An interface level authentication method and device based on intelligent configuration and related equipment

Abstract

The application discloses an interface-level authentication method and device based on intelligent configuration and related equipment, and relates to the technical field of interface authentication. User login state verification can intercept the behavior of an unlogged user accessing a third-party business system, and can authenticate the interface corresponding to the menu ID, thereby effectively intercepting the unauthorized access behavior of a user without permission. According to the scheme, by combining user login state verification and interface-level authentication, the unauthorized access behavior of a user can be effectively intercepted when the user accesses a third-party business system. In addition, the mapping relationship between the business system menu and the interface is intelligently configured. When the menu is verified, only the menu configured in the mapping relationship is verified, and the menu not configured in the mapping relationship is not subjected to interface-level authentication, thereby improving the maintenance efficiency of the mapping relationship between the business system menu and the interface.

Description

Technical Field

[0001] This application relates to the field of interface authentication technology, and more specifically, to an interface-level authentication method, apparatus and related equipment based on intelligent configuration. Background Technology

[0002] Single Sign-On (SSO) is a popular solution for enterprise business integration. SSO is defined as allowing users to access all trusted applications by logging in only once.

[0003] When a user accesses a third-party business system via SSO, the user's identity is verified. If the verification is successful, the user can access the third-party business system. However, for centralized internal operating systems, unauthorized access occurs when a user logs into the centralized internal operating system and then accesses the third-party business system by entering the third-party system's menu address in a browser. Current methods for verifying user login status alone are insufficient to effectively prevent this unauthorized access.

[0004] Therefore, how to effectively block unauthorized access behavior when users access third-party business systems is a problem that this application urgently needs to solve. Summary of the Invention

[0005] In view of this, this application discloses an interface-level authentication method, apparatus and related equipment based on intelligent configuration, which aims to effectively intercept unauthorized access behavior of users when they access third-party business systems by combining user login status verification and interface-level authentication.

[0006] To achieve the above objectives, the disclosed technical solution is as follows:

[0007] The first aspect of this application discloses an interface-level authentication method based on intelligent configuration, the method comprising:

[0008] When a user is detected accessing the business system's menu based on single sign-on, verify the user's login status.

[0009] If the user's login status is valid, obtain the user's login information;

[0010] Based on the user login information, query the menu IDs of all user permissions, and authenticate the interfaces corresponding to the menu IDs of all user permissions.

[0011] If the interface passes authentication, it allows users to access the business system based on single sign-on and obtain the business system's menu access volume, interface access volume, and business system requirements;

[0012] Based on the menu access volume, the interface access volume, and the business system requirements, intelligently configure the mapping relationship between the business system menu and the interface;

[0013] If the user's login status is invalid, the user does not have permission to access the menu they are currently accessing, or the user does not have permission to access the interface of the business system, a corresponding permission-unauthorized access record will be generated.

[0014] Optionally, the step of querying the menu IDs of all user permissions based on the user login information and authenticating the interfaces corresponding to the menu IDs of all user permissions includes:

[0015] Based on the user login information, query the menu IDs of all user permissions and store them in the cache.

[0016] Access the business system's menu by using the menu IDs of all user permissions in the cache to verify the status of the master authentication switch;

[0017] If the authentication master switch is in the off state, the user's login status will be authenticated according to the preset authentication method;

[0018] If the authentication master switch is in the on state, obtain the menu ID from the request to access the menu;

[0019] Determine whether the menu ID in the request to access the menu is empty;

[0020] If the menu ID in the request to access the menu is empty, an input link access is initiated on the page of the business system, and an authentication operation is performed on the input link access.

[0021] If the menu ID in the request to access the menu is not empty, a click-to-menu access is initiated on the business system's page, and an authentication operation is performed on the click-to-menu access.

[0022] Optionally, authentication operations may be performed on accessed links, including:

[0023] Based on the interface accessed by the input link, the menu ID in the request to access the menu is looked up in the local configuration to determine whether it matches the menu ID in the request to access the menu.

[0024] If a menu ID is matched in the request to access the menu, check whether the menu ID in the request to access the menu matches the cached list of menu IDs.

[0025] If the menu ID in the request to access the menu matches the menu ID list in the cache, access is allowed;

[0026] If no menu ID is found in the request to access the menu, determine the status of the menu authentication blocking switch;

[0027] If the menu authentication blocking switch is in the on state, access is interrupted and a permission failure message is generated.

[0028] Access is allowed if the menu authentication blocking switch is in the off state.

[0029] Optionally, authentication operations can be performed for click-menu access, including:

[0030] Determine whether the menu ID in the cached menu ID list matches the menu ID in the request to access the menu;

[0031] If no menu ID in the request to access the menu is matched in the cached menu ID list, determine the state of the menu authentication blocking switch;

[0032] If the menu authentication blocking switch is in the on state, access is interrupted and a permission failure message is generated.

[0033] If the menu authentication blocking switch is in the off state, access is allowed;

[0034] If a menu ID in the request to access the menu is matched in the cached menu ID list, determine whether the menu ID in the request to access the menu is matched in the local configuration.

[0035] If the menu ID in the request to access the menu is not matched in the local configuration, return to the step of checking whether the menu ID in the request to access the menu is matched in the cached menu ID list;

[0036] If the menu ID in the request to access the menu is matched in the local configuration, determine whether the mapping relationship of the verification interface in the local configuration is consistent with the mapping relationship of the menu ID in the request to access the menu.

[0037] If the mapping relationship of the verification interface in the local configuration matches the mapping relationship of the menu ID in the request to access the menu, access is allowed;

[0038] If the mapping relationship of the verification interface in the local configuration is inconsistent with the mapping relationship of the menu ID in the request to access the menu, determine the state of the menu authentication blocking switch.

[0039] If the menu authentication blocking switch is in the on state, access is interrupted and a permission failure message is generated.

[0040] Access is allowed if the menu authentication blocking switch is in the off state.

[0041] Optionally, the step of intelligently configuring the mapping relationship between the business system menu and the interface based on the menu access volume of the business system, the interface access volume, and the business system requirements includes:

[0042] Retrieve records of unauthorized access and count the number of such records;

[0043] When the ratio of the menu access volume to the interface access volume is within a first preset range, the authentication interface is pushed to the business system for intelligent configuration based on the number of unauthorized access records.

[0044] When the ratio of menu access volume to interface access volume is within a second preset range, the mapping relationship between the business system menu and interface is intelligently adjusted.

[0045] Optionally, when it is detected that a user accesses the menu of the business system based on single sign-on, verifying the user's login status includes:

[0046] When a user is detected accessing the business system's menu via single sign-on, the user's login status is authenticated using a preset authentication method; wherein the preset authentication method includes at least an authorization authentication method or a security assertion markup language authentication method.

[0047] A second aspect of this application discloses an interface-level authentication device based on intelligent configuration, the device comprising:

[0048] The verification unit is used to verify the user's login status when it detects that the user accesses the menu of the business system based on single sign-on.

[0049] The first acquisition unit is used to acquire user login information if the user's login status is valid.

[0050] The authentication unit is used to query the menu IDs of all user permissions based on the user login information, and to authenticate the interfaces corresponding to the menu IDs.

[0051] The second acquisition unit is used to allow users to access the business system based on single sign-on if the interface passes authentication, and to acquire the menu access volume, interface access volume and business system requirements of the business system.

[0052] The intelligent configuration unit is used to intelligently configure the mapping relationship between the menu and the interface of the business system according to the menu access volume, the interface access volume and the business system requirements;

[0053] The generation unit is used to generate a corresponding permission-unauthorized access record if the user's login status is invalid, the user's current access menu does not have permission, or the user does not have permission to access the interface of the business system.

[0054] Optionally, the authentication unit includes:

[0055] The query module is used to query the menu IDs of all user permissions based on the user login information, and store the menu IDs of all user permissions in the cache;

[0056] The verification module is used to verify the status of the main authentication switch by accessing the menu of the business system through the menu IDs of all user permissions in the cache.

[0057] The verification module is used to verify the user's login status according to the preset authentication method if the authentication master switch is in the off state.

[0058] The first acquisition module is used to acquire the menu ID and interface name in the request to access the menu if the authentication master switch is in the open state.

[0059] The judgment module is used to determine whether the menu ID in the request to access the menu is empty;

[0060] The first operation module is used to initiate an input link access on the page of the business system and perform an authentication operation on the input link access if the menu ID in the request to access the menu is empty.

[0061] The second operation module is used to initiate a click-to-menu access on the business system page and perform authentication operations on the click-to-menu access if the menu ID in the request to access the menu is not empty.

[0062] A third aspect of this application discloses a storage medium comprising stored instructions, wherein, when the instructions are executed, the device in which the storage medium resides executes the interface-level authentication method based on intelligent configuration as described in any one of the first aspects.

[0063] The fourth aspect of this application discloses an electronic device, including a memory and one or more instructions, wherein one or more instructions are stored in the memory and configured to be executed by one or more processors using the interface-level authentication method based on intelligent configuration as described in any one of the first aspects.

[0064] As can be seen from the above technical solution, this application discloses an interface-level authentication method, device, and related equipment based on intelligent configuration. When a user is detected accessing the menu of a business system based on single sign-on, the user's login status is verified. If the user's login status is valid, the user's login information is obtained. Based on the user's login information, the menu IDs of all user permissions are queried, and the interfaces corresponding to the menu IDs are authenticated. If the interface is authenticated, the user is allowed to access the business system based on single sign-on, and the menu access volume, interface access volume, and business system requirements of the business system are obtained. Based on the menu access volume, interface access volume, and business system requirements, the mapping relationship between the business system menu and the interface is intelligently configured. If the user's login status is invalid, the user does not have permission for the currently accessed menu, or the user does not have permission for the accessed interface of the business system, a corresponding unauthorized access record is generated.

[0065] The above solution effectively blocks unauthorized access to third-party business systems by verifying user login status and authenticating the interfaces corresponding to menu IDs. This combined user login status verification and interface-level authentication effectively prevents unauthorized access by users accessing third-party business systems. Furthermore, the intelligent configuration of the mapping relationship between business system menus and interfaces ensures that only menus configured within the mapping relationship are validated during menu verification; menus not configured in the mapping relationship are not subject to interface-level authentication, thus improving the efficiency of maintaining the mapping relationship between business system menus and interfaces. Attached Figure Description

[0066] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0067] Figure 1 This is a timing diagram of an interface-level authentication method based on intelligent configuration disclosed in an embodiment of this application;

[0068] Figure 2 This is a flowchart illustrating an interface-level authentication method based on intelligent configuration disclosed in an embodiment of this application;

[0069] Figure 3 This is a schematic diagram of the interface-level authentication process disclosed in the embodiments of this application;

[0070] Figure 4 This is a schematic diagram of the structure of an interface-level authentication device based on intelligent configuration disclosed in an embodiment of this application;

[0071] Figure 5 This is a schematic diagram of the structure of the electronic device disclosed in the embodiments of this application. Detailed Implementation

[0072] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0073] In this application, the terms "comprising," "including," or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0074] As the background technology indicates, when a user accesses a third-party business system via SSO, the user's identity is verified. If the verification is successful, the user can access the third-party business system. However, for centralized internal operating systems, when a user logs into the centralized internal operating system and then attempts to access the third-party business system by entering the third-party system's menu address in a browser, unauthorized access will occur. Current methods for user access to third-party business systems rely solely on user login status verification, which is insufficient to effectively prevent such unauthorized access.

[0075] To address the aforementioned issues, this application discloses an interface-level authentication method, apparatus, and related devices based on intelligent configuration. User login status verification can intercept unauthorized users accessing third-party business systems, and authentication of the interfaces corresponding to menu IDs can effectively block unauthorized access by unauthorized users. This solution combines user login status verification and interface-level authentication to effectively intercept unauthorized access by users accessing third-party business systems. Furthermore, the intelligent configuration of the mapping relationship between business system menus and interfaces ensures that only menus configured in the mapping relationship are verified during menu verification; menus not configured in the mapping relationship are not subject to interface-level authentication, improving the maintenance efficiency of the mapping relationship between business system menus and interfaces. The specific implementation is described in detail in the following embodiments.

[0076] refer to Figure 1The diagram shown is a timing diagram of an interface-level authentication method based on intelligent configuration disclosed in an embodiment of this application. The timing diagram of the interface-level authentication method based on intelligent configuration includes a menu page, an SSO public software development kit (SDK) package, a business system backend, and an SSO service.

[0077] Once the backend program of the business system starts, it initiates the configuration reading function to load SSO-related configurations into the SSO public SDK package. These SSO-related configurations include SSO authentication URL, business system forwarding configuration, application ID, application token, and other configurations.

[0078] When a user accesses the menu of a third-party business system, the user carries the menu ID to access the backend of the third-party business system. When a user accesses the menu of a third-party business system, the single sign-on logic is used to verify whether the user's login state is valid.

[0079] Verify the user's login status, i.e., redirect to the SSO service for verification;

[0080] Redirecting to the SSO backend service to verify the user's login status;

[0081] The SSO backend verifies the user's login status and redirects the user to the proxy interface.

[0082] The proxy interface obtains the logged-in user information and plants cookies under the domain name of the business system.

[0083] The SSO public SDK package stores the menu IDs of all user permissions for a preset cache time, such as 5 minutes, based on the menu IDs of all permissions of the logged-in user.

[0084] The SSO service returns the menu IDs of all permissions for the current user to the SSO public SDK package;

[0085] The SSO public SDK package stores the current user's menu ID in the cache for interface verification, plants a cookie, and redirects the original interface of the menu page. That is, after the single sign-on verification is successful, the token will be saved in the cookie and the request interface of the original menu page will be redirected.

[0086] Users access the business system backend by carrying the menu ID and cookie through the menu page;

[0087] Access the business system backend by verifying the local login status using the SSO public SDK package;

[0088] The SSO public SDK package can be used to check if the current interface is configured and whether the menu ID corresponding to the current interface has permissions.

[0089] If the current interface is configured and the corresponding menu ID has permission, it can be accessed normally; otherwise, if the current interface is configured but the corresponding menu ID does not have permission, the logic method (the logic of the original menu interface) will be called.

[0090] If the current interface is not configured, or the menu ID corresponding to the current interface does not have permission, access will be interrupted and a message indicating that access is prohibited due to lack of permission will be displayed.

[0091] The business data obtained after calling the logic method is returned to the front end for page rendering.

[0092] (1) When the program starts, the user accesses the menu of the third-party business system, the single sign-on logic is used to verify whether the user's login status is valid;

[0093] (2) After the user's login status is verified, query all the menu information that the user has permission to access and verify whether the user has permission to access the menu.

[0094] (3) When a user accesses a menu that they have permission to access, further verify whether the user has permission to access the interface and whether access is allowed.

[0095] (4) When the user is logged in and has permission to access the menu and the interface to be accessed, the access is allowed to continue; otherwise, the access is interrupted and a message indicating that permission is not granted is displayed.

[0096] (5) The background monitors and analyzes the records of users who do not have permission to access the menu and the corresponding interface. Based on the access volume of the menu and the corresponding interface and the requirements of the business system, the data is automatically pushed to the intelligent configuration interface of the business system to realize the intelligent dynamic allocation of menu interface relationships.

[0097] In this embodiment, user login status verification can block unauthorized users from accessing third-party business systems, and authentication of the interface corresponding to the menu ID can effectively block unauthorized access by unauthorized users. This solution, by combining user login status verification and interface-level authentication, can effectively block unauthorized access by users when they access third-party business systems.

[0098] refer to Figure 2 The diagram shown is a flowchart illustrating an interface-level authentication method based on intelligent configuration disclosed in an embodiment of this application. This interface-level authentication method based on intelligent configuration mainly includes the following steps:

[0099] S201: When a user is detected accessing the business system's menu based on single sign-on, verify the user's login status.

[0100] In S201, when a user is detected accessing the business system menu based on single sign-on, the user's login status is authenticated through a preset authentication method; wherein, the preset authentication method includes at least an authorization authentication method or a security assertion markup language authentication method.

[0101] The default authentication methods in this application include, but are not limited to, authorization authentication methods and security assertion markup language authentication methods.

[0102] S202: If the user's login status is valid, obtain the user's login information.

[0103] User login information includes, but is not limited to, username, password, login status, user role / permissions, etc.

[0104] S203: Query the menu IDs of all user permissions based on the user login information, and authenticate the interfaces corresponding to the menu IDs of all user permissions.

[0105] It should be noted that only the configured menus are validated during the verification process. Menus not configured in the mapping relationship are not subject to interface-level validation, which facilitates the maintenance of the mapping relationship as the business system gradually adds more.

[0106] Specifically, based on the user's login information, the system queries the menu IDs of all user permissions and authenticates the interfaces corresponding to those menu IDs. Figure 3 As shown in A1-A7. Figure 3 The flowchart of interface-level authentication is shown.

[0107] Figure 3 In addition to the existing login authentication logic, the SSO service returns all menu IDs corresponding to the user account to the SDK, which are then stored in the cache by the business system.

[0108] Figure 3 The system provides three switches: master authentication switch, interface authentication blocking switch, and menu authentication blocking switch.

[0109] Figure 3 Add authentication logic for click-to-menu access, as follows:

[0110] (1) Obtain the ID of the clicked menu and verify whether it is in the list of menu IDs associated with the account returned by the SSO service;

[0111] (2) If it does not exist, then determine whether to deny access or print a log based on the authentication blocking switch in the menu;

[0112] (3) If it exists, further verify whether the menu ID exists in the local configuration. If it is not configured in the local configuration, determine whether to reject or print the log based on the menu authentication blocking switch.

[0113] (4) If the local configuration exists, open the page. When operating on the page, obtain the interface link and verify whether the interface and menu ID are consistent with the data in the mapping relationship (the mapping relationship between the menu and the interface accessible by the menu);

[0114] (5) If they match, access is allowed; if they do not match, access is denied or an ERROR log is printed based on the interface authentication blocking switch.

[0115] Figure 3 For input links (such as manual input) in the code, add authentication logic for input link access, as follows:

[0116] (1) Obtain the interface in the link and check whether the interface exists in the local mapping relationship;

[0117] (2) If the verification interface does not exist in the local mapping relationship, determine whether to deny access or print an ERROR log based on the interface authentication blocking switch;

[0118] (3) If the verification interface exists in the local mapping relationship, then obtain the menu ID corresponding to the matched interface;

[0119] (4) Match the menu ID corresponding to the matched interface with the menu ID corresponding to the locally saved account;

[0120] (5) If the menu ID corresponding to the interface matches the menu ID corresponding to the account stored locally, then access is allowed;

[0121] (6) If the menu ID corresponding to the interface does not match the menu ID corresponding to the locally stored account, then determine whether to deny access or print logs based on the menu authentication blocking switch.

[0122] A1: Query the menu IDs of all user permissions based on the user login information, and store the menu IDs of all user permissions in the cache.

[0123] For example, you can query the menu IDs of all user permissions based on the user's login information and store these menu IDs in a cache, say, for 5 minutes. Caching is used to improve query performance and prevent frequent database queries within a short period, which could lead to application instability.

[0124] A2: Access the business system's menu through the menu IDs of all user permissions in the cache to verify the status of the master authentication switch.

[0125] A3: If the authentication master switch is in the off state, the user's login status will be authenticated according to the preset authentication method.

[0126] Among them, the preset authentication methods include at least authorization authentication or security assertion markup language authentication.

[0127] A4: If the authentication master switch is in the open state, obtain the menu ID and interface name from the request to access the menu (access the menu of the business system).

[0128] The interface name is used to compare with the menus and interfaces that the user has permission to access to determine if the user has exceeded their authority.

[0129] A5: Determine if the menu ID in the request to access the menu is empty.

[0130] A6: If the menu ID in the request to access the menu is empty, initiate access to the input link on the business system page and perform authentication operations on the input link access.

[0131] A7: If the menu ID in the request to access the menu is not empty, initiate a click-to-menu access on the business system page and perform authentication operations on the click-to-menu access.

[0132] The specific authentication process for accessing the input link is shown in B1-B6.

[0133] B1: Based on the interface accessed by the input link, look up the menu ID in the request to access the menu in the local configuration to determine whether it matches the menu ID in the request to access the menu.

[0134] B2: If a menu ID is matched in the request to access the menu, check whether the menu ID in the request to access the menu matches the cached list of menu IDs.

[0135] B3: If the menu ID in the request to access the menu matches the cached list of menu IDs, access is allowed.

[0136] B4: If no menu ID is found in the request to access the menu, check the status of the menu authentication blocking switch.

[0137] B5: If the menu authentication blocking switch is in the on state, interrupt access and generate a permission-unauthorized message.

[0138] B6: If the menu authentication blocking switch is in the off state, access is allowed.

[0139] The specific authentication process for click-menu access is shown in C1-C11.

[0140] C1: Check the cached menu ID list to see if it matches the menu ID in the request to access the menu.

[0141] C2: If the menu ID in the request to access the menu is not matched in the cached menu ID list, determine the status of the menu authentication blocking switch.

[0142] C3: If the menu authentication blocking switch is in the on state, interrupt access and generate a permission-unauthorized message.

[0143] C4: If the menu authentication blocking switch is in the off state, access is allowed.

[0144] C5: If a menu ID from a request to access the menu is matched in the cached menu ID list, determine whether a menu ID from a request to access the menu is matched in the local configuration.

[0145] C6: If the menu ID in the request to access the menu is not matched in the local configuration, return to the step of checking whether the menu ID in the request to access the menu is matched in the cached menu ID list.

[0146] C7: If a menu ID is found in a request to access the menu in the local configuration, check whether the mapping relationship of the validation interface and the mapping relationship of the menu ID are consistent in the local configuration.

[0147] C8: If the mapping relationship of the interface is consistent with the mapping relationship of the menu ID in the request to access the menu in the local configuration, access is allowed.

[0148] C9: If the mapping relationship of the verification interface in the local configuration is inconsistent with the mapping relationship of the menu ID in the request to access the menu, determine the status of the menu authentication blocking switch.

[0149] C10: If the menu authentication blocking switch is in the on state, interrupt access and generate a permission-unauthorized prompt message;

[0150] C11: If the menu authentication blocking switch is in the off state, access is allowed.

[0151] S204: If the interface passes authentication, allow users to access the business system based on single sign-on and obtain the business system's menu access volume, interface access volume, and business system requirements.

[0152] S205: Intelligently configure the mapping relationship between menus and interfaces in the business system based on menu access volume, interface access volume, and business system requirements.

[0153] The requirements for business systems include, but are not limited to, the requirement to obtain records of unauthorized access.

[0154] Specifically, based on menu access volume, interface access volume, and business system requirements, the mapping relationship between business system menus and interfaces is intelligently configured as shown in D1-D3.

[0155] D1: Retrieve records of unauthorized access and count the number of such records.

[0156] D2: When the ratio of menu access volume to interface access volume is within the first preset range, the authentication interface will be pushed to the business system for intelligent configuration based on the number of unauthorized access records.

[0157] In D2, when the ratio of menu access volume to interface access volume is within the first preset range, it indicates that the ratio of menu access volume to interface access volume is very high. When the business system grants permission, the authentication interface will be intelligently pushed to the business system for intelligent configuration based on the statistical data.

[0158] The first preset range is set according to the actual situation, and this application does not make specific limitations.

[0159] D3: When the ratio of menu access volume to interface access volume is within the second preset range, intelligently adjust the mapping relationship between the business system menu and interface.

[0160] In D3, when the ratio of menu visits to API visits is within the second preset range, indicating that the ratio of menu visits to API visits has reached a new high, the mapping relationship between the menu and API with the new high ratio is intelligently adjusted to achieve the goal of intelligent automatic API configuration.

[0161] The specific mapping process between the menus and interfaces of the intelligent dispatch business system is as follows:

[0162] For interfaces where the menu is not configured, the backend monitors the menu interface access records and statistics; when the interface access volume is high and reaches a set ratio, the backend automatically pushes the menu interface configuration to the business system to allow access and notifies the business side for confirmation.

[0163] The second preset range is set according to the actual situation, and this application does not make specific limitations.

[0164] The system intelligently and automatically configures menu and interface relationships. During verification, only the configured menu IDs are validated, and menu IDs not configured in the mapping relationship are not validated at the interface level. This makes it convenient for business systems to gradually add and maintain mapping relationships.

[0165] S206: If the user's login status is invalid, the user does not have permission to access the menu they are currently accessing, or the user does not have permission to access the interface of the business system, generate the corresponding permission-unauthorized access record.

[0166] To enhance security controls and effectively prevent users from accessing third-party business systems via browser links without authorization, this solution is designed to block such unauthorized access. After implementation, this solution is primarily used for interface-level authentication within internal operating systems. User login status verification can prevent unauthorized users from accessing third-party business systems, while interface-level authentication effectively blocks unauthorized access by unreliable users, further improving the security of internal operating systems. This technology has already been deployed and is used across all internal operating systems.

[0167] In this embodiment, user login status verification can block unauthorized users from accessing third-party business systems, and authentication of the interfaces corresponding to menu IDs can effectively block unauthorized access by unauthorized users. This solution combines user login status verification and interface-level authentication to effectively block unauthorized access by users accessing third-party business systems. Furthermore, it intelligently configures the mapping relationship between business system menus and interfaces, verifying only menus configured in the mapping relationship, and exempting menus not configured in the mapping relationship from interface-level authentication, thus improving the maintenance efficiency of the mapping relationship between business system menus and interfaces.

[0168] Based on the above embodiments Figure 1 This application discloses an interface-level authentication method based on intelligent configuration. An embodiment of this application also discloses a schematic diagram of an interface-level authentication device based on intelligent configuration, as shown below. Figure 4 As shown, the interface-level authentication device based on intelligent configuration includes:

[0169] The verification unit 401 is used to verify the user's login status when it detects that the user accesses the menu of the business system based on single sign-on.

[0170] The first acquisition unit 402 is used to acquire user login information if the user's login status is valid.

[0171] The authentication unit 403 is used to query the menu IDs of all user permissions based on the user login information and to authenticate the interfaces corresponding to the menu IDs of all user permissions.

[0172] The second acquisition unit 404 is used to allow users to access the business system based on single sign-on if the interface passes authentication, and to acquire the menu access volume, interface access volume and business system requirements of the business system.

[0173] The intelligent configuration unit 405 is used to intelligently configure the mapping relationship between the menu and the interface of the business system according to the menu access volume, interface access volume and business system requirements.

[0174] The generation unit 406 is used to generate a corresponding permissionless access record if the user's login status is invalid, the user does not have permission to access the menu currently accessed, or the user does not have permission to access the interface of the business system.

[0175] Optional, authentication unit 403 includes:

[0176] The query module is used to query the menu IDs of all user permissions based on the user's login information and store the menu IDs of all user permissions in the cache;

[0177] The verification module is used to verify the status of the main authentication switch by accessing the menu of the business system through the menu IDs of all user permissions in the cache.

[0178] The verification module is used to verify the user's login status according to the preset authentication method if the authentication master switch is in the off state.

[0179] The first acquisition module is used to acquire the menu ID in the request to access the menu if the authentication master switch is in the on state.

[0180] The judgment module is used to determine whether the menu ID in the request to access the menu is empty;

[0181] The first operation module is used to initiate an input link access on the business system page and perform authentication operations on the input link access if the menu ID in the request to access the menu is empty.

[0182] The second operation module is used to initiate a click-to-menu access on the business system page if the menu ID in the request to access the menu is not empty, and to perform authentication operations on the click-to-menu access.

[0183] Furthermore, the first operation module for authenticating access to the input link includes:

[0184] The first determining submodule is used to look up the menu ID in the request to access the menu in the local configuration based on the interface accessed by the input link, so as to determine whether it matches the menu ID in the request to access the menu.

[0185] The validation submodule is used to verify whether the menu ID in the request to access the menu matches the cached list of menu IDs if a menu ID is found in the request.

[0186] The first allow submodule is used to allow access if the menu ID in the request to access the menu matches the list of menu IDs in the cache.

[0187] The first judgment submodule is used to determine the status of the menu authentication blocking switch if the menu ID in the request to access the menu is not matched.

[0188] The first interrupt generation submodule is used to interrupt access and generate a permission-unauthorized prompt message if the menu authentication blocking switch is in the on state.

[0189] The second permission submodule is used to allow access if the menu authentication blocking switch is in the off state.

[0190] Furthermore, the second operation module for authenticating access via click-menu style includes:

[0191] The second judgment submodule is used to determine whether the menu ID in the cached menu ID list matches the menu ID in the request to access the menu;

[0192] The third judgment submodule is used to determine the status of the menu authentication blocking switch if the menu ID in the request to access the menu is not matched in the cached menu ID list.

[0193] The second interrupt generation submodule is used to interrupt access and generate a permission-unauthorized prompt message if the menu authentication blocking switch is in the on state.

[0194] The third permission submodule is used to allow access if the menu authentication blocking switch is in the off state;

[0195] The second determining submodule is used to determine whether the menu ID in the request to access the menu is matched in the local configuration if the menu ID in the cached menu ID list is matched in the request to access the menu.

[0196] The execution submodule is used to return to the step of checking whether the menu ID in the request to access the menu is matched in the cached menu ID list if the menu ID in the request to access the menu is not matched in the local configuration.

[0197] The fourth judgment submodule is used to determine whether the mapping relationship of the verification interface in the local configuration is consistent with the mapping relationship of the menu ID in the request to access the menu if the menu ID is matched in the local configuration.

[0198] The fourth allow submodule is used to allow access if the mapping relationship of the interface in the local configuration matches the mapping relationship of the menu ID in the request to access the menu.

[0199] The fifth judgment submodule is used to determine the status of the menu authentication blocking switch if the mapping relationship of the verification interface in the local configuration is inconsistent with the mapping relationship of the menu ID in the request to access the menu.

[0200] The third interrupt generation submodule is used to interrupt access and generate a permission-unauthorized prompt message if the menu authentication blocking switch is in the on state.

[0201] The fifth allow submodule is used to allow access if the menu authentication blocking switch is in the off state.

[0202] Furthermore, the intelligent configuration unit 405 includes:

[0203] The second acquisition module is used to acquire unauthorized access records and count the number of unauthorized access records.

[0204] The push module is used to push the authentication interface to the business system for intelligent configuration based on the number of unauthorized access records when the ratio of menu access volume to interface access volume is within a first preset range.

[0205] The intelligent allocation module is used to intelligently allocate the mapping relationship between the menu and the interface in the business system when the ratio of menu access volume to interface access volume is within a second preset range.

[0206] Furthermore, the verification unit 401 is specifically used to verify the user's login status through a preset authentication method when it detects that the user accesses the menu of the business system based on single sign-on; wherein, the preset authentication method includes at least an authorization authentication method or a security assertion markup language authentication method.

[0207] In this embodiment, user login status verification can block unauthorized users from accessing third-party business systems, and authentication of the interfaces corresponding to menu IDs can effectively block unauthorized access by unauthorized users. This solution combines user login status verification and interface-level authentication to effectively block unauthorized access by users accessing third-party business systems. Furthermore, it intelligently configures the mapping relationship between business system menus and interfaces, verifying only menus configured in the mapping relationship, and exempting menus not configured in the mapping relationship from interface-level authentication, thus improving the maintenance efficiency of the mapping relationship between business system menus and interfaces.

[0208] This application embodiment also provides a storage medium, the storage medium including stored instructions, wherein, when the instructions are executed, the device where the storage medium is located is controlled to execute the interface-level authentication method based on intelligent configuration as described above.

[0209] This application also provides an electronic device, the structural schematic diagram of which is shown below. Figure 5 As shown, it specifically includes a memory 501 and one or more instructions 502, wherein one or more instructions 502 are stored in the memory 501 and configured to be executed by one or more processors 503 to perform the above-mentioned interface-level authentication method based on intelligent configuration.

[0210] For the foregoing method embodiments, in order to simplify the description, they are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, because according to this application, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0211] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For apparatus embodiments, since they are basically similar to method embodiments, the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0212] The steps in the methods of the various embodiments of this application can be adjusted, combined, or deleted according to actual needs.

[0213] Finally, it should be noted that in this paper, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations.

[0214] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

[0215] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. An interface-level authentication method based on intelligent configuration, characterized in that, The method includes: When a user is detected accessing the business system's menu based on single sign-on, verify the user's login status. If the user's login status is valid, obtain the user's login information; Based on the user login information, query the menu IDs of all user permissions, and authenticate the interfaces corresponding to the menu IDs of all user permissions. If the interface passes authentication, it allows users to access the business system based on single sign-on and obtain the business system's menu access volume, interface access volume, and business system requirements; Based on the menu access volume, the interface access volume, and the business system requirements, intelligently configure the mapping relationship between the business system menu and the interface; If the user's login status is invalid, the user does not have permission to access the menu they are currently accessing, or the user does not have permission to access the interface of the business system, a corresponding permission-unauthorized access record will be generated.

2. The method according to claim 1, characterized in that, The step of querying the menu IDs of all user permissions based on the user login information and authenticating the interfaces corresponding to the menu IDs of all user permissions includes: Based on the user login information, query the menu IDs of all user permissions and store them in the cache. Access the business system's menu by using the menu IDs of all user permissions in the cache to verify the status of the master authentication switch; If the authentication master switch is in the off state, the user's login status will be authenticated according to the preset authentication method; If the authentication master switch is in the on state, obtain the menu ID from the request to access the menu; Determine whether the menu ID in the request to access the menu is empty; If the menu ID in the request to access the menu is empty, an input link access is initiated on the page of the business system, and an authentication operation is performed on the input link access. If the menu ID in the request to access the menu is not empty, a click-to-menu access is initiated on the business system's page, and an authentication operation is performed on the click-to-menu access.

3. The method according to claim 2, characterized in that, Authentication of accessed links includes: Based on the interface accessed by the input link, the menu ID in the request to access the menu is looked up in the local configuration to determine whether it matches the menu ID in the request to access the menu. If a menu ID is matched in the request to access the menu, check whether the menu ID in the request to access the menu matches the cached list of menu IDs. If the menu ID in the request to access the menu matches the menu ID list in the cache, access is allowed; If no menu ID is found in the request to access the menu, determine the status of the menu authentication blocking switch; If the menu authentication blocking switch is in the on state, access is interrupted and a permission failure message is generated. Access is allowed if the menu authentication blocking switch is in the off state.

4. The method according to claim 2, characterized in that, Authentication operations for click-to-access menus include: Determine whether the menu ID in the cached menu ID list matches the menu ID in the request to access the menu; If no menu ID in the request to access the menu is matched in the cached menu ID list, determine the state of the menu authentication blocking switch; If the menu authentication blocking switch is in the on state, access is interrupted and a permission failure message is generated. If the menu authentication blocking switch is in the off state, access is allowed; If a menu ID in the request to access the menu is matched in the cached menu ID list, determine whether the menu ID in the request to access the menu is matched in the local configuration. If the menu ID in the request to access the menu is not matched in the local configuration, return to the step of checking whether the menu ID in the request to access the menu is matched in the cached menu ID list; If the menu ID in the request to access the menu is matched in the local configuration, determine whether the mapping relationship of the verification interface in the local configuration is consistent with the mapping relationship of the menu ID in the request to access the menu. If the mapping relationship of the verification interface in the local configuration matches the mapping relationship of the menu ID in the request to access the menu, access is allowed; If the mapping relationship of the verification interface in the local configuration is inconsistent with the mapping relationship of the menu ID in the request to access the menu, determine the state of the menu authentication blocking switch. If the menu authentication blocking switch is in the on state, access is interrupted and a permission failure message is generated. Access is allowed if the menu authentication blocking switch is in the off state.

5. The method according to claim 1, characterized in that, The step of intelligently configuring the mapping relationship between the business system menu and the interface based on the menu access volume of the business system, the interface access volume, and the business system requirements includes: Retrieve records of unauthorized access and count the number of such records; When the ratio of the menu access volume to the interface access volume is within a first preset range, the authentication interface is pushed to the business system for intelligent configuration based on the number of unauthorized access records. When the ratio of menu access volume to interface access volume is within a second preset range, the mapping relationship between the business system menu and interface is intelligently adjusted.

6. The method according to claim 1, characterized in that, When a user is detected accessing the business system's menu via single sign-on, verifying the user's login status includes: When a user is detected accessing the business system menu based on single sign-on, the user's login status is authenticated through a preset authentication method; wherein, the preset authentication method includes at least an authorization authentication method or a security assertion markup language authentication method.

7. An interface-level authentication device based on intelligent configuration, characterized in that, The device includes: The verification unit is used to verify the user's login status when it detects that the user accesses the menu of the business system based on single sign-on. The first acquisition unit is used to acquire user login information if the user's login status is valid. The authentication unit is used to query the menu IDs of all user permissions based on the user login information, and to authenticate the interfaces corresponding to the menu IDs. The second acquisition unit is used to allow users to access the business system based on single sign-on if the interface passes authentication, and to acquire the menu access volume, interface access volume and business system requirements of the business system. The intelligent configuration unit is used to intelligently configure the mapping relationship between the menu and the interface of the business system according to the menu access volume, the interface access volume and the business system requirements; The generation unit is used to generate a corresponding permission-unauthorized access record if the user's login status is invalid, the user's current access menu does not have permission, or the user does not have permission to access the interface of the business system.

8. The apparatus according to claim 7, characterized in that, The authentication unit includes: The query module is used to query the menu IDs of all user permissions based on the user login information, and store the menu IDs of all user permissions in the cache; The verification module is used to verify the status of the main authentication switch by accessing the menu of the business system through the menu IDs of all user permissions in the cache. The verification module is used to verify the user's login status according to the preset authentication method if the authentication master switch is in the off state. The first acquisition module is used to acquire the menu ID and interface name in the request to access the menu if the authentication master switch is in the open state. The judgment module is used to determine whether the menu ID in the request to access the menu is empty; The first operation module is used to initiate an input link access on the page of the business system and perform an authentication operation on the input link access if the menu ID in the request to access the menu is empty. The second operation module is used to initiate a click-to-menu access on the business system page and perform authentication operations on the click-to-menu access if the menu ID in the request to access the menu is not empty.

9. A storage medium, characterized in that, The storage medium includes stored instructions, wherein, when the instructions are executed, the device containing the storage medium is controlled to perform the interface-level authentication method based on intelligent configuration as described in any one of claims 1 to 6.

10. An electronic device, characterized in that, It includes a memory, and one or more instructions, wherein one or more instructions are stored in the memory and configured to be executed by one or more processors as described in any one of claims 1 to 6.

Images