Identity authentication and access control method, system, device and medium

Abstract

The application discloses an identity authentication and access control method, system, device and medium. The identity authentication and access control method comprises the following steps: receiving an access request of a user; judging whether the access request matches an access white list rule; if yes, allowing the user to access without authentication; if not, verifying whether a JWT token is contained in the access request; if not, redirecting the user to a login page, generating a JWT token of the user after the user logs in and passes authentication, the JWT token containing identity information and permission information of the user; verifying the validity of the JWT token, and after the verification passes, performing access control on the user according to the permission information in the JWT token. By adopting the application, the white list is configured to realize fast access of users without authentication, and the local verification mechanism of the JWT token is used to realize identity authentication and access control of the user, so that the network interaction overhead and request response delay are reduced, and the system operation efficiency is improved.

Description

Technical Field

[0001] This application relates to the field of network security technology, specifically to an identity authentication and access control method, system, device, and medium. Background Technology

[0002] In existing enterprise application systems, authentication and access control functions are typically deployed separately: the authentication system is responsible for authenticating user identities, such as LDAP / AD domain authentication and OAuth 2.0 authentication; the access control system is responsible for user-based permission control, such as the Role-Based Access Control (RBAC) model. This separate architecture has the following drawbacks: First, the separation of authentication and access control increases system complexity, as user requests must pass through authentication and permission services sequentially, leading to increased network latency; second, the separate architecture easily blurs security boundaries, and the connection between authentication and authorization may be vulnerable to permission bypass vulnerabilities; furthermore, most existing technologies lack flexible whitelist configuration mechanisms, making it difficult to perform fine-grained authentication-free access control for specific domains, paths, or IPs. Although some authentication and access control methods exist, they usually rely on specific communication protocols or introduce complex frameworks, resulting in high system complexity, significant resource consumption, and difficulty in meeting network latency and system performance requirements. Summary of the Invention

[0003] In view of the above-mentioned defects or deficiencies in the existing technology, it is desirable to provide an identity authentication and access control method, system, device and medium that enables fast access for unauthenticated users by configuring a whitelist and realizes user identity authentication and access control through the local verification mechanism of JWT tokens, thereby reducing network interaction overhead and request response latency and improving system operating efficiency.

[0004] In a first aspect, embodiments of this application provide an identity authentication and access control method, including: Receive user access requests; Determine whether the access request matches the access whitelist rule; if so, allow the user to access without authentication. If not, verify whether the access request contains a JWT token; If not included, the user is redirected to the login page, and after the user's login authentication is successful, a JWT token is generated for the user, wherein the JWT token contains the user's identity information and permission information; Verify the validity of the JWT token, and after successful verification, perform access control on the user based on the permission information within the JWT token.

[0005] In some examples, determining whether the access request matches an access whitelist rule includes: When the access whitelist rule includes a configuration dimension, it is determined whether the configuration dimension matches the corresponding configuration dimension in the access request. If they match, the access request is determined to match the access whitelist rule. When the access whitelist rule contains multiple configuration dimensions, the multiple configuration dimensions in the access request are matched and judged in sequence according to a preset priority order. If any configuration dimension matches, the access request is determined to match the access whitelist rule.

[0006] In some examples, it also includes: Before determining whether the access request matches the access whitelist rule, the process also includes: Configure access whitelist rules, wherein the access whitelist rules support configuration according to one or more of the following configuration dimensions: domain name, path, and IP address; When there is more than one configuration dimension, a priority order is set for each configuration dimension.

[0007] In some examples, after redirecting the user to the login page, the following is also included: Receive the login information submitted by the user; Based on the login information, invoke the corresponding authentication service to perform login authentication; Receive the authentication result returned by the authentication service.

[0008] In some examples, the access control of the user based on the permission information within the JWT token includes: Based on the permission information, verify whether the user has the access permission to the backend application requested by the access request; If so, the access request is forwarded to the backend application, and the resources returned by the backend application are forwarded to the user.

[0009] In some examples, forwarding the access request to a backend application and forwarding the resource returned by the backend application to the user includes: Through routing decisions and load balancing, the access request is forwarded to the corresponding business service of the backend application; The resources returned by the service are forwarded to the user.

[0010] In some examples, the JWT token is automatically included in the user's access request during the validity period of the JWT token.

[0011] Secondly, embodiments of this application provide an identity authentication and access control system, including: The receiving module is used to receive user access requests; The judgment module is used to determine whether the access request matches the access whitelist rule. If it does, the user is allowed to access the site without authentication. The verification module is used to verify whether the access request contains a JWT token if it does not. An authentication module is used to redirect the user to a login page if the authentication is not available, and to generate a JWT token for the user after the user's login authentication is successful. The JWT token contains the user's identity information and permission information. The control module is used to verify the validity of the JWT token, and after successful verification, to perform access control on the user based on the permission information in the JWT token.

[0012] Thirdly, embodiments of this application provide a computing device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the authentication and access control method according to the first aspect described above.

[0013] Fourthly, embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, it implements the authentication and access control method according to the first aspect described above.

[0014] In this embodiment, the system first receives a user's access request; then it determines whether the access request matches the access whitelist rules. If it does, the user is allowed access without authentication; otherwise, it verifies whether the access request contains a JWT token. If not, the user is redirected to the login page, and after successful login authentication, a JWT token is generated for the user, containing the user's identity and permission information. Finally, the validity of the JWT token is verified, and upon successful verification, access control is implemented for the user based on the permission information within the JWT token. Thus, by configuring a whitelist, fast access for authentication-free users is achieved, and user authentication and access control are implemented through the local verification mechanism of the JWT token, thereby reducing network interaction overhead and request-response latency, and improving system operating efficiency.

[0015] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description

[0016] Other features, objects, and advantages of this application will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings: Figure 1A flowchart illustrating the identity authentication and access control method provided in the embodiments of this application; Figure 2 This is an overall architecture diagram of the identity authentication and access control method provided in the embodiments of this application; Figure 3 The authentication flowchart provided for the embodiments of this application; Figure 4 A configuration management flowchart provided for embodiments of this application; Figure 5 This is a structural block diagram of the identity authentication and access control system provided in the embodiments of this application; Figure 6 A schematic diagram of a computing device suitable for implementing embodiments of this application is shown. Detailed Implementation

[0017] The present application will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the relevant application and not intended to limit the application. Furthermore, it should be noted that, for ease of description, only the parts relevant to the application are shown in the accompanying drawings.

[0018] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0019] The following describes, with reference to the accompanying drawings, an identity authentication and access control method, system, device, and medium according to embodiments of this application.

[0020] Figure 1 This is a flowchart of an identity authentication and access control method according to an embodiment of this application, such as... Figure 1 As shown, an identity authentication and access control method according to an embodiment of this application includes the following steps: S101: Receive user access requests.

[0021] like Figure 2 As shown, users send access requests to backend applications through the client layer, which includes web browsers, mobile applications, application programming interface (API) clients, etc.

[0022] S102: Determine whether the access request matches the access whitelist rule. If so, allow the user to access without authentication.

[0023] In one embodiment of this application, before determining whether the access request matches the access whitelist rule, the method further includes: configuring the access whitelist rule, wherein the access whitelist rule supports configuration according to one or more configuration dimensions among domain name, path, and IP address; when there is more than one configuration dimension, a priority order is set for each configuration dimension.

[0024] Among them, the domain whitelist refers to supporting authentication-free access for all path requests under a specific domain; the path whitelist refers to supporting authentication-free access for specific path requests; and the IP address whitelist refers to supporting authentication-free access for requests from specific IP addresses or address ranges. These configuration dimensions can be combined; for example, a "domain + path" combination rule can be configured. When multiple configuration dimensions are combined, matching is performed according to a preset priority order to ensure accurate matching of the target request.

[0025] In addition, such as Figure 4 As shown, the configuration and verification process for whitelist rules is as follows: The administrator submits the configured whitelist rules, the system verifies the legality of the whitelist rules, and if the verification passes, the whitelist rules are saved to the configuration center; the gateway listens for configuration change events, pulls the latest whitelist rules from the configuration center, and updates the memory cache, thereby processing access requests according to the updated whitelist rules; if the verification fails, an error message is returned so that the administrator can modify and submit it.

[0026] In one embodiment of this application, determining whether the access request matches an access whitelist rule includes: when the access whitelist rule contains one configuration dimension, determining whether the configuration dimension matches the corresponding configuration dimension in the access request; if they match, determining that the access request matches the access whitelist rule; when the access whitelist rule contains multiple configuration dimensions, sequentially matching and determining the multiple configuration dimensions in the access request according to a preset priority order; if any configuration dimension matches, determining that the access request matches the access whitelist rule.

[0027] In a specific example, if a "path + IP address" combination rule is set, upon receiving an access request, it will determine whether the user's path matches a path in the access whitelist. If they match, the user is allowed access without authentication; otherwise, it will further determine whether the user's IP address matches. If they match, the user is allowed access without authentication; otherwise, user authentication will be performed.

[0028] S103: If not, verify whether the access request contains a JWT token.

[0029] The JWT token stores the user's identity and permission information, such as... Figure 3As shown, the JWT token information is cached locally. When a user makes an access request, the JWT token is directly verified through the gateway without frequent access to the authentication center, thereby reducing network overhead and improving system response efficiency. It also supports cross-domain authentication status sharing, that is, for services of different domains, single sign-on can be achieved by verifying the user's JWT token. At the same time, the JWT token is bound to the user's IP address, thereby effectively preventing the token from being stolen from other locations.

[0030] S104: If not included, redirect the user to the login page, and after the user's login authentication is successful, generate the user's JWT token, wherein the JWT token contains the user's identity information and permission information.

[0031] In one embodiment of this application, after redirecting the user to the login page, the method further includes: receiving login information submitted by the user; invoking the corresponding authentication service to perform login authentication based on the login information; and receiving the authentication result returned by the authentication service.

[0032] Specifically, such as Figure 3 As shown, when the gateway does not detect a JWT token in the access request, it redirects the user request to the authentication center. The authentication center displays a login page to the user. After the user submits login information, the gateway calls the corresponding authentication service for authentication based on the type of login information. Authentication services include, but are not limited to, LDAP / AD domain authentication, OAuth2.0 authentication, SMS gateway authentication, and enterprise application authentication. Then, the authentication result is returned to the gateway. If the authentication is successful, the gateway generates a JWT token containing the user's identity and permission information based on the information returned by the authentication service, sets it in a cookie, and returns it to the browser.

[0033] S105: Verify the validity of the JWT token, and after successful verification, perform access control on the user based on the permission information in the JWT token.

[0034] The validity verification of JWT tokens includes: whether the token signature is complete, whether it is within the valid time period, and whether the requesting client IP address matches the IP address bound to the token.

[0035] In one embodiment of this application, the step of performing access control on the user based on the permission information in the JWT token includes: verifying whether the user has access rights to the backend application requested by the access request based on the permission information; if so, forwarding the access request to the backend application and forwarding the resources returned by the backend application to the user.

[0036] In one embodiment of this application, such as Figure 2As shown, forwarding the access request to the backend application and forwarding the resources returned by the backend application to the user includes: forwarding the access request to the corresponding business service of the backend application through routing decisions and load balancing; and forwarding the resources returned by the business service to the user.

[0037] Routing decision refers to determining which business service should handle an access request based on its characteristics, thereby achieving accurate request distribution. Load balancing refers to selecting a running instance from multiple running instances of the target business service to handle the request according to user permissions or preset policies after the target business service has been identified, thereby avoiding single point overload and improving system operating efficiency.

[0038] In one embodiment of this application, the JWT token is automatically included in the user's access request during the validity period of the JWT token.

[0039] like Figure 3 As shown, when a user accesses other applications, the request automatically includes the issued JWT token. Upon receiving the request, the API gateway verifies the validity of the JWT token locally, eliminating the need to repeatedly forward it to the authentication center. After successful verification, the gateway directly forwards the access request to the backend application, which processes the request and returns the application page. This achieves single sign-on, reduces system response latency, and improves processing efficiency.

[0040] According to the authentication and access control method in this application, the method first receives a user's access request; then it determines whether the access request matches the access whitelist rules. If it does, the user is allowed access without authentication; otherwise, it verifies whether the access request contains a JWT token. If not, the user is redirected to the login page, and after successful login authentication, a JWT token is generated for the user, containing the user's identity and permission information. Finally, the validity of the JWT token is verified, and after successful verification, access control is applied to the user based on the permission information within the JWT token. Thus, by configuring a whitelist, fast access for users without authentication is achieved, and by using the local verification mechanism of the JWT token, user authentication and access control are implemented, thereby reducing network interaction overhead and request-response latency, and improving system operating efficiency.

[0041] Figure 5 This is a structural block diagram of the identity authentication and access control system according to an embodiment of this application, such as... Figure 5 As shown, the identity authentication and access control system according to an embodiment of this application includes: a receiving module 510, a judging module 520, a verification module 530, an authentication module 540, and a control module 550, wherein: The receiving module 510 is used to receive user access requests; The judgment module 520 is used to determine whether the access request matches the access whitelist rule based on the access request. If it does, the user is allowed to access the access without authentication. The verification module 530 is used to verify whether the access request contains a JWT token if it does not. The authentication module 540 is used to redirect the user to the login page if the authentication is not included, and to generate the user's JWT token after the user's login authentication is successful, wherein the JWT token contains the user's identity information and permission information; The control module 550 is used to verify the validity of the JWT token, and after successful verification, to perform access control on the user based on the permission information in the JWT token.

[0042] The identity authentication and access control system according to the embodiments of this application first receives a user's access request; then it determines whether the access request matches the access whitelist rules. If it does, the user is allowed access without authentication; otherwise, it verifies whether the access request contains a JWT token. If not, the user is redirected to the login page, and after successful login authentication, a JWT token is generated for the user, containing the user's identity and permission information. Finally, the validity of the JWT token is verified, and after successful verification, access control is implemented for the user based on the permission information within the JWT token. Thus, by configuring a whitelist, fast access for users without authentication is achieved, and user identity authentication and access control are implemented through the local verification mechanism of the JWT token, thereby reducing network interaction overhead and request-response latency, and improving system operating efficiency.

[0043] It should be noted that the specific implementation of the identity authentication and access control system in this application embodiment is similar to the specific implementation of the identity authentication and access control method in this application embodiment. Please refer to the description in the method section for details, which will not be repeated here.

[0044] The following is for reference. Figure 6 , Figure 6 A schematic diagram of a computing device structure suitable for implementing embodiments of this application is shown.

[0045] like Figure 6As shown, the computer system 1000 includes a central processing unit (CPU) 1001, which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 1002 or programs loaded from storage section 1008 into random access memory (RAM) 1003. The RAM 1003 also stores various programs and data required for the system's operating instructions. The CPU 1001, ROM 1002, and RAM 1003 are interconnected via a bus 1004. An input / output (I / O) interface 1005 is also connected to the bus 1004.

[0046] The following components are connected to I / O interface 1005: an input section 1006 including a keyboard, mouse, etc.; an output section 1007 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 1008 including a hard disk, etc.; and a communication section 1009 including a network interface card such as a LAN card, modem, etc. The communication section 1009 performs communication processing via a network such as the Internet. A drive 1010 is also connected to I / O interface 1005 as needed. A removable medium 1011, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 1010 as needed so that computer programs read from it can be installed into storage section 1008 as needed.

[0047] Specifically, according to embodiments of this application, the flowchart above refers to... Figure 1 The described process can be implemented as a computer-readable storage medium. For example, embodiments of this application include a computer-readable storage medium comprising a computer program containing program code for performing the methods shown in the flowchart, such as performing: receiving a user's access request; Determine whether the access request matches the access whitelist rule; if so, allow the user to access without authentication. If not, verify whether the access request contains a JWT token; If not included, the user is redirected to the login page, and after the user's login authentication is successful, a JWT token is generated for the user, wherein the JWT token contains the user's identity information and permission information; Verify the validity of the JWT token, and after successful verification, perform access control on the user based on the permission information within the JWT token.

[0048] Specifically, according to embodiments of this application, the flowchart above refers to... Figure 1The described process can be implemented as a computer software program. For example, embodiments of this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowchart, such as performing: receiving a user's access request; Determine whether the access request matches the access whitelist rule; if so, allow the user to access without authentication. If not, verify whether the access request contains a JWT token; If not included, the user is redirected to the login page, and after the user's login authentication is successful, a JWT token is generated for the user, wherein the JWT token contains the user's identity information and permission information; Verify the validity of the JWT token, and after successful verification, perform access control on the user based on the permission information within the JWT token.

[0049] In such an embodiment, the computer program includes program code for performing the methods shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via communication section 1009, and / or installed from removable media 1011. When the computer program is executed by the central processing unit (CPU) 1001, it performs the functions defined in the system of this application.

[0050] It should be noted that the computer-readable medium shown in this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0051] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operational instructions of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two connected blocks may actually be executed substantially in parallel, or they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified functions or operational instructions, or using a combination of dedicated hardware and computer instructions.

[0052] The units or modules described in the embodiments of this application can be implemented in software or hardware. The described units or modules can also be located in a processor. The names of these units or modules do not, in certain circumstances, constitute a limitation on the unit or module itself.

[0053] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0054] The above embodiments merely illustrate several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A method for identity authentication and access control, characterized in that, include: Receive user access requests; Determine whether the access request matches the access whitelist rule; if so, allow the user to access without authentication. If not, verify whether the access request contains a JWT token; If not included, the user is redirected to the login page, and after the user's login authentication is successful, a JWT token is generated for the user, wherein the JWT token contains the user's identity information and permission information; Verify the validity of the JWT token, and after successful verification, perform access control on the user based on the permission information within the JWT token.

2. The authentication and access control method according to claim 1, characterized in that, The determination of whether the access request matches the access whitelist rule includes: When the access whitelist rule includes a configuration dimension, it is determined whether the configuration dimension matches the corresponding configuration dimension in the access request. If they match, the access request is determined to match the access whitelist rule. When the access whitelist rule contains multiple configuration dimensions, the multiple configuration dimensions in the access request are matched and judged in sequence according to a preset priority order. If any configuration dimension matches, the access request is determined to match the access whitelist rule.

3. The authentication and access control method according to claim 2, characterized in that, Before determining whether the access request matches the access whitelist rule, the process also includes: Configure access whitelist rules, wherein the access whitelist rules support configuration according to one or more of the following configuration dimensions: domain name, path, and IP address; When there is more than one configuration dimension, a priority order is set for each configuration dimension.

4. The authentication and access control method according to claim 1, characterized in that, After redirecting the user to the login page, the process also includes: Receive the login information submitted by the user; Based on the login information, invoke the corresponding authentication service to perform login authentication; Receive the authentication result returned by the authentication service.

5. The authentication and access control method according to claim 1, characterized in that, The step of controlling access to the user based on the permission information within the JWT token includes: Based on the permission information, verify whether the user has the access permission to the backend application requested by the access request; If so, the access request is forwarded to the backend application, and the resources returned by the backend application are forwarded to the user.

6. The authentication and access control method according to claim 5, characterized in that, The step of forwarding the access request to the backend application and forwarding the resources returned by the backend application to the user includes: Through routing decisions and load balancing, the access request is forwarded to the corresponding business service of the backend application; The resources returned by the service are forwarded to the user.

7. The authentication and access control method according to claim 1, characterized in that, During the validity period of the JWT token, the user's access request will automatically include the JWT token.

8. An identity authentication and access control system, characterized in that, include: The receiving module is used to receive user access requests; The judgment module is used to determine whether the access request matches the access whitelist rule. If it does, the user is allowed to access the site without authentication. The verification module is used to verify whether the access request contains a JWT token if it does not. An authentication module is used to redirect the user to a login page if the authentication is not available, and to generate a JWT token for the user after the user's login authentication is successful. The JWT token contains the user's identity information and permission information. The control module is used to verify the validity of the JWT token, and after successful verification, to perform access control on the user based on the permission information in the JWT token.

9. A computing device, comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, when the processor executes the computer program, it implements the authentication and access control method according to any one of claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the authentication and access control method according to any one of claims 1-7.

Images