A method, system and computer readable storage medium supporting multi-platform user identity unified authentication

Abstract

The application discloses a kind of methods, systems and computer readable storage medium supporting multi-platform user identity unified authentication, belong to computer network identity authentication technical field, to solve the problem of high cost of multi-platform authentication docking in prior art, authentication strategy rigidification, user identity and session management split;The method comprises: generating unified identity identifier for user and automatically associating its ID in each terminal platform;Receive authentication request containing platform security level, and perform identity verification according to pre-configured authentication strategy matched with the security level;After identity verification, actively generate and distribute an independent session token for all associated terminal platforms of user in advance;When receiving logout request from any terminal platform, locate all associated terminal platforms and trigger session synchronization invalidation.

Description

Technical Field

[0001] This invention relates to the field of computer network identity authentication technology, and specifically to a method, system, and computer-readable storage medium that supports unified authentication of user identities across multiple platforms. Background Technology

[0002] With the widespread adoption of digital technologies, users frequently switch between various terminal platforms, such as office platforms, mobile applications, and web services. Identity authentication, as a core component of platform security, still faces significant challenges in today's multi-platform environment.

[0003] First, the fragmented authentication systems of different terminal platforms lead to high integration costs. Each time an enterprise or service provider expands to a new terminal platform, it needs to develop a separate authentication integration module to adapt to its unique API protocols, interface specifications, and authentication methods. For example, different office platforms use different open interface protocols, and third-party mobile applications often employ their own token authentication mechanisms. This piecemeal development approach is not only time-consuming and costly, but also requires modifications to the core authentication logic with each new platform addition, severely impacting the system's scalability and maintainability.

[0004] Secondly, existing authentication schemes lack sufficient policy configuration capabilities and cannot meet the differentiated security needs of different platforms. Traditional single sign-on (SSO) schemes mostly adopt fixed authentication policies, such as only verifying usernames and passwords, which makes it difficult to implement differentiated security protection for platforms with different business sensitivities and network environments.

[0005] To address these issues, the industry has proposed several improvement solutions. One type is a policy configuration scheme based on the Identity Provider (IdP) security objective framework. This scheme requires administrators to understand and select abstract technical standards (such as NIST AAL levels) to configure policies, resulting in a high management threshold and a disconnect between the policy organization dimension and enterprise security management practices. Another type is an adaptive authentication scheme based on user behavior or risk scoring. Its authentication policy relies on a black-box model of real-time calculation, leading to unpredictable and difficult-to-audit authentication behavior, and failing to meet the rigid requirements of enterprises for authentication compliance of critical systems (such as financial systems).

[0006] More importantly, none of the above solutions achieves a complete closed-loop management system, from unified user identification and cross-platform session synchronization to globally unified logout. Identity management, session management, and logout management are typically separate modules in existing technologies, lacking an effective coordination mechanism. Even if a user logs out on one platform, their sessions on other platforms may still remain valid, posing security risks and failing to fundamentally eliminate authentication and operational friction between multiple platforms. Therefore, a new technical solution is urgently needed to address these issues. Summary of the Invention

[0007] To address the technical problems mentioned above, this invention provides a method, system, and computer-readable storage medium that support unified authentication of user identities across multiple platforms. The aim is to reduce the integration costs of multi-platform authentication, provide predictable and auditable differentiated authentication strategies, and achieve collaborative closed-loop management of the entire user identity lifecycle.

[0008] This invention provides a method for unified authentication of user identities across multiple platforms, comprising: generating a globally unique unified identity identifier for a user when the user first registers on any terminal platform, and establishing a mapping relationship between the user ID (unique identifier) ​​of the terminal platform and the unified identity identifier; when the user subsequently registers on other terminal platforms, identifying the same user through preset associated credentials, and automatically associating the user ID of the other terminal platform with the existing unified identity identifier; receiving an authentication request from a target terminal platform containing the platform security level, and converting the authentication request into a standard internal format through an interface adaptation module; matching a pre-configured authentication policy according to the platform security level in the authentication request, and performing identity verification by executing the authentication dimension combination specified by the authentication policy; after the identity verification is successful, querying all terminal platforms associated with the user's unified identity identifier, and proactively and pre-generating and distributing an independent session token for each associated terminal platform; when a cancellation request is received from any terminal platform, locating all associated terminal platforms based on the user's unified identity identifier, and triggering all associated terminal platforms to perform session invalidation operations. This method enables automatic association of user identities, one-time authentication for use on multiple platforms, and global synchronous deregistration, forming a complete closed loop for identity management.

[0009] Optionally, the method further includes: obtaining a mapping relationship between a preset platform security level and a pre-configured authentication policy, wherein the pre-configured authentication policy is a defined combination of authentication dimensions, including at least one of basic authentication, biometric authentication, and third-party authorization authentication. This approach enables administrators to configure predictable and auditable authentication policies for platforms with different security levels based on business needs, thus meeting the enterprise's compliance requirements.

[0010] Furthermore, the independent session token has a lifecycle that is independently configured based on the platform security level of the terminal platform. This enables granular management of sessions across different platforms; platforms with high security levels can be configured with shorter token validity periods to reduce risk, while platforms with low security levels can be configured with longer validity periods to improve user experience, thus balancing security and convenience.

[0011] In one implementation, the independent session token is in JWT format; and triggering all associated terminal platforms to perform session expiration includes: pushing a targeted cancellation notification to all associated terminal platforms, comprising a unique token identifier (JTI) of the session token as the token to be revoked, a one-time anti-replay random number, and a signature. Using JTI for targeted cancellation ensures the accuracy and security of the cancellation operation, avoiding the replay attack risk and the inability to selectively cancel, which are inherent to broadcast cancellation.

[0012] Optionally, the method further includes: setting a global failure counter shared across all terminal platforms, the global failure counter being used to record the number of authentication failures; when the number of authentication failures reaches a preset threshold, locking the user simultaneously on all associated terminal platforms. This mechanism provides cross-platform unified brute-force protection, effectively preventing attackers from attempting to bypass the locking strategy by switching platforms.

[0013] Furthermore, converting the authentication request into a standard internal format includes converting the API request format specific to each terminal platform into a standard internal format using a pre-configured platform adaptation plugin. This decoupled architecture encapsulates platform differences within plugins, eliminating the need to modify the core authentication logic when adding a new platform, thus improving system scalability and reducing integration costs.

[0014] In one implementation, the method further includes performing at least one of signature verification, frequency limiting, and IP filtering on the authentication request before receiving the authentication request. This pre-security check can effectively defend against common network attacks.

[0015] Optionally, the preset association credentials include a mobile phone number or an email address; and before automatically associating the user ID of the other terminal platform with the existing unified identity identifier, the method further includes: when a mapping conflict is detected in the association credentials, confirming that the user has been authenticated. This conflict detection mechanism ensures the accuracy of automatic identity association and effectively prevents identity mapping errors caused by scenarios such as mobile phone number recycling.

[0016] This invention also provides a system supporting unified authentication of user identities across multiple platforms, comprising: a mapping module, used to generate a globally unique unified identity identifier for a user when the user first registers on any terminal platform, and establish a mapping relationship between the user ID of the terminal platform and the unified identity identifier; the mapping module is further used to identify the user as the same user through preset associated credentials when the user subsequently registers on other terminal platforms, and automatically associate the user ID of the other terminal platform with the existing unified identity identifier; an interface adaptation module, communicatively connected to the mapping module, used to receive authentication requests from target terminal platforms that include the platform security level, and convert the authentication requests into a standard internal format; multi-dimensional authentication; The authentication module, which communicates with the interface adaptation module, is used to match a pre-configured authentication policy according to the platform security level in the authentication request, and to perform identity verification by executing the authentication dimension combination specified by the authentication policy. The session management module, which communicates with both the multi-dimensional authentication module and the mapping module, is used to query all terminal platforms associated with the user's unified identity identifier after the identity verification is passed, and to proactively and pre-generate and distribute an independent session token for each associated terminal platform. The session management module is also used to locate all associated terminal platforms of the user based on the user's unified identity identifier when a cancellation request is received from any terminal platform, and to trigger all associated terminal platforms to perform session invalidation operations.

[0017] The present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described above.

[0018] Compared with existing technologies, this invention has the following advantages: First, by encapsulating platform API differences through a standardized interface adaptation layer, the cost of adding new platforms is significantly reduced, and the system has strong scalability. Second, it achieves automatic association and unified view management of user identities across multiple platforms through a unified identity identifier. Third, it provides a pre-configured authentication strategy based on platform security levels, with deterministic, predictable, and auditable results, meeting enterprise compliance requirements. More importantly, this invention organically combines identity mapping, cross-platform proactive pre-synchronization of session tokens, and a unified deregistration mechanism, realizing collaborative closed-loop management of the entire user identity lifecycle—"registration equals association, authentication equals access, and deregistration equals global effectiveness"—improving user experience and system security. Attached Figure Description

[0019] Figure 1 This is a schematic diagram of the system architecture provided for an embodiment of the present invention.

[0020] Figure 2 This is a flowchart illustrating user registration and cross-platform unified identity identifier mapping provided in an embodiment of the present invention.

[0021] Figure 3 This is a schematic diagram of the overall process of multi-platform identity authentication provided in an embodiment of the present invention.

[0022] Figure Labels 10: Unified identity authentication platform; 11: Interface adaptation module; 12: Multi-dimensional authentication module; 13: Session management module; 14: Mapping module; 20: Terminal platform; 30: Data storage module. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of the present invention clearer, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other.

[0024] like Figure 1 As shown, this invention provides a system architecture supporting unified authentication of user identities across multiple platforms. The system uses a unified identity authentication platform 10 as its core hub, responsible for unified scheduling, interface adaptation, and verification management. This platform interacts with multiple external entities, including various terminal platforms 20, such as office platforms, mobile applications, or web services, and a data storage module 30 for persistently storing user data. The unified identity authentication platform 10 mainly includes core components such as a mapping module 14, an interface adaptation module 11, a multi-dimensional authentication module 12, and a session management module 13. The core technical idea of ​​this invention lies in constructing a complete closed-loop management mechanism for the entire lifecycle of user identities. By coordinating the unified identifier of cross-platform identities, the proactive pre-synchronization of independent session tokens, and the globally unified deregistration operation, it achieves the technical effect of "registration equals association, authentication equals access, and deregistration equals global effectiveness," providing users with a seamless and secure multi-platform authentication experience.

[0025] To address the significant differences in API protocols, interface specifications, and authentication methods among different terminal platforms, this invention first constructs a standardized interface adaptation layer, namely the interface adaptation module 11. This module adopts a layered architecture, with its front end being a request access gateway, serving as the unified entry point for all external requests. This gateway is responsible for performing first-layer security checks, including request signature verification based on the HMAC-SHA256 algorithm to ensure the integrity and authenticity of the request's source; frequency limiting checks based on the sliding window token bucket algorithm, for example, configurable to limit each platform and each IP to no more than 100 requests per second, effectively preventing malicious high-frequency attacks; and IP whitelist or blacklist filtering. Through these pre-verification checks, the stability and security of backend services can be effectively guaranteed. This design implements at least one of the following operations for authentication requests: signature verification, frequency limiting, and IP filtering, thereby effectively resisting common network attacks.

[0026] After the request passes through the access gateway, it enters the core part of the interface adaptation module. This part adopts an architecture of "standard internal protocol model plus platform adaptation plugin". Specifically, the system predefines a set of standard internal formats, which includes standardized fields such as request type, platform type, platform security level, and authentication credential payload. For each terminal platform 20 to be accessed, developers only need to write an independent adaptation plugin. The core function of this plugin is to realize bidirectional conversion between the platform-specific API format and the standard internal format, such as the extraction and mapping of request parameters, HTTP method adaptation, and Content-Type format conversion. This adaptation logic is driven by configuration files. When adding a new platform, only a new configuration file needs to be provided, without modifying the core authentication logic code. For example, writing an adaptation configuration for a DingTalk platform can map DingTalk's `requestAuthCode` field to the `credential_payload.authCode` field in the standard internal format. This design completely decouples the platform adaptation logic from the core authentication logic, significantly reducing the access cost of new platforms from the traditional 5-10 person-days to 1-2 person-days, and improving the system's scalability.

[0027] Interface adaptation module 11 also includes an exception handling module and an automatic retry module. The exception handling module is responsible for uniformly classifying and handling various exceptions that may occur during interface calls, such as network timeouts, DNS resolution failures, and HTTP error codes, and generating standardized error messages for easy maintenance and traceability. The automatic retry module performs automatic retries for recoverable errors (such as network timeouts or HTTP 5xx server errors). This module uses an exponential backoff algorithm with random jitter. The retry waiting time follows the formula `2^n × (1 + rand(-0.25, +0.25))` seconds, where `n` is the number of retries, starting from 0. For example, the first retry is initiated 1 second after failure, and subsequent waiting times increase exponentially with an added random jitter to avoid a large number of concurrent retry requests impacting the server at the same time, thus effectively preventing a "retry storm." Specific parameters can be set to a maximum of 3 retries and a total timeout budget of 15 seconds. For HTTP 4xx client errors, no retries are triggered, and a failure response is returned directly.

[0028] After constructing a standardized interface adaptation layer, this invention further elaborates on the full lifecycle management process of user identity. For example... Figure 2 As shown, the process begins with user identity registration and mapping. When a user initiates a registration request for the first time through any terminal platform 20, as shown in step S201: Receiving Registration Request, the unified identity authentication platform 10, upon receiving the registration information, first checks whether the user already exists using preset associated credentials (such as a mobile phone number or email address), as shown in step S202: Checking User Existence Using Associated Credentials. For users registering for the first time, the system will generate a globally unique unified identity identifier for them, such as a random identifier generated using the UUID v4 standard, and establish a mapping relationship between the user's ID on the current terminal platform and this unified identity identifier, as shown in step S203: Generating a Globally Unique Unified Identity Identifier and Establishing the Initial Mapping. This mapping relationship is stored in the data storage module 30, providing a unified identity benchmark for subsequent cross-platform operations.

[0029] When the user subsequently registers through other terminal platforms 20, the system queries again using preset associated credentials (such as a mobile phone number), as shown in step S202. At this point, it can identify that the user already has a registration record. The system then automatically associates the ID of this new platform with the user's existing unified identity identifier, as shown in step S205: associating the unique identifier of the new platform with the existing unified identity identifier. This achieves automatic association of the user's identity across multiple platforms, eliminating the need for cumbersome manual binding operations. To ensure the security of identity mapping, the system also performs identity mapping conflict detection before automatic association, as shown in step S204: performing identity mapping conflict detection. If it detects a fundamental difference between the existing user identity information matched through preset associated credentials and the information submitted during registration (e.g., different username or email address), the system will trigger an additional authentication process, such as sending an SMS verification code to the user's bound mobile phone number. A new mapping relationship is established only after the user confirms their identity. This mechanism effectively prevents identity mapping errors caused by scenarios such as mobile phone number recycling by triggering an additional authentication process. Meanwhile, during the registration process, users' passwords and other sensitive credentials are salted and hashed, for example, using the bcrypt algorithm (cost factor=12) and generating a 16-byte random salt value for each user, which is stored in encrypted form to ensure the security of user credentials.

[0030] like Figure 3 As shown, after a user completes registration and establishes an identity mapping, multi-platform identity authentication can be performed. A user initiates an authentication request on any target terminal platform 20. This request contains a key piece of information: the platform security level, as shown in process step S301: Receiving an authentication request containing the platform security level. This platform security level is predefined by the system administrator based on attributes such as the platform's network environment and business sensitivity, for example, divided into high, medium, and low levels. After the authentication request undergoes protocol adaptation and standardization processing through the interface adaptation module 11, as shown in step S302: Protocol Adaptation and Standardization, it will be routed to the multi-dimensional authentication module 12. The core function of this module is to match the pre-configured authentication policy according to the platform security level in the request and perform identity verification, as shown in step S303: Matching the pre-configured authentication policy and performing verification.

[0031] The authentication strategy configuration method provided by this invention differs fundamentally from existing technologies. Instead of dynamically adjusting based on real-time calculated risk scores, it allows administrators to pre-define a specific combination of authentication dimensions for each platform's security level. For example, administrators can configure platforms with a "high" security level to use a combination of "basic authentication + biometric authentication," "medium" security level platforms to use "basic authentication + third-party authorization authentication," and "low" security level platforms to require only "basic authentication." This pre-configured deterministic strategy makes authentication behavior completely predictable and easy to audit, meeting the compliance requirements of enterprises for critical business systems (such as financial systems). Basic authentication in the authentication dimension combination refers to traditional account and password verification; biometric authentication may include fingerprint, facial, or voiceprint recognition; and third-party authorization authentication achieves passwordless and quick login through protocols such as OAuth 2.0.

[0032] To enhance system security, this invention also introduces a cross-platform unified brute-force attack protection mechanism. The system sets up a global failure counter shared across all 20 terminal platforms. Regardless of which platform a user attempts to log in from, each failed authentication attempt increments this global counter. When the number of consecutive failures reaches a preset threshold (e.g., 5 times), the system triggers a global account lock, prohibiting the user from initiating new authentication requests from any terminal platform. The lock can be automatically unlocked via a timer (e.g., automatically unlocked after 60 minutes) or by the user actively unlocking using an alternative authentication method (e.g., SMS verification code). This mechanism prevents attackers from circumventing the lock by switching between different platforms, providing more robust security protection.

[0033] After successful identity verification, the process enters the independent session token generation and distribution stage, as shown in step S304: pre-generating and distributing tokens for all associated platforms. This is a crucial step in achieving "authentication for access." The session management module 13 generates an independent session token for the user. Unlike traditional single sign-on solutions, this invention not only generates a token for the target terminal platform initiating authentication but also queries a list of all terminal platforms associated with the user's unified identity identifier and proactively and pre-generates and distributes an independent session token for each associated terminal platform. This means that after a user successfully authenticates once, sessions for all their associated platforms are pre-established. When the user switches to other associated platforms, they can directly access them without re-authentication, significantly improving the user experience.

[0034] Each associated session token generated for a specific terminal platform has a uniquely configured lifecycle based on the platform's security level. For example, tokens for high-security platforms might have a validity period of 1-4 hours, while those for low-security platforms could have a validity period of 24-72 hours. This differentiated lifecycle management ensures the security of platforms with high security requirements while providing longer access times for platforms with lower security requirements. Token refreshes for each platform are also performed independently; the expiration or refresh of a token on one platform does not affect the session state of other platforms, thus improving the overall availability of the system.

[0035] To further enhance security and management flexibility, this invention preferably uses the JWT format as an independent session token, and achieves precise targeted revocation through the token's unique identifier, jti. The payload of the JWT token includes the user's Unique Identity Identifier (sub), Platform Identifier (platform), Issuance Time (iat), Expiration Time (exp), and a crucial field—the unique token identifier, jti. This jti field is the core of achieving precise token revocation. When the system needs to invalidate a specific token, it can pinpoint the exact location using the jti.

[0036] The final link in the closed-loop management system constructed by this invention is unified global deregistration, as shown in steps S305: receiving deregistration requests and S306: locating all platforms and revoking tokens in a targeted manner. When a user initiates a deregistration request from any terminal platform 20, as shown in step S305, the session management module 13, upon receiving the request, immediately locates all associated terminal platforms based on the user's unified identity identifier. Subsequently, the system triggers all these associated terminal platforms to perform session invalidation operations, as shown in step S306. Specifically, the system pushes a targeted deregistration notification to all associated platforms. This notification contains the unique token identifier jti of the token to be revoked, a one-time anti-replay random number (nonce) to prevent replay attacks, and a digital signature. After receiving the notification, each terminal platform, after verifying the validity of the signature and nonce, precisely deletes the session token corresponding to jti stored locally, thereby achieving synchronous invalidation of sessions across all platforms.

[0037] This logout mechanism, based on a unified identity identifier (UI) and utilizing a unique token (JTI) for targeted revocation, achieves a "logout takes effect globally" effect. Compared to traditional solutions, its response speed and user experience are significantly improved. Test data shows that in traditional solutions, the delay from logging out of one platform to the complete invalidation of all platform sessions can be as long as 15 to 45 minutes, while the closed-loop collaborative solution of this invention can complete the revocation of all platform tokens within 50 to 150 milliseconds, significantly improving response speed and completing the process within milliseconds. Furthermore, this mechanism supports selective logout, meaning users can specify to log out only on certain platforms while retaining their login status on others, providing greater flexibility and accuracy compared to traditional broadcast logout solutions.

[0038] To achieve the above method, the present invention also provides a system that supports unified authentication of user identities across multiple platforms. For example... Figure 1 As shown, the system includes a mapping module, whose function corresponds to the aforementioned user identity registration and mapping process. This module is responsible for generating a unified identity identifier and managing its mapping relationship with user IDs on various terminal platforms. The system also includes an interface adaptation module 11, used to receive and standardize authentication requests from different terminal platforms; a multi-dimensional authentication module 12, used to match and execute pre-configured authentication policies based on platform security levels; and a session management module 13, responsible for generating, proactively pre-distributing and managing independent session tokens, and performing a unified global deregistration operation. These modules work together to fully implement the multi-platform user identity unified authentication method proposed in this invention.

[0039] The following section provides a more detailed explanation of the implementation of this invention through a specific enterprise application scenario. Assume an enterprise uses both DingTalk and Lark as its office platforms and also has a self-developed mobile office app.

[0040] First, during the system pre-configuration phase, administrators need to register applications on the open platforms of DingTalk and Lark, obtain credentials such as AppKey and AppSecret, and configure the callback address to point to the unified identity authentication platform 10. Simultaneously, in the interface adaptation module 11, adaptation configuration files are written for DingTalk, Lark, and the self-developed app respectively. For example, DingTalk's configuration file defines the mapping rules between its API endpoints, authentication methods, and platform-specific fields (such as `requestAuthCode`) and standard internal format fields (such as `credential_payload.authCode`). Next, administrators preset authentication policies for the three platform security levels—"high," "medium," and "low"—in the management backend. For example, office platforms like DingTalk and Lark are classified as "medium" platform security level, and a "basic authentication + third-party authorization authentication" strategy is specified for them.

[0041] Secondly, during the user registration phase, when user Zhang San registers for the first time through DingTalk, the system generates a unified identity identifier for him (e.g., `a1b2c3d4-e5f6-7890-abcd-ef1234567890`) and associates his DingTalk ID with this identifier. When Zhang San subsequently registers on Lark or a self-developed app using the same mobile number, the system can automatically identify him as the same user and append the new platform ID to the mapping list of this unified identity identifier, without requiring Zhang San to reset his password or manually bind it.

[0042] Then, during the authentication phase, when Zhang San initiates login through the Lark client, Lark sends an authentication request containing the "MEDIUM" platform security level to the unified identity authentication platform 10. The multi-dimensional authentication module 12 matches the "medium" level policy, requiring the execution of "basic authentication + third-party authorization authentication". After Zhang San enters the correct password to complete the basic authentication, the system will guide him to perform authorization authentication through third-party platforms such as WeChat. After both verifications pass, the identity verification is successful. At this time, the session management module 13 not only generates an independent session token for Lark with a validity period of 24 hours, but also immediately queries that Zhang San has also associated with DingTalk and the mobile APP, and proactively and pre-generates and distributes independent session tokens for these two platforms, each with a validity period of 24 hours. The effect is that after Zhang San successfully authenticates in Lark, when he opens DingTalk or the mobile APP, he can directly enter the logged-in state without any operation, realizing "one-time authentication, automatic access to multiple platforms".

[0043] Finally, during the logout phase, when Zhang San clicks "Logout" on Lark, the logout request is sent to the unified identity authentication platform 10. The session management module 13 immediately locates all platforms (Lark, DingTalk, and mobile apps) associated with Zhang San's unified identity identifier and pushes a targeted logout notification to the servers of these platforms, containing a list of unique token identifiers (JTIs) to be revoked, a one-time nonce, and a signature. After receiving the notification and verifying it, each platform immediately clears the corresponding independent session token stored locally. The end result is that Zhang San's login status on all platforms is cleared instantly and synchronously, achieving a unified global logout effect of "logout in one place, invalidation everywhere".

[0044] It should be noted that those skilled in the art will understand that the specific technical features in the above embodiments can be replaced or modified in various ways. For example, in addition to UUID v4, the unified identity identifier can also be generated using namespace-based UUID v5, the Snowflake algorithm, or a hash value of the user's mobile phone number. The password encryption algorithm can also be a more modern algorithm such as scrypt or Argon2id. The format of the independent session token can be PASETO or an opaque token, in addition to JWT. The cross-platform synchronization mechanism for the independent session token can be implemented through active push, asynchronous synchronization via message queues, or passive retrieval by the client, in addition to active push. The unified logout trigger mechanism can be triggered manually by the user, or by a cascading event of password modification or organizational structure changes such as employee departure.

[0045] Furthermore, the present invention also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, enables the implementation of the method for supporting unified authentication of user identities across multiple platforms as described in any of the foregoing embodiments. The medium can be any electronic, magnetic, optical, or other physical device capable of storing program code, such as a read-only memory (ROM), random access memory (RAM), hard disk, or solid-state drive (SSD).

Claims

1. A method for supporting unified authentication of user identities across multiple platforms, characterized in that, The method includes the following steps: When a user registers for the first time on any terminal platform, a globally unique unified identity identifier is generated for the user, and a mapping relationship between the user identifier ID of the terminal platform and the unified identity identifier is established. When the user subsequently registers on other terminal platforms, the same user is identified through preset associated credentials, and the user ID of the other terminal platform is automatically associated with the existing unified identity identifier. Receive authentication requests from the target terminal platform, which include the platform's security level, and convert the authentication requests into a standard internal format through the interface adaptation module; The authentication policy is matched with the platform security level in the authentication request, and the authentication dimension combination specified by the authentication policy is executed to verify the identity. After the identity verification is passed, query all terminal platforms associated with the user's unified identity identifier, and proactively and pre-generate and distribute an independent session token for each associated terminal platform; When a cancellation request is received from any terminal platform, the system locates all associated terminal platforms of the user based on the user's unified identity identifier and triggers all associated terminal platforms to perform session invalidation operations.

2. The method according to claim 1, characterized in that, The method further includes: Obtain the mapping relationship between the preset platform security level and the pre-configured authentication policy. The pre-configured authentication policy is a certain combination of authentication dimensions, which includes at least one of the following: basic authentication, biometric authentication and third-party authorization authentication.

3. The method according to claim 1, characterized in that, The independent session token has a lifecycle that is independently configured according to the platform security level of the terminal platform.

4. The method according to claim 1, characterized in that, The independent session token is in JWT format; triggering all associated terminal platforms to perform session expiration operations includes: A targeted cancellation notification is pushed to all associated terminal platforms, including the unique token identifier jti of the session token, a one-time anti-replay random number, and a signature, wherein the unique token identifier jti is the token identifier to be revoked.

5. The method according to claim 1, characterized in that, The method further includes: Configure a global failure counter shared across all terminal platforms, the global failure counter being used to record the number of authentication failures; When the number of authentication failures reaches a preset threshold, the user is simultaneously locked on all associated terminal platforms.

6. The method according to claim 1, characterized in that, The step of converting the authentication request into a standard internal format includes: By using pre-configured platform adaptation plugins, the API request formats specific to each terminal platform are converted into a standard internal format.

7. The method according to claim 1, characterized in that, The method further includes performing at least one of signature verification, frequency limiting, and IP filtering on the authentication request before receiving the authentication request.

8. The method according to claim 1, characterized in that, The preset association credentials include a mobile phone number or email address; and before automatically associating the user ID of the other terminal platform with the existing unified identity identifier, the method further includes: When a mapping conflict is detected in the associated credentials, the user is confirmed to be authenticated.

9. A system supporting unified authentication of user identities across multiple platforms, characterized in that, include: The mapping module is used to generate a globally unique unified identity identifier for a user when the user registers for the first time on any terminal platform, and to establish a mapping relationship between the user ID of the terminal platform and the unified identity identifier; the mapping module is also used to identify the user as the same user through preset association credentials when the user subsequently registers on other terminal platforms, and to automatically associate the user ID of the other terminal platform with the existing unified identity identifier. An interface adaptation module, which is communicatively connected to the mapping module, is used to receive an authentication request from the target terminal platform that includes the platform's security level, and convert the authentication request into a standard internal format. A multi-dimensional authentication module, which is connected to the interface adaptation module, is used to match a pre-configured authentication policy according to the platform security level in the authentication request, and to perform identity verification by executing the authentication dimension combination specified by the authentication policy. The session management module is communicatively connected to the multi-dimensional authentication module and the mapping module, respectively. After the identity verification is passed, it queries all terminal platforms associated with the user's unified identity identifier and actively and pre-generates and distributes an independent session token for each associated terminal platform. The session management module is also used to locate all associated terminal platforms of the user based on the user's unified identity identifier when a cancellation request is received from any terminal platform, and to trigger all associated terminal platforms to perform session invalidation operations.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1 to 8.

Images