User identity authorization system based on hierarchical authorization

Abstract

The invention relates to a user identity authorization system based on hierarchical authorization, which belongs to the technical field of information system identity authentication, and comprises a user registration module, an application hierarchical authorization module, an authority recovery module, a security identification module and a user authentication module, the application grading authorization module is used for carrying out authorization grade division on the user information and the applications; the user authentication module determines an authorization level according to an application accessed by a user and calls the security identification module to verify whether a user authentication environment is credible, if the user authentication environment is not credible, the authorization level is plus 1, then corresponding user information in the user registration module is read for authentication, and if the authentication is passed, an authentication token corresponding to the authorization level is returned to the user; and the permission recovery module is used for recovering the authentication token. According to the invention, the overall security of the system is improved, and the flexibility of the authentication process is also considered.

Description

Technical Field

[0001] This invention relates to a user identity authorization system based on hierarchical authorization, belonging to the field of information system identity authentication technology. Background Technology

[0002] With the rapid development of information technology, software applications are becoming increasingly prevalent in various fields, and users frequently use various software systems in their daily work and life. However, software licensing and user authentication, as key aspects of ensuring software security and legal use, face numerous challenges.

[0003] Traditional software authorization methods are typically quite simple, relying primarily on a combination of username and password for user authentication. While this method is simple and easy to implement, it has significant security vulnerabilities. For example, passwords are easily cracked or leaked, and once an account and password are obtained by others, the user's personal information and data are at risk of unauthorized access and tampering. Furthermore, a single authentication method cannot meet the diverse security needs of different application scenarios. For applications involving sensitive information or high-risk operations, relying solely on username and password authentication is clearly insufficient to provide adequate security. Summary of the Invention

[0004] To address the problems existing in the prior art, this invention proposes a user identity authorization system based on hierarchical authorization.

[0005] The technical solution of the present invention is as follows: A user identity authorization system based on hierarchical authorization includes a user registration module, an application hierarchical authorization module, a permission revocation module, a security identification module, and a user authentication module. The user registration module is used to collect user information for user registration. The application hierarchical authorization module is used to classify the user information and applications into authorization levels; The user authentication module determines the authorization level based on the application accessed by the user, and calls the security identification module to verify whether the user authentication environment is trustworthy. If it is untrustworthy, the authorization level is incremented by 1, and the corresponding user information in the user registration module is read for authentication. If the authentication is successful, the authentication token corresponding to the authorization level is returned to the user. The permission revocation module is used to revoke authentication tokens.

[0006] Preferably, the user registration module uses the user's ID card number as the account and sets a corresponding password for registration.

[0007] Preferably, the user information includes the user's facial information, fingerprint information, and mobile phone number.

[0008] Preferably, the application hierarchical authorization module is used to classify the user information and applications into authorization levels, specifically as follows: Application A is classified as Level 1 authorization, which requires account and password authentication to return an authentication token. Application B is classified into Level 2 authorization, which requires verification code authentication via mobile phone number to return an authentication token; Application C is divided into 3 authorization levels, which require fingerprint authentication to return an authentication token. Application D is divided into 4 authorization levels, requiring facial recognition authentication to return an authentication token.

[0009] Preferably, the security identification module verifies whether the user authentication environment is trustworthy, specifically as follows: Obtain the device's IMEI serial number and check if the user has any authentication records corresponding to the IMEI serial number within the past month. If so, the user is considered a trustworthy user; otherwise, the user is considered an untrustworthy user.

[0010] Preferably, the permission revocation module is used to check whether the user has authentication tokens in each application, and to revoke the authentication tokens for the applications that have obtained them by clicking the "cancel authorization" option.

[0011] Preferably, the face information authentication uses a convolutional neural network (CNN) to extract features of the face information stored in the user registration module and the face information collected during authentication, and calculates the similarity between the two features; If the similarity is greater than the preset feature threshold, the authentication is successful.

[0012] The present invention has the following beneficial effects: 1. This invention employs a tiered authorization mechanism, allowing for different authorization levels to be set based on the importance and sensitivity of applications. Low-risk applications can use account and password authentication, while high-risk applications or those involving sensitive information require biometric authentication (such as fingerprint or facial recognition). This differentiated authentication method effectively prevents unauthorized access and dynamically adjusts the authentication level according to the user's environment (e.g., automatically increasing requirements when a new device logs in), thus improving both overall system security and the flexibility of the authentication process.

[0013] 2. This invention provides a convenient permission revocation function, allowing users or administrators to view and revoke granted authentication tokens at any time. This design simplifies the permission management process and enhances users' control over their own data security—users can revoke access permissions to an application at any time, avoiding the security risks associated with long-term authorization. Attached Figure Description

[0014] Figure 1 This is a system structure diagram of an embodiment of the present invention. Detailed Implementation

[0015] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0016] It should be understood that the step numbers used in the text are for ease of description only and are not intended to limit the order in which the steps are performed.

[0017] It should be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0018] The terms “comprising” and “including” indicate the presence of the described feature, whole, step, operation, element and / or component, but do not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or collections thereof.

[0019] The term “and / or” refers to any combination of one or more of the associated listed items, as well as all possible combinations, and includes these combinations.

[0020] Example 1: See Figure 1 A user identity authorization system based on hierarchical authorization includes a user registration module, an application hierarchical authorization module, a permission revocation module, a security identification module, and a user authentication module. The user registration module is used to collect user information for user registration. The application hierarchical authorization module is used to classify the user information and applications into authorization levels; The user authentication module determines the authorization level based on the application accessed by the user, and calls the security identification module to verify whether the user authentication environment is trustworthy. If it is untrustworthy, the authorization level is incremented by 1, and the corresponding user information in the user registration module is read for authentication. If the authentication is successful, the authentication token corresponding to the authorization level is returned to the user. The permission revocation module is used to revoke authentication tokens.

[0021] When accessing various applications, it is necessary to check whether the user has the corresponding authentication token. If so, access is allowed; otherwise, authentication is required.

[0022] Preferably, the user registration module uses the user's ID card number as the account and sets a corresponding password for registration.

[0023] Preferably, the user information includes the user's facial information, fingerprint information, and mobile phone number.

[0024] Preferably, the application hierarchical authorization module is used to classify the user information and applications into authorization levels, specifically as follows: Application A is classified as Level 1 authorization, which requires account and password authentication to return an authentication token. Application B is classified into Level 2 authorization, which requires verification code authentication via mobile phone number to return an authentication token; Application C is divided into 3 authorization levels, which require fingerprint authentication to return an authentication token. Application D is divided into 4 authorization levels, requiring facial recognition authentication to return an authentication token.

[0025] Preferably, the security identification module verifies whether the user authentication environment is trustworthy, specifically as follows: Obtain the device's IMEI serial number and check if the user has any authentication records corresponding to the IMEI serial number within the past month. If so, the user is considered a trustworthy user; otherwise, the user is considered an untrustworthy user.

[0026] For example, if a user wants to access application B, they need to complete Level 2 authorization authentication. At this time, the security identification module recognizes that the user's login device is a new device (there is no authentication success record corresponding to the IMEI serial number within one month), so the authorization level +1 requires Level 3 authorization authentication.

[0027] Since Level 4 is the highest level of authorization, there is no need to verify whether the authentication environment is trustworthy when accessing application D.

[0028] Preferably, the permission revocation module is used to check whether the user has authentication tokens in each application, and to revoke the authentication tokens for the applications that have obtained them by clicking the "cancel authorization" option.

[0029] Preferably, the face information authentication uses a convolutional neural network (CNN) to extract features of the face information stored in the user registration module and the face information collected during authentication, and calculates the similarity between the two features; In this embodiment, the similarity is specifically calculated as the cosine similarity between two features; If the similarity is greater than the preset feature threshold, the authentication is successful.

[0030] In this application embodiment, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent the existence of A alone, A and B simultaneously, or B alone. A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one of the following" and similar expressions refer to any combination of these items, including any combination of singular or plural items. For example, at least one of a, b, and c can represent: a, b, c, a and b, a and c, b and c, or a and b and c, where a, b, and c can be single or multiple.

[0031] Those skilled in the art will recognize that the units and algorithm steps described in the embodiments disclosed herein can be implemented using electronic hardware, computer software, or a combination of electronic hardware and software. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0032] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0033] In the several embodiments provided in this application, any function, if implemented as a software functional unit and sold or used as an independent product, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0034] The above description is merely an embodiment of the present invention and does not limit the patent scope of the present invention. Any equivalent structural or procedural transformations made based on the content of the present invention's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of the present invention.

Claims

1. A user identity authorization system based on hierarchical authorization, characterized in that, This includes a user registration module, an application hierarchical authorization module, a permission revocation module, a security identification module, and a user authentication module. The user registration module is used to collect user information for user registration. The application hierarchical authorization module is used to classify the user information and applications into authorization levels; The user authentication module determines the authorization level based on the application accessed by the user, and calls the security identification module to verify whether the user authentication environment is trustworthy. If it is untrustworthy, the authorization level is incremented by 1, and the corresponding user information in the user registration module is read for authentication. If the authentication is successful, the authentication token corresponding to the authorization level is returned to the user. The permission revocation module is used to revoke authentication tokens.

2. The user identity authorization system based on hierarchical authorization according to claim 1, characterized in that, The user registration module uses the user's ID card number as the account and sets a corresponding password for registration.

3. The user identity authorization system based on hierarchical authorization according to claim 1, characterized in that, The user information includes the user's facial information, fingerprint information, and mobile phone number.

4. The user identity authorization system based on hierarchical authorization according to claim 3, characterized in that, The application hierarchical authorization module is used to classify the user information and applications into authorization levels, specifically as follows: Application A is classified as Level 1 authorization, which requires account and password authentication to return an authentication token. Application B is classified into Level 2 authorization, which requires verification code authentication via mobile phone number to return an authentication token; Application C is divided into 3 authorization levels, which require fingerprint authentication to return an authentication token. Application D is divided into 4 authorization levels, requiring facial recognition authentication to return an authentication token.

5. The user identity authorization system based on hierarchical authorization according to claim 4, characterized in that, The security identification module verifies whether the user authentication environment is trustworthy, specifically as follows: Obtain the device's IMEI serial number and check if the user has any authentication records corresponding to the IMEI serial number within the past month. If so, the user is considered a trustworthy user; otherwise, the user is considered an untrustworthy user.

6. The user identity authorization system based on hierarchical authorization according to claim 1, characterized in that, The permission revocation module is used to check whether the user has authentication tokens in each application, and to revoke the authentication tokens for the applications that have obtained them by clicking the "cancel authorization" option.

7. The user identity authorization system based on hierarchical authorization according to claim 4, characterized in that, The facial information authentication uses a convolutional neural network (CNN) to extract features of facial information stored in the user registration module and facial information collected during authentication, and calculates the similarity between the two features; If the similarity is greater than the preset feature threshold, the authentication is successful.

Images