the administrator or imported from a third-party platform (such as WeChat, DingTalk, etc.). Accordingly, local users call local authentication, while third-party users call the corresponding third-party authentication.

[0030] When authenticating users, primary authentication is performed first, followed by secondary authentication. Primary authentication is mandatory for all users. Whether secondary authentication is performed is determined by a pre-configured secondary authentication policy based on the user, their directory, and roles. Primary authentication verifies the authenticity of the user's identity, while secondary authentication can perform authorization verification based on primary authentication, or it can be a third-party authentication independent of primary authentication. This allows for multi-factor authentication of user identity, ensuring the legitimacy of the user's identity. Primary authentication is performed by the organization using a preset authentication method, such as SMS authentication, while third-party authentication can be a recognized and trusted authentication method, such as WeChat authentication or DingTalk authentication.

[0031] After primary authentication is successful, the system checks the hierarchical list to see if a secondary authentication policy directly associated with the current user exists. If it does, that policy is executed; otherwise, the secondary authentication policy inherited by the user's parent directory is executed. In other words, if a secondary authentication policy is configured for the user, it is executed directly after primary authentication; otherwise, the secondary authentication policy associated with the user's parent directory is executed.

[0032] Furthermore, as a preferred implementation, user authentication can also include initiating authentication by installing a client on the user's terminal, or by the user initiating authentication by accessing a preset server through a browser. For client requests, one-click online access can be configured, meaning that after successful authentication, the authentication is retained for a certain period, during which one-click online access can be achieved without repeated authentication.

[0033] Therefore, secondary authentication policies that apply to both the client and the browser can be configured for users, including: If a user has enabled enhanced authentication, no-secondary authentication, and one-click online at the same time, one-click online will be executed first. If one-click online is not enabled, enhanced authentication will be matched. If enhanced authentication fails to match, no-secondary authentication will be matched. If a user has enabled both enhanced authentication and two-factor authentication, the two-factor authentication will be performed first, and the enhanced authentication will be performed only after the two-factor authentication is successful.

[0034] The secure access control method embodiment described above, through dual authentication of primary authentication and secondary authentication, can implement different authentication strategies for different users. Furthermore, primary authentication is essential. While ensuring the legality control of user identities, the authentication strategy can be dynamically adjusted according to the actual situation, which is beneficial to improving the applicability of authentication.

[0035] In the above-described secure access control method embodiments, each level of directory and each user also has role tags, and the role tags are also associated with authorized accessible resources.

[0036] like Figure 2 As shown, after user authentication is successful, the resources directly associated with the user, the resources associated with the user's corresponding role, the resources associated with the user's directory, and the resources associated with the user's directory and corresponding role are aggregated to obtain the user's authorized resources, which are then stored in the mapping relationship list. The target resource requested by the user each time is matched with the authorized resources, and if the match fails, the request is terminated.

[0037] The authorized resources include the resource's IP address, port, URL, and APP information. Authenticating user access requests also includes determining whether the target resource of the request is consistent with the authorized resources.

[0038] For example, employee user A belongs to second-level department B, and A's role is "Salesperson." Second-level department B's role is "City Office." Since A is primarily an employee, their authorized applications are restricted to Browser 1 and social media software 2. The "Salesperson" role restricts their authorized applications to the city's customer relationship data 3. Second-level department B's authorized applications can be restricted to Browser 1, social media software 2, and remote work software 4. The "City Office" role can restrict their authorized applications to the office maintenance personnel database 5. After user authentication, user A's authorized applications are aggregated from the aforementioned related applications of user A, user A's "Salesperson" role, second-level department B's related applications, and second-level department B's "City Office" role, resulting in their final authorized applications being Browser 1, social media software 2, the city's customer relationship data 3, remote work software 4, and the office maintenance personnel database 5.

[0039] As described above, the secure access control method embodiment, after successful authentication, aggregates the user's associated resources based on identity and role to obtain their authorized resources. This allows for dynamic and automatic adaptation to changes in user identity or role, thereby avoiding permission and resource conflicts that may result from manual modifications. This approach helps improve resource responsiveness and business continuity while ensuring the legitimacy of user identity.

[0040] An embodiment of a secure access control system implements the above-described secure access control method, such as... Figure 3 As shown, it specifically includes the following modules: The authentication module determines whether to allow access based on whether a token is carried and whether the target resource is authorized, and generates a token for the user based on the authentication result of the authentication module. The authentication module is used to perform primary and secondary authentication for users. The policy module is used to specify auxiliary authentication policies for users and their directories; The resource module is used to aggregate the user's authorized resources based on the user, the user's directory, and the associated resources of their respective roles; The connection module is used to establish or block access requests based on authentication and security check results; The security check module is used to perform security checks on the user's environment before authentication, and to detect anomalies in access behavior and data after authentication is successful.

[0041] Preferably, the system controls access by including the following steps: Establish a hierarchical list based on the organizational structure hierarchy. Each level of the list includes the auxiliary authentication policies and associated resources of the current directory. Add at least one role to the user and the directory to which the user belongs. The role and the resource are associated. Determine whether the access request carries a token. If the request does not carry a token, retrieve the current user's mapping relationship from the mapping relationship list, and generate a token based on the mapping relationship and return it to the user. If no user mapping relationship is found, determine whether the user environment meets the preset access control policy. If it does, perform a security check; otherwise, reject the request. If the security check passes, perform primary authentication; if the security check fails, reject the request. If the primary authentication passes, the system queries the hierarchical list to see if there is an auxiliary authentication strategy directly associated with the current user. If there is, the strategy is executed; otherwise, the auxiliary authentication strategy inherited by the current user from the parent directory is executed. After the auxiliary authentication is passed, the resources directly associated with the user, the resources associated with the user's corresponding role, the resources associated with the user's directory, and the resources associated with the user's directory and corresponding role are aggregated to obtain the user's authorized resources; Add the association between users and authentication tags and authorized resources to the mapping list; The mapping relationship and validity period are encrypted to obtain a token, which is then returned to the user. If the user information and authentication tag of the token match the request, the token is within its valid time, and the IP, port, URL and APP information of the target resource and the authorized resource are consistent, then the authentication is successful and a data connection between the user and the target resource is established.

[0042] As described above, the secure access control system embodiment establishes a data connection to the target resource only after the user's request has been successfully authenticated, thus controlling the legitimacy of access. Authentication includes first authenticating the token and then authenticating the resource. Furthermore, if token authentication fails, a user authentication and token creation process is implemented, ensuring secure authentication of the user's identity. Moreover, an authorization resource determination method based on user identity and role is designed, which minimizes the impact of resource policies on user requests when the identity is legitimate, thereby improving response efficiency.

[0043] Those skilled in the art will understand that all or part of the steps in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc.

[0044] The description of the disclosed embodiments above enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles disclosed herein.

Claims

1. A method for controlling secure access, establishing a data connection between a user and a target resource after an access request of the user is authenticated, characterized in that: the authentication comprises judging whether the access request carries a token, if the request does not carry a token, obtaining a mapping relationship of the current user from a mapping relationship list, and generating a token according to the mapping relationship and returning it to the user; if the mapping relationship of the user is not found, authenticating the current user, and adding the association between the user and the authentication tag and the authorized resource into the mapping relationship list after the authentication is passed; the token is obtained by encrypting the mapping relationship and the valid time; the authentication comprises judging whether the user information and the authentication tag of the token match the request respectively, and judging whether the token is valid according to the valid time; monitoring the data connection between the request and the target resource, recording the access log and detecting the behavior content for abnormality, and forcibly logging off or re-authenticating if an abnormality is found; the authentication of the user comprises establishing a hierarchical list according to the organizational structure level, each hierarchical list comprising an auxiliary authentication strategy and associated resources of the current directory; querying the hierarchical list according to the user information to determine whether the auxiliary authentication strategy directly associated with the current user exists, and executing the strategy if it exists, otherwise executing the auxiliary authentication strategy of the superior directory inherited by the current user; the auxiliary authentication further comprises judging whether the user environment meets the preset access strategy, and if so, performing security check, otherwise rejecting the request; if the security check is passed, performing the main authentication, and if the security check is not passed, rejecting the request; the auxiliary authentication strategy comprises: if the enhanced authentication, the secondary authentication exemption and the one-key online are enabled at the same time, executing the one-key online first, then matching the enhanced authentication, and if the enhanced authentication matching fails, matching the secondary authentication exemption; if the enhanced authentication and the secondary authentication are enabled at the same time, performing the secondary authentication first, and then performing the enhanced authentication after the secondary authentication is passed; after the user authentication is passed, aggregating the resources directly associated with the user, the resources associated with the role corresponding to the user, the resources associated with the directory to which the user belongs, and the resources associated with the role corresponding to the directory to which the user belongs, to obtain the authorized resources of the user, and storing them into the mapping relationship list; matching the target resource of each request of the user with the authorized resources, and terminating the request if the matching fails; before the resource aggregation, adding at least one role to the user and the directory to which the user belongs, the role having an association with the resource; the authorized resources comprise the IP, port, URL and APP information of the resource, and the authentication of the access request of the user further comprises judging whether the target resource of the request is consistent with the authorized resources; the system comprises: an authentication module for judging whether to pass the access request according to whether the token is carried and whether the target resource is authorized, and generating a token for the user according to the authentication result of the authentication module; an authentication module for authenticating the user; a strategy module for specifying the auxiliary authentication strategy of the user and the directory to which the user belongs; a resource module for aggregating the authorized resources of the user according to the associated resources of the user, the directory to which the user belongs and the respective roles. ​ ​ ​ ​ 2. The control method of secure access according to claim 1, characterized in that, ​ 3. The method of claim 1, wherein, ​ 4. The method of claim 3, wherein, ​ ​ 5. The method of claim 4, wherein, ​ ​ ​ 6. The method of claim 3, wherein the security access is controlled by, ​ 7. The method of claim 6, wherein, ​ 8. The control method of secure access according to claim 1 or 6, characterized in that, ​ 9. A security access control system implementing the method of controlling security access according to any one of claims 1 to 8, characterized in that, ​ ​ ​ ​ ​ The connection module is configured to establish or prevent an access request according to an authentication result and a security check result. The security check module is configured to perform a security check on a user environment before authentication, and perform anomaly detection on an access behavior and data after the authentication is passed.

10. The secure access control system of claim 9, wherein, The system implements a process of secure access control, including: A hierarchical list is established according to an organizational structure level, each level of the list including an auxiliary authentication strategy associated with a current directory and associated resources; at least one role is added to a user and a directory to which the user belongs, the role having an associated relationship with the resources; It is judged whether the access request carries a token, if the request does not carry a token, a mapping relationship of the current user is obtained from a mapping relationship list, and a token is generated according to the mapping relationship and returned to the user; If the mapping relationship of the user is not found, it is judged whether the user environment meets a preset access policy, if yes, a security check is performed, otherwise the request is rejected; if the security check is passed, a main authentication is performed, if the security check is not passed, the request is rejected; If the main authentication is passed, it is judged whether there is an auxiliary authentication strategy directly associated with the current user in the hierarchical list according to user information, if yes, the strategy is executed, otherwise an auxiliary authentication strategy of a superior directory inherited by the current user is executed; After the auxiliary authentication is passed, resources directly associated with the user, resources associated with a role of the user, resources associated with a directory to which the user belongs, and resources associated with a role of the directory to which the user belongs are aggregated to obtain authorized resources of the user; A mapping relationship between the user and an authentication tag and authorized resources is added to the mapping relationship list; The mapping relationship and a valid time length are encrypted to obtain a token, which is returned to the user; When the user information, the authentication tag and the request of the token match, the token is within a valid time, and the IP, port, URL and APP information of the target resources and the authorized resources are consistent, the authentication is passed, and a data connection between the user and the target resources is established.

Images