Method and system for identity and access management

Abstract

A method for identity and access management includes receiving, by an identity and access management policy center, identity and access management policy information, wherein the identity and access management policy information includes account information of a user and services accessible by the user; receiving, by an identity and access management policy agent, the identity and access management policy information transmitted by the identity and access management policy center; verifying, by the identity and access management policy agent, whether a token corresponding to a first user is valid according to the identity and access management policy information when a request information including the token is received; and allowing, by the identity and access management policy agent, the first user to access a first service when the token is valid.

Description

Technical Field

[0001] This invention relates to the field of network technology, and in particular to a method and system for Identity and Access Management (IAM). Background Technology

[0002] With the rapid evolution of information technology, enterprises are constantly introducing new services and applications during their digital transformation, and are gradually adopting microservices architecture to replace traditional monolithic systems. While this development has improved the resilience and scalability of systems, it has also brought the following challenges.

[0003] Verification management complexity increases:

[0004] In a microservices architecture, each microservice developer needs to develop their own microservice and maintain their own authentication and authorization mechanism. This results in inconsistent authentication standards for each microservice, increases development and maintenance costs, and exposes the system to potential security risks.

[0005] Integration of identity verification across multiple systems is challenging.

[0006] When an enterprise uses multiple systems, the authentication systems of each system are difficult to integrate, which leads to users having to log in multiple times or perform repeated authentication, thus reducing the user experience.

[0007] Compatibility requirements with external identity providers:

[0008] Enterprises need to integrate with different identity providers and identity and access management systems (such as Azure AD, Okta, Google Identity, etc.). However, the lack of a unified architecture for managing identities and permissions can reduce the overall system's operational efficiency and affect its scalability.

[0009] Compliance requirements and information security assurance:

[0010] With increasingly stringent regulations in various countries (such as GDPR and ISO 27001) on data protection and identity management, companies need to ensure that their systems' verification architecture complies with the latest security standards to avoid potential legal risks.

[0011] Therefore, a method and system for identity and access management is needed to achieve unified identity verification and access management for various system services. This would not only improve interoperability between systems but also effectively reduce development and maintenance costs, meeting the needs of multi-platform, multi-interface environments within enterprises. Summary of the Invention

[0012] The following disclosure is exemplary only and is not intended to limit in any way. In addition to the illustrative aspects, embodiments, and features described, other aspects, embodiments, and features will also become apparent from the accompanying drawings and the detailed description below. That is, the following disclosure is provided to introduce concepts, key points, benefits, and novel and non-obvious technical advantages described in the invention. Selected, and not all, embodiments will be further described in detail below. Therefore, the following disclosure is not intended to represent essential features of the claimed subject matter, nor is it intended to define the scope of use of the claimed subject matter.

[0013] Therefore, the main objective of this invention is to provide a method and system for identity and access management. The system of this invention uses an identity and access management policy center to centrally manage users, user roles, and permissions, allowing administrators to quickly adjust and audit user permissions. Furthermore, the system of this invention uses identity and access management policy proxies deployed in a sidecar mode in front of each service to ensure the acquisition of the latest identity and access management policy information. Since all authentication and authorization are handled uniformly by the identity and access management policy proxies, services only need to handle business logic, significantly reducing development and maintenance costs and improving system integration and security.

[0014] This invention discloses a method for identity and access management, comprising receiving identity and access management policy information through an identity and access management policy center, wherein the identity and access management policy information includes: user account information, services accessible to the user, and application interfaces accessible to the user; receiving the identity and access management policy information transmitted by the identity and access management policy center through an identity and access management policy agent; when receiving a request information from a front-end browser including a token corresponding to a first user, verifying the validity of the token based on the identity and access management policy information through the identity and access management policy agent; and when the token is valid, allowing the first user to access the first service accessible to the first user through the identity and access management policy agent.

[0015] In some implementations, the method further includes: when the token is invalid, the identity and access management policy agent denies the first user access to the first service that the first user can access.

[0016] In some implementations, after the identity and access management policy center receives the identity and access management policy information, the method further includes: transmitting the identity and access management policy information to an identity provider through the identity and access management policy center; receiving, through the identity provider, a first account information of the first user entered by the first user through the front-end browser; generating the token through the identity provider based on the identity and access management policy information and the first account information of the first user; and transmitting the token to the front-end browser through the identity provider so that the front-end browser can generate the request information.

[0017] In some implementations, the first service described above resides in a service mesh.

[0018] In some implementations, the aforementioned identity and access management policy agent resides within the aforementioned service mesh.

[0019] In some implementations, the request information is transmitted to the access management policy agent via an Application Programming Interface Management (APIM).

[0020] In some implementations, when the token is valid, the identity and access management policy agent allows the first user to access the first service accessible to the first user through the application interface.

[0021] In some implementations, after the identity and access management policy agent receives the identity and access management policy information, it stores the identity and access management policy information in a cache.

[0022] In some implementations, the token is in JWT format.

[0023] In some implementations, when the aforementioned token is invalid, the aforementioned identity and access management policy agent sends back an HTTP status code 401 or an HTTP status code 403 to the aforementioned front-end browser.

[0024] This invention proposes an identity and access management system, comprising: a first electronic device configured to implement an identity and access management policy center, wherein the identity and access management policy center performs the following actions: receiving identity and access management policy information, wherein the identity and access management policy information includes: user account information, services accessible to the user, and application interfaces accessible to the user; and a second electronic device configured to implement an identity and access management policy agent, wherein the identity and access management policy center performs the following actions: receiving the identity and access management policy information transmitted by the identity and access management policy center; verifying the validity of the token based on the identity and access management policy information when a request information including a token corresponding to a first user is received from a front-end browser; and allowing the first user to access a first service accessible to the first user when the token is valid. Attached Figure Description

[0025] Figures 1A-1C This is a schematic diagram of an identity and access management system according to an embodiment of the present invention;

[0026] Figure 2 This is a flowchart of an embodiment of the identity and access management method according to the present invention;

[0027] Figure 3A This is a schematic diagram of the program code for initiating an identity and access management policy agent according to an embodiment of the present invention;

[0028] Figure 3B This is a schematic diagram of the program code for setting the identity and access management policy agent according to an embodiment of the present invention;

[0029] Figure 4 This is a schematic diagram of an exemplary operating environment for implementing embodiments of the present invention.

[0030] Symbol Explanation 100: System

[0031] 102: Management Personnel

[0032] 110: Identity and Access Management Strategy Center

[0033] 120: Identity and Access Management Strategy Agent

[0034] 122: Cache

[0035] 130: Identity Provider

[0036] 140: Front-end browser

[0037] 142: First User

[0038] 150: Service

[0039] 160: Service Mesh

[0040] 170: Application Interface Management

[0041] 200: Method

[0042] S205, S210, S215, S220, S225: Steps

[0043] 310: Tag

[0044] 400: Electronic Devices

[0045] 410: Bus

[0046] 412: Memory

[0047] 414: Processor

[0048] 416: Display element

[0049] 418: I / O Ports

[0050] 420:I / O components

[0051] 422: Power Supply Detailed Implementation

[0052] The various aspects of the invention will be described more fully below with reference to the accompanying drawings. However, the invention can be embodied in many different forms and should not be construed as being limited to any particular structure or function presented throughout the invention. Rather, these aspects are provided to make the invention comprehensive and complete, and to provide those skilled in the art with a full understanding of the scope of the invention. Based on the teachings herein, those skilled in the art will recognize that the scope of the invention is intended to cover any aspect disclosed herein, whether implemented alone or in combination with any other aspect of the invention. For example, it can be implemented using any number of the means or methods presented herein. Furthermore, in addition to the various aspects of the invention presented herein, the scope of the invention is more intended to cover means or methods implemented using other structures, functions, or structures and functions. It should be understood that any aspect disclosed herein can be embodied by one or more elements of the claims.

[0053] The word "exemplary" is used herein to mean "serving as an example, instance, or illustration." Any aspect of the invention or a design described herein as "exemplary" is not necessarily to be construed as preferred or superior to other aspects of the invention or design. Furthermore, the same numerals indicate the same elements in all the figures, and unless otherwise specified in the description, the articles "a" and "above" include plural references.

[0054] It is understood that when a component is described as being "connected" or "coupled" to another component, the component may be directly connected to or coupled to the other component, or there may be intermediate components. Conversely, when a component is described as being "directly connected" or "directly coupled" to another component, there are no intermediate components. Other terms used to describe the relationship between components should be interpreted in a similar manner (e.g., "between" and "directly between," "adjacent" and "directly adjacent," etc.).

[0055] Figures 1A-1C This is a schematic diagram of an identity and access management system 100 according to an embodiment of the present invention.

[0056] like Figure 1A As shown, system 100 may include at least an identity and access management policy center 110, an identity and access management policy agent 120, and an identity provider 130, wherein the identity and access management policy center 110 is connected to the identity and access management policy agent 120 and the identity provider 130 via a network (not shown). The network is used as a medium to provide a communication link between the identity and access management policy center 110, the identity and access management policy agent 120, and the identity provider 130. The network may include various connection types, such as wired, wireless communication links, or fiber optic cables, etc.

[0057] The Identity and Access Management Policy Center 110, Identity and Access Management Policy Agent 120, and Identity Provider 130 can be hardware or software. When the Identity and Access Management Policy Center 110, Identity and Access Management Policy Agent 120, and Identity Provider 130 are hardware, they can be various electronic devices with a display screen, including but not limited to smartphones, tablets, laptops, portable laptops, and desktop computers. When the Identity and Access Management Policy Center 110, Identity and Access Management Policy Agent 120, and Identity Provider 130 are software, they can be installed in the aforementioned electronic devices. They can be implemented as multiple software programs or software modules, or as a single software program or software module; no specific limitation is made in this invention.

[0058] An administrator 102 can set identity and access management policy information through the user interface provided by the identity and access management policy center 110. This identity and access management policy information includes at least: the user's account information, the services the user can access, and the application programming interface (API) the user can access. In another embodiment, the identity and access management policy information may further include role-based access control (RBAC) and attribute-based access control (ABAC).

[0059] When the identity and access management policy information is updated, the identity and access management policy center 110 will transmit the identity and access management policy information to the identity and access management policy agent 120 and the identity provider 130, so that the identity and access management policy agent 120 and the identity provider 130 can use the latest identity and access management policy information at any time.

[0060] Identity and Access Management Policy Agent 120 receives identity and access management policy information transmitted by Identity and Access Management Policy Center 110 and stores the information in a cache 122. Even when the connection between Identity and Access Management Policy Agent 120 and Identity and Access Management Policy Center 110 is interrupted, the identity and access management policy information stored in cache 122 can still be used to achieve a decentralized effect. In another embodiment, Identity and Access Management Policy Agent 120 can be an Open Policy Agent (OPA) or an Open Policy Administration Layer (OPAL). It should be noted that although the Identity and Access Management Policy Agent 120 is exemplified as an Open Policy Agent or an Open Policy Administration Layer in this invention, those skilled in the art can make appropriate substitutions or adjustments based on this invention.

[0061] When the identity and access management policy agent 120 receives a request message from a first user 142 via a front-end browser 140, which includes a token corresponding to the first user 142, the identity and access management policy agent 120 can verify whether the token is valid based on the identity and access management policy information.

[0062] When the token is valid, the identity and access management policy agent 120 allows the first user 142 to access the first service that the first user 142 is authorized to access in the backend service 150. When the token is invalid, the identity and access management policy agent 120 denies the first user 142 access to the first service that the first user 142 is authorized to access.

[0063] In more detail, when the first user 142 enters its first account information through the front-end browser 140, the front-end browser 140 transmits the first user 142's first account information to the identity provider 130. Upon receiving the first user 142's first account information, the identity provider 130 generates a token corresponding to the first user 142 based on the identity and access management policy information and the first user 142's first account information, and transmits the token corresponding to the first user 142 to the front-end browser 140 so that the front-end browser 142 can generate request information.

[0064] In another embodiment, identity provider 130 may support identity and access management protocols such as OAuth 2.0 and OpenID Connect. In yet another embodiment, according to the OpenID Connect protocol, the token may be in JWT format. The JWT may include, for example, JSON attributes representing the user's actual authentication. For example, the token may include the following data that can be encoded as a JWT:

[0065] aud – This can refer to the intended audience of the sign. For example, "aud" could be the RP's OAuth client ID;

[0066] iss—This can refer to the unique identifier of the contract issuer;

[0067] nbf – This can mean no earlier than time;

[0068] `exp` – This can include an integer and / or may identify an expiration time, at which time the token can be accepted for processing. The processing of this parameter may depend on whether the current date / time is before the expiration date / time listed in the value. For example, the implementer can provide leeway considering clock offsets. The value can be the number of seconds from 1970-01-01T0:0:0Z measured in UTC until the desired date / time.

[0069] The identity and access management policy agent 120 can verify the validity of the token by checking the aud, iss, nbf, or exp in the token. It should be noted that although the token is aud, iss, nbf, or exp as an example, the invention should not be limited thereto.

[0070] exist Figure 1B In this system, the identity and access management system 100 mainly includes an identity and access management policy center 110, an identity and access management policy agent 120, and an identity provider 130, wherein the identity and access management policy center 110 is connected to the identity and access management policy agent 120 and the identity provider 130. The functions of the identity and access management policy center 110, the identity and access management policy agent 120, and the identity provider 130 are as described above and will not be repeated here.

[0071] and Figure 1A The difference is, Figure 1B System 100 is applied to a service mesh environment. For example... Figure 1B As shown, the identity and access management policy agent 120 and the backend service 150 are located in a service mesh 160.

[0072] In another embodiment, service mesh 160 may be an Istio service mesh. In one embodiment, service mesh 160 may be managed by Kubernetes. Kubernetes is an application programming interface (API) that can coordinate the resources of service 150. Service 150 may be deployed to run on a cluster of virtual machines, and Kubernetes may schedule containers to run on these virtual machines based on the available compute resources of the containers and the resource requirements of each container.

[0073] In more detail, within the service mesh 160 environment, the identity and access management policy proxy 120 is attached to service 150 in a sidecar mode, providing the functionality of authentication tokens. Only after the identity and access management policy proxy 120 verifies the token is the user allowed to access the backend service 150. When the identity and access management policy proxy 120 verifies the token is invalid, it sends an HTTP status code 401 or an HTTP status code 403 back to the frontend browser 140.

[0074] exist Figure 1C In this system, system 100 mainly includes an identity and access management policy center 110, an identity and access management policy agent 120, and an identity provider 130, wherein the identity and access management policy center 110 is connected to the identity and access management policy agent 120 and the identity provider 130. The functions of the identity and access management policy center 110, the identity and access management policy agent 120, and the identity provider 130 are as described above and will not be repeated here.

[0075] and Figure 1A , Figure 1B The difference is, Figure 1CSystem 100 is applied to the Application Programming Interface Management (APIM) environment. For example... Figure 1C As shown, the application interface management 170 is located before the backend service 150. When the application interface management receives the aforementioned request information, it forwards it to the access management policy proxy 120 for verification. Only after the identity and access management policy proxy 120 verifies the token in the request information is valid will the user be allowed to access the backend service 150 via the application interface management 170. If the identity and access management policy proxy 120 verifies the token is invalid, access to the first service accessible to the first user 142 is denied.

[0076] This should be understandable. Figures 1A-1C The management policy center 110, identity and access management policy agent 120, and identity provider 130 shown are examples of an identity and access management system 100 architecture. Figures 1A-1C Each of the devices shown can be implemented via any type of electronic device, such as a reference. Figure 4 The described electronic device 400, such as Figure 4 As shown.

[0077] Figure 2 This is a flowchart illustrating a method 200 for identity and access management according to an embodiment of the present invention. This method can be... Figures 1A-1C The identity and access management policy center 110, access management policy agent 120 and identity provider 130 in the identity and access management system 100 shown are implemented.

[0078] In step S205, an identity and access management policy center receives identity and access management policy information, wherein the identity and access management policy information includes: the user's account information, the services that the user can access, and the application interfaces that the user can access.

[0079] In step S210, an identity and access management policy agent receives the identity and access management policy information transmitted by the identity and access management policy center.

[0080] In step S215, when a request message containing a token corresponding to a first user is received from a front-end browser, the identity and access management policy proxy verifies the validity of the token based on the identity and access management policy information.

[0081] When the aforementioned token is valid ("Yes" in step S215), in step S220, the aforementioned identity and access management policy agent allows the aforementioned first user to access the first service that the aforementioned first user can access.

[0082] When the aforementioned token is invalid ("No" in step S215), in step S225, the aforementioned identity and access management policy agent denies the aforementioned first user access to the aforementioned first service that the aforementioned first user can access. In one embodiment, the aforementioned identity and access management policy agent returns an HTTP status code 401 or an HTTP status code 403 to the front-end browser.

[0083] In one embodiment, after step S205, the identity and access management policy center may transmit the aforementioned identity and access management policy information to an identity provider. The identity provider may receive the first user's first account information entered by a first user through a front-end browser, generate the aforementioned token based on the aforementioned identity and access management policy information and the aforementioned first user's first account information, and transmit the aforementioned token to the front-end browser so that the front-end browser can generate request information.

[0084] The identity and access management method and system proposed in this invention can ensure that service access meets security standards, allowing services to interact and be accessed under the same identity and access management architecture without worrying about system security issues or having to build a complete identity and access management mechanism themselves, thus significantly reducing development costs.

[0085] Furthermore, the identity and access management policy proxy proposed in this invention allows developers to deploy their respective identity and access management systems using the same process. They only need to register with the identity and access management policy center and obtain a subscription key to activate the proxy. Developers can obtain permissions for their respective projects from the identity and access management policy center to run the identity and access management system without spending time developing program code.

[0086] For example, in a Kubernetes Istio environment, developers only need to add a label to their Deployment YAML. For example... Figure 3A As shown, the developer simply adds a label 310 to the Deployment YAML. Once the Pod hosting the container is started, the identity and access management system will initiate an identity and access management policy agent that attaches to the service in a sidecar mode.

[0087] Figure 3B It is program code that displays the settings of the identity and access management policy agent according to an embodiment of the present invention. Figure 3BThe program code is used to set up the redirection of request information to the identity and access management policy agent for verification.

[0088] In other words, regardless of the programming language, simply modifying one or two lines of code can provide complete protection for the service.

[0089] As described above, the identity and access management method and system proposed in this invention provide a unified standard identity and access management architecture (e.g., the identity and access management architecture may include OAuth 2.0 and OIDC standard protocols). This not only significantly reduces development and maintenance costs but also effectively reduces potential security risks, thereby improving security. Furthermore, since the identity and access management policy proxy is a decentralized device and stores identity and access management policy information in a local cache, it can still operate stably even when disconnected from the identity and access management policy center, further improving the reliability and stability of the identity and access management system. In addition, the identity and access management system proposed in this invention supports multiple environments, such as service mesh, application interface management, and monolithic services. Regardless of the environment, the identity and access management system proposed in this invention can operate efficiently, meeting the needs of different application scenarios.

[0090] The embodiments described herein, including systems, methods / processes, and / or apparatuses, can be implemented using well-known computers (such as...). Figure 4 This is achieved by the electronic device 400 shown. For illustrative purposes, the electronic device 400 is described as follows.

[0091] For details, please refer to the following: Figure 4 , Figure 4 This illustrates an exemplary operating environment for implementing embodiments of the present invention and can generally be considered as electronic device 400. Electronic device 400 is merely an example of a suitable computing environment and is not intended to imply any limitation on the use or scope of the invention. Electronic device 400 should also not be construed as having any dependency or requirement in relation to any or a combination of the elements shown.

[0092] This invention can be executed via computer program code or machine-usable instructions. These instructions can be computer-executable instructions for program modules, which are executed by a computer or other machine, such as a personal digital assistant or other portable device. Generally, program modules include routines, programs, objects, components, data structures, etc., and a program module refers to program code that performs a specific task or implements a specific abstract data type. This invention can be implemented in various system configurations, including portable devices, consumer electronics, general-purpose computers, and more specialized computing devices. This invention can also be implemented in distributed computing environments, processing devices connected by communication networks.

[0093] refer to Figure 4 Electronic device 400 includes a bus 410 directly or indirectly coupled to the following devices: a memory 412, one or more processors 414, one or more display elements 416, input / output (I / O) ports 418, input / output (I / O) elements 420, and an illustrative power supply 422. Bus 410 represents an element that may be one or more buses (e.g., an address bus, a data bus, or a combination thereof). Although Figure 4 For simplicity, the various blocks are shown as lines. In reality, the boundaries between the various elements are not specific. For example, the presentation elements of the display device can be regarded as I / O elements; the processor may have memory.

[0094] Electronic device 400 generally includes various computer-readable media. Computer-readable media can be any available media accessible by electronic device 400, including both volatile and non-volatile media, and removable and non-removable media. For example, but not limited to, computer-readable media can include computer storage media and communication media. Computer-readable media also includes volatile and non-volatile media, removable and non-removable media implemented in any method or technology for storing information such as computer-readable instructions, data structures, program modules, or other data. Computer storage media includes, but is not limited to, random access memory (RAM), read-only memory (ROM), electronically eraseable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical disc storage devices, magnetic disks, magnetic disk storage devices or other magnetic storage devices, or any other media that can be used to store desired information and can be accessed by an electronic device 400. Computer storage media itself does not include signals.

[0095] Communication media generally include computer-readable instructions, data structures, program modules, or other data in the form of modular data signals, such as carrier waves or other transmission mechanisms, and includes any information transmission medium. The term "modular data signal" refers to a signal having one or more sets of characteristics or modified in a manner that encodes information within the signal. For example, but not limited to, communication media includes wired media such as wired networks or direct wired connections, and wireless media such as audio, radio frequency, infrared, and other wireless media. Combinations of the above media are included within the scope of computer-readable media.

[0096] Memory 412 includes computer storage media in the form of volatile and non-volatile memory. The memory may be removable, non-removable, or a combination of both. Exemplary hardware devices include solid-state memory, hard disk drives, optical disk drives, etc. Electronic device 400 includes one or more processors that read data from entities such as memory 412 or I / O elements 420. Display element 416 displays data instructions to a user or other device. Exemplary display elements include display screens, etc.

[0097] I / O port 418 allows electronic device 400 to be logically connected to other devices, including I / O element 420, some of which are built-in. Exemplary elements include microphones, joysticks, wireless devices, etc. I / O element 420 can provide a natural user interface for processing user-generated gestures, voice, or other physiological inputs. In some examples, these inputs can be transmitted to a suitable network element for further processing. Electronic device 400 may be equipped with a depth camera, such as a stereo camera system, an infrared camera system, an RGB camera system, and combinations thereof, to detect and identify objects. Furthermore, electronic device 400 may be equipped with sensors (e.g., radar, LiDAR) to periodically sense the surrounding environment within a sensing range, generating sensor information indicating its relationship to the surrounding environment. Moreover, electronic device 400 may be equipped with an accelerometer or gyroscope to detect motion. The output of the accelerometer or gyroscope can be provided to electronic device 400 for display.

[0098] In addition, the processor 414 in the electronic device 400 may also execute the programs and instructions in the memory 412 to perform the actions and steps described in the above embodiments, or other descriptions in the specification.

[0099] Any specific order or hierarchical arrangement of steps disclosed herein is merely illustrative. It should be understood, based on design preferences, that any specific order or hierarchical arrangement of steps in the procedure can be rearranged within the scope disclosed herein. The accompanying method claims present the elements of various steps in an exemplary order and should therefore not be limited to any particular order or hierarchy shown herein.

[0100] The use of ordinal numbers such as "first," "second," and "third" to modify elements in the claims does not imply any priority, order of precedence, sequence of elements, or order of steps performed by the method, but is merely used as identifiers to distinguish different elements with the same name (but different ordinal numbers).

[0101] Although the present invention has been disclosed above by way of example, it is not intended to limit this case. Any person skilled in the art may make some modifications and refinements without departing from the spirit and scope of the present invention. Therefore, the scope of protection of this case shall be determined by the appended claims.

Claims

1. A method for identity and access management, comprising: The identity and access management policy information is received through the identity and access management policy center, which includes: the user's account information, the services that the user can access, and the application interfaces that the user can access. The identity and access management policy information transmitted by the aforementioned identity and access management policy center is received through the identity and access management policy agent. When a request message containing the token corresponding to the first user is received from the front-end browser, the same procedure applies: the identity and access management policy proxy verifies the validity of the token based on the aforementioned identity and access management policy information; and When the aforementioned token is valid, the aforementioned identity and access management policy agent allows the aforementioned first user to access the first service that the aforementioned first user can access.

2. The method for identity and access management as described in claim 1, further comprising: When the aforementioned token is invalid, the aforementioned identity and access management policy agent will deny the aforementioned first user access to the aforementioned first service that the aforementioned first user is entitled to access.

3. The method for identity and access management as described in claim 1, further comprising, after the identity and access management policy center receives the identity and access management policy information: The aforementioned identity and access management policy information is transmitted to the identity provider through the aforementioned identity and access management policy center; The identity provider receives the first user's first account information entered by the first user through the front-end browser. The aforementioned token is generated by the aforementioned identity provider based on the aforementioned identity and access management policy information and the aforementioned first account information of the aforementioned first user; as well as The aforementioned identity provider transmits the aforementioned token to the aforementioned front-end browser, so that the aforementioned front-end browser can generate the aforementioned request information.

4. The method for identity and access management as described in claim 1, wherein the first service is located in a service mesh.

5. The method for identity and access management as described in claim 4, wherein the identity and access management policy agent is located in the service mesh.

6. The method for identity and access management as described in claim 1, wherein the request information is transmitted to the access management policy agent via Application Programming Interface Management (APIM).

7. The method for identity and access management as described in claim 6, wherein when the token is valid, the identity and access management policy agent allows the first user to access the first service accessible to the first user through the application interface.

8. The method for identity and access management as described in claim 1, wherein after the identity and access management policy agent receives the identity and access management policy information, it stores the identity and access management policy information in a cache.

9. The method for identity and access management as described in claim 1, wherein the token is in JWT format.

10. The method for identity and access management as described in claim 1, wherein when the token is invalid, the identity and access management policy agent returns an HTTP status code 401 or an HTTP status code 403 to the front-end browser.

11. A system for identity and access management, comprising: A first electronic device is configured to implement an identity and access management policy center, wherein the identity and access management policy center performs the following: Receive identity and access management policy information, wherein the aforementioned identity and access management policy information includes: the user's account information, the services that the user can access, and the application interfaces that the user can access; and The second electronic device is configured to implement an identity and access management policy agent, wherein the aforementioned identity and access management policy center performs the following: Receive the aforementioned identity and access management policy information transmitted by the aforementioned identity and access management policy center; When a request message containing the token corresponding to the first user is received from the front-end browser, the validity of the token is verified based on the aforementioned identity and access management policy information; and When the aforementioned token is valid, the aforementioned first user is allowed to access the first service that the aforementioned first user can access.

12. The identity and access management system as described in claim 11, wherein when the token is invalid, the identity and access management policy agent denies the first user access to the first service that the first user can access.

13. The identity and access management system as described in claim 11, further comprising: A third electronic device, configured to enable identity provider; After receiving the identity and access management policy information, the identity and access management policy center transmits the identity and access management policy information to the identity provider. The aforementioned identity provider receives the first user's first account information entered by the aforementioned first user through the aforementioned front-end browser; The aforementioned identity provider generates the aforementioned token based on the aforementioned identity and access management policy information and the aforementioned first account information of the aforementioned first user; as well as The aforementioned identity provider transmits the aforementioned token to the aforementioned front-end browser, so that the aforementioned front-end browser can generate the aforementioned request information.

14. The system for identity and access management as described in claim 11, wherein the first service is located in a service mesh.

15. The system for identity and access management as described in claim 14, wherein the identity and access management policy agent is located in the service mesh.

16. The identity and access management system as described in claim 11, wherein the request information is transmitted to the access management policy agent via Application Programming Interface Management (APIM).

17. The identity and access management system of claim 16, wherein when the token is valid, the identity and access management policy agent allows the first user to manage access to the first service accessible to the first user through the application interface.

18. The system for identity and access management as described in claim 11, wherein after the identity and access management policy agent receives the identity and access management policy information, it stores the identity and access management policy information in a cache.

19. The system for identity and access management as described in claim 11, wherein the token is in JWT format.

20. The identity and access management system as described in claim 11, wherein when the aforementioned token is invalid, the aforementioned identity and access management policy agent returns an HTTP status code 401 or an HTTP status code 403 to the aforementioned front-end browser.

Images