Multi-mode user interfacing processing method, apparatus, device, storage medium and program product

Abstract

The application relates to a user docking processing method and device, equipment, a storage medium and a program product. The method comprises the following steps: obtaining a docking request of an access party; the docking request comprises a source identifier; according to the source identifier, an authentication processing link corresponding to the access party is determined from preconfigured docking information; the authentication processing link comprises a first mode link, a second mode link and a third mode link; the first mode link is used for authentication according to a pre-stored user white list; the second mode link is used for authentication according to a user credential transmitted in a cipher text; the third mode link is used for authentication according to an authentication result returned by a callback interface of a third party; the docking request is subjected to authentication processing through the authentication processing link corresponding to the access party; and after the docking request is authenticated, an access token is generated and issued. The method can expand the scene coverage range of cross-system docking.

Description

Technical Field

[0001] This application relates to the field of information protection technology, and in particular to a multi-mode user interface processing method, apparatus, device, storage medium, and program product. Background Technology

[0002] As the digital transformation of the financial industry deepens, institutional clients' demands for investment research data services are becoming increasingly diversified. Financial institutions such as securities firms and fund companies hope to connect their internal business systems with external investment research platforms to achieve cross-system sharing and access to investment research data. Against this backdrop, passwordless inter-system connection technology has gradually become a research hotspot in the fintech field, which enables identity verification and secure communication between third-party systems and target platforms without requiring users to actively enter their account passwords.

[0003] In traditional technologies, passwordless connection between systems typically uses the standard OAuth 2.0 authorization protocol. Users are redirected to the authorization server through their browser to complete identity verification and then authorize the third-party system to obtain access permissions.

[0004] However, when dealing with the connection between financial institution systems, the passwordless connection technology between these systems cannot simultaneously meet customers' needs for data compliance and flexible configuration, making it difficult for institutions with different user management systems to achieve cross-system authentication connection without exposing sensitive information. Summary of the Invention

[0005] Therefore, it is necessary to provide a multi-mode user interface processing method, apparatus, equipment, storage medium, and program product to address the aforementioned technical problems.

[0006] Firstly, this application provides a multi-mode user interface processing method, including:

[0007] Obtain the connection request from the access party; the connection request includes the source identifier;

[0008] Based on the source identifier, the authentication processing link corresponding to the access party is determined from the pre-configured docking information; the authentication processing link includes a first mode link, a second mode link, and a third mode link; the first mode link is used for authentication based on a pre-stored user whitelist; the second mode link is used for authentication based on the encrypted user credentials; and the third mode link is used for authentication based on the authentication result returned by the third party's callback interface.

[0009] The connection request is authenticated and processed through the authentication processing link corresponding to the access party;

[0010] After the connection request is authenticated, an access token is generated and issued.

[0011] In one embodiment, the authentication processing link corresponding to the access party is a first-mode link, which performs authentication processing on the connection request through the authentication processing link corresponding to the access party, including:

[0012] Obtain the user whitelist pre-stored by the access party; the user whitelist must include at least one authenticated first user identifier;

[0013] The system obtains the second user identifier to be authenticated from the access party based on the connection request, and matches it with the first user identifier and the second user identifier in the user whitelist.

[0014] If the first user identifier and the second user identifier match successfully, the connection request is confirmed to have passed authentication; if the first user identifier and the second user identifier do not match successfully, an authentication failure message is returned.

[0015] In one embodiment, the authentication processing link corresponding to the access party is a second-mode link, which performs authentication processing on the connection request through the authentication processing link corresponding to the access party, including:

[0016] Obtain the encrypted field based on the connection request, and obtain the decryption key corresponding to the access party based on the source identifier;

[0017] The encrypted fields are decrypted using the decryption key to obtain user information and validity period timestamp;

[0018] Get the current time and compare it with the expiration timestamp;

[0019] If the current time exceeds the expiration timestamp, the connection request is deemed expired, and an authentication failure message is returned; if the current time has not exceeded the expiration timestamp, user matching is performed based on user information to confirm whether the connection request has passed authentication.

[0020] In one embodiment, the authentication processing link corresponding to the access party is a third-mode link. The authentication processing of the connection request is performed through the authentication processing link corresponding to the access party, including:

[0021] Obtain the original identifier of the access party based on the connection request; the original identifier is used to identify the user identity information of the access party;

[0022] Based on the source identifier, obtain the callback interface address corresponding to the access party, and send a query request to the access party based on the callback interface address; the query request includes the original identifier, and the query request is used by the access party to perform authentication processing based on the original identifier;

[0023] Receive the authentication result returned by the access party; the authentication result includes authentication success information or authentication failure information;

[0024] If the authentication result is successful, user matching is performed based on the user information carried in the successful authentication message to confirm that the connection request has passed authentication.

[0025] In one embodiment, after the connection request is authenticated, an access token is generated and issued, including:

[0026] Obtain user information obtained after authentication through the authentication processing link; user information includes user identifier, user name, and tenant identifier;

[0027] Based on user information and a preset access token structure, an access token is generated and distributed to the access party; the access token includes at least the user identifier, the tenant identifier, and the validity period of the access token.

[0028] In one embodiment, the above-described multi-mode user interface processing method further includes:

[0029] If the connection request is routed to the first-mode link and the connection request also contains a ciphertext field, the ciphertext field is ignored;

[0030] If the docking request is routed to the first-mode link and the docking request still contains the original identifier, ignore the original identifier;

[0031] If the docking request is routed to the first-mode link and the docking request also contains a ciphertext field and the original identifier, the ciphertext field and the original identifier are ignored.

[0032] Secondly, this application also provides a multi-mode user interface processing device, including:

[0033] The acquisition module is used to acquire the connection request from the access party; the connection request includes the source identifier;

[0034] The routing module is used to determine the authentication processing link corresponding to the access party from the pre-configured docking information based on the source identifier. The authentication processing link includes a first mode link, a second mode link, and a third mode link. The first mode link is used to perform authentication based on a pre-stored user whitelist. The second mode link is used to perform authentication based on the encrypted user credentials. The third mode link is used to perform authentication based on the authentication result returned by the callback interface of the third party.

[0035] The authentication module is used to authenticate connection requests through the authentication processing link corresponding to the access party;

[0036] The distribution module is used to generate and distribute access tokens after the connection request is authenticated.

[0037] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0038] Obtain the connection request from the access party; the connection request includes the source identifier;

[0039] Based on the source identifier, the authentication processing link corresponding to the access party is determined from the pre-configured docking information; the authentication processing link includes a first mode link, a second mode link, and a third mode link; the first mode link is used for authentication based on a pre-stored user whitelist; the second mode link is used for authentication based on the encrypted user credentials; and the third mode link is used for authentication based on the authentication result returned by the third party's callback interface.

[0040] The connection request is authenticated and processed through the authentication processing link corresponding to the access party;

[0041] After the connection request is authenticated, an access token is generated and issued.

[0042] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the following steps:

[0043] Obtain the connection request from the access party; the connection request includes the source identifier;

[0044] Based on the source identifier, the authentication processing link corresponding to the access party is determined from the pre-configured docking information; the authentication processing link includes a first mode link, a second mode link, and a third mode link; the first mode link is used for authentication based on a pre-stored user whitelist; the second mode link is used for authentication based on the encrypted user credentials; and the third mode link is used for authentication based on the authentication result returned by the third party's callback interface.

[0045] The connection request is authenticated and processed through the authentication processing link corresponding to the access party;

[0046] After the connection request is authenticated, an access token is generated and issued.

[0047] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps:

[0048] Obtain the connection request from the access party; the connection request includes the source identifier;

[0049] Based on the source identifier, the authentication processing link corresponding to the access party is determined from the pre-configured docking information; the authentication processing link includes a first mode link, a second mode link, and a third mode link; the first mode link is used for authentication based on a pre-stored user whitelist; the second mode link is used for authentication based on the encrypted user credentials; and the third mode link is used for authentication based on the authentication result returned by the third party's callback interface.

[0050] The connection request is authenticated and processed through the authentication processing link corresponding to the access party;

[0051] After the connection request is authenticated, an access token is generated and issued.

[0052] The aforementioned multi-mode user interface processing method, device, equipment, storage medium, and program product obtains the interface request from the access party; the interface request includes a source identifier; based on the source identifier, the authentication processing link corresponding to the access party is determined from pre-configured interface information; the authentication processing link includes a first-mode link, a second-mode link, and a third-mode link; the first-mode link is used for authentication based on a pre-stored user whitelist; the second-mode link is used for authentication based on encrypted user credentials; the third-mode link is used for authentication based on the authentication result returned by a third-party callback interface; the interface request is authenticated through the authentication processing link corresponding to the access party; after the interface request is successfully authenticated, an access token is generated and issued. This method allows computer devices to automatically route to the corresponding authentication processing link based on the configuration information of different access parties, eliminating the need to develop separate access interfaces for each interface scenario, thereby reducing development and maintenance complexity; moreover, different authentication strategies also allow computer devices to be compatible with the user management systems and data compliance requirements of different access parties, further expanding the scope of cross-system interface scenarios. Attached Figure Description

[0053] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0054] Figure 1 This is an application environment diagram of a multi-mode user interface processing method in one embodiment;

[0055] Figure 2 This is one of the flowcharts illustrating a multi-mode user interface processing method in one embodiment;

[0056] Figure 3This is the second flowchart illustrating a multi-mode user interface processing method in one embodiment;

[0057] Figure 4 This is the third flowchart illustrating a multi-mode user interface processing method in one embodiment;

[0058] Figure 5 This is the fourth flowchart illustrating a multi-mode user interface processing method in one embodiment;

[0059] Figure 6 This is the fifth flowchart illustrating a multi-mode user interface processing method in one embodiment;

[0060] Figure 7 This is a structural block diagram of a multi-mode user interface processing device in one embodiment. Detailed Implementation

[0061] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0062] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the embodiments, or any combination of multiple embodiments.

[0063] As the digital transformation of the financial industry deepens, institutional clients' demands for investment research data services are becoming increasingly diversified. Financial institutions such as securities firms and fund companies hope to connect their internal business systems with external investment research platforms to achieve cross-system sharing and access to investment research data. Against this backdrop, passwordless inter-system connection technology has gradually become a research hotspot in the fintech field, which enables identity verification and secure communication between third-party systems and target platforms without requiring users to actively enter their account passwords.

[0064] In traditional technologies, passwordless connection between systems typically uses the standard OAuth 2.0 authorization protocol. Users are redirected to the authorization server through their browser to complete identity verification and then authorize the third-party system to obtain access permissions.

[0065] However, when dealing with the connection between financial institution systems, the passwordless connection technology between these systems cannot simultaneously meet customers' needs for data compliance and flexible configuration, making it difficult for institutions with different user management systems to achieve cross-system authentication connection without exposing sensitive information.

[0066] In view of the above-mentioned technical problems, this application provides a multi-mode user interface processing method, and the following embodiments will specifically illustrate the multi-mode user interface processing method.

[0067] The multi-mode user interface processing method provided in this application embodiment can be applied to, for example... Figure 1 The computer device shown includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The database stores interface configuration data and user authentication data. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements a multi-mode user interface processing method.

[0068] Those skilled in the art will understand that Figure 1 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0069] In one exemplary embodiment, such as Figure 2 As shown, a multi-mode user interface processing method is provided, which can be applied to... Figure 1 Taking computer devices as an example, the explanation includes:

[0070] S201, Obtain the connection request from the access party.

[0071] The connection request includes a source identifier, which is used to uniquely identify the authentication processing link corresponding to the access party in the pre-set connection configuration information. The connection configuration information is stored in the database of the computer device in the form of a configuration table, and the configuration table includes at least a source identifier field, a connection mode field, an encryption key field, and a callback interface address field.

[0072] In this embodiment, before obtaining the connection request from the access party, the computer device first responds to the administrator's configuration table entry operation and obtains the connection configuration information. This connection configuration information includes at least one of the following: source identifier, connection mode, callback interface address, and decryption key. For example, the administrator enters a connection configuration information record through the computer device's management backend, where the source identifier is T00000571, the connection mode is "secret," the decryption key is JRbsZ5gV2bCbf / fOOx+2a9nlFs7Q07UE, and the callback interface address is https: / / test-open.gangtise.com.cn / application / user / api / getInfo. The computer device stores this configuration information in a configuration table, using the source identifier field as a unique key to ensure that each access party corresponds to a unique configuration record.

[0073] After the configuration table changes, the computer device periodically reloads the updated interface configuration information into memory, ensuring that the changes take effect without requiring a service restart. For example, after an administrator completes configuration entry or modification, the computer device scans the configuration table every 15 minutes to check for any added, deleted, or modified configuration records. If a change is detected, the computer device loads the modified configuration record into its memory cache, replacing the original configuration item. When subsequent connection requests arrive, the computer device can directly read the connection configuration information from the memory cache without real-time database queries. Optionally, if a configuration change occurs within the 15-minute interval, the administrator can manually trigger a reload interface to force the computer device to immediately reload the configuration table. It's important to note that during the configuration table reloading process, ongoing connection requests still use the old configuration table before loading, while newly arriving connection requests use the new configuration table after loading; the two processes do not interfere with each other.

[0074] The connection request is transmitted via HTTPS and is primarily encapsulated in JSON format. Upon receiving the connection request, the computer device first performs a structural validity check. This check includes, but is not limited to, verifying that the request body is a valid JSON format, contains required fields, and that the values ​​of each field conform to preset format requirements. If the structural validity check fails, the computer device directly returns an error message and does not proceed to the subsequent authentication process. For example, if the connection request lacks a source identifier field, or if the source identifier field's value is an empty string, the computer device returns an error message indicating a missing source identifier. Furthermore, when querying the corresponding connection configuration information based on the source identifier, if the source identifier does not exist in the configuration table, an error message indicating an unrecognized source identifier is returned.

[0075] It's important to note that the connection request may also include a product identifier. This product identifier is used to route the access party to the target product service corresponding to the product identifier after the connection request is authenticated. For example, the connection request may contain a `productCode` field with a value of 10018. After the connection request is authenticated, the computer device can use this `productCode` field to guide the access party to the corresponding product service. The mapping relationship between product identifiers and target product services can be pre-stored in a configured product routing table. The computer device can then query the product routing table based on the product identifier to determine the interface location of the corresponding target product service and forward the access token generated after authentication and the connection request to the corresponding target product service.

[0076] S202, based on the source identifier, determine the authentication processing link corresponding to the access party from the pre-configured docking information.

[0077] The authentication processing chain includes a first-mode chain (i.e., import mode), a second-mode chain (i.e., encrypted mode), and a third-mode chain (i.e., callback mode). The first-mode chain is used for authentication based on a pre-stored user whitelist. That is, the access party imports the user whitelist into the system in advance, and during authentication, it performs precise matching through user identifiers. In other words, the access party encrypts the user information before transmission, and the computer device decrypts it to complete the authentication. The second-mode chain is used for authentication based on the user credentials transmitted in encrypted form. The third-mode chain is used for authentication based on the authentication result returned by the callback interface of a third party. That is, the computer device calls the interface provided by the access party, and the access party completes the user identity verification and returns the result itself.

[0078] In this embodiment, the computer device queries a pre-existing configuration table using the source identifier as the key. The docking mode field in the configuration table can be used to indicate the type of authentication processing link corresponding to the source identifier. For example, if the source identifier is shk, the computer device queries the configuration table for the source identifier shk and finds that the corresponding docking mode field has the value import, thereby determining that the authentication processing link corresponding to the access party is a first mode link (i.e., import mode).

[0079] It should be noted that after determining the authentication processing link corresponding to the access party, the computer device only needs to process the parameters related to that authentication processing link. Parameters carried in the connection request that are unrelated to that authentication processing link can be directly ignored by the computer device and not input into the subsequent authentication processing flow. For example, when the source identifier shk determines that the authentication processing link is a first-mode link, if the connection request also includes a ciphertext field (i.e., a parameter for the second-mode link) or a raw identifier field (i.e., a parameter for the third-mode link), the computer device will only extract the identifier of the user to be authenticated required by the first-mode link during the parsing process. It will not perform any parsing or processing on the values ​​of the ciphertext field and the raw identifier field, nor will it change the routing policy or interrupt the authentication process due to the presence of these unrelated parameters.

[0080] It is important to note that the connection request may also include a pattern identifier. This pattern identifier is mainly used for cross-validation with the connection pattern field found in the configuration table to ensure the accuracy of the routing policy. For example, if the pattern identifier in the connection request is "import" and the value of the connection pattern field found in the configuration table is also "import", then the two match, and the computer device can route the connection request to the first pattern link. If the pattern identifier in the connection request is "secret" and the value of the connection pattern field found in the configuration table is "import", then the two do not match, the computer device returns a pattern mismatch error message, and does not proceed to the subsequent authentication process.

[0081] S203, the connection request is authenticated through the authentication processing link corresponding to the access party.

[0082] In this embodiment, after determining the authentication processing link corresponding to the access party, the computer device performs the corresponding authentication operation according to the type of the link. If the target mode determined by querying the configuration table based on the source identifier is the first mode link, the computer device extracts the user identifier to be authenticated from the connection request and precisely matches it with the user whitelist pre-imported by the access party. Since the connection mode field corresponding to the source identifier in the configuration table is valued as import, indicating that the access party uses the whitelist pre-import method, the computer device only processes the identifier parameter. If the request also carries other parameters such as the encrypted field, they are ignored. After successful matching, the user status also needs to be verified to ensure that the user status is normal before authentication can be confirmed. If the target mode determined by querying the configuration table based on the source identifier is the second mode link, the connection mode field corresponding to the source identifier in the configuration table is valued as secret, indicating that the access party uses the encrypted transmission method. The computer device extracts the encrypted field from the connection request, obtains the corresponding decryption key from the configuration table based on the source identifier, decrypts it, obtains the user information and the validity period timestamp, and compares the current time with the validity period timestamp. If the current time exceeds the expiration timestamp, the request has expired, and an expiration message is returned. If it has not expired, user matching or creation is performed based on the decrypted user identifier, and the user status is verified. If the status is normal, authentication is successful. If the target mode determined after querying the configuration table based on the source identifier is a third-mode link, the connection mode field corresponding to the source identifier in the configuration table is set to "callback," indicating that the access party uses a callback method to complete identity verification itself. The computer device extracts the original identifier from the connection request, obtains the corresponding callback interface address from the configuration table based on the source identifier, and sends a query request carrying the original identifier to the callback interface address. The access party performs authentication processing based on the original identifier. The computer device receives the authentication result returned by the access party. If authentication is successful, user matching or creation is performed based on the returned user information, and the user status is verified. If the status is normal, authentication is successful; if authentication fails, authentication failure information is returned.

[0083] It is important to note that the authentication process for all three modes is driven by the configuration information determined by the source identifier. Different connection modes correspond to different parameter parsing methods and authentication logic.

[0084] S204: After the connection request is authenticated, an access token is generated and issued.

[0085] The access token is used by the access party to carry in subsequent business interface calls to prove that the connection request has been authenticated; the access token includes at least the user identifier, the tenant identifier, and the validity period of the access token.

[0086] In this embodiment, after the computer device completes the authentication process of the docking request through any one of the first mode link, the second mode link, or the third mode link, if the docking request passes authentication, it obtains the user information returned by the authentication processing link. This user information includes a user identifier (which may correspond to the uid field or user_code field in Table 1), a user name, and a tenant identifier; the user identifier is the user's unique identity identifier in the computer device (which may correspond to the uid field or user_code field in Table 1); the user name is the user's display name (which may correspond to the user_name field in Table 1); and the tenant identifier is the unique identifier of the tenant to which the user belongs (which may correspond to the tenant_id field in Table 1). Table 1 is shown below:

[0087] Table 1

[0088]

[0089] Subsequently, the computer device generates an access token corresponding to the user based on the obtained user information and a preset access token structure. For example, the access token is a JSON structure containing the following fields: uid (user identifier), identifier (external system user identifier), user_name (user name), tenant_id (tenant identifier), time (valid timestamp of the access token), and access_token (unique token identifier). The access_token is a unique string generated by the computer device according to preset token generation rules; optionally, it can be generated using a universally unique identifier format. The time field records the effective timestamp of the access token; when a business request carrying this access token is received subsequently, the computer device can use this timestamp to determine if the access token is still valid. The preset access token structure may also include an ipaddr field (used to record the IP address of the access party), which facilitates access tracing and security auditing by the system.

[0090] After generating an access token, the computer device sends it to the access party. For example, the computer device returns the access token in JSON format via HTTPS. Upon receiving the access token, the access party stores it locally and includes it in the request header when subsequently calling the business interface provided by the computer device, allowing the computer device to authenticate the request. This access token has a validity period after generation; after the expiration date, the access token becomes invalid, and the access party must re-initiate the connection request to obtain a new access token.

[0091] In the aforementioned multi-mode user integration processing method, the integration request from the access party is obtained. The integration request includes a source identifier. Based on the source identifier, the authentication processing link corresponding to the access party is determined from the pre-configured integration information. The authentication processing link includes a first-mode link, a second-mode link, and a third-mode link. The first-mode link is used for authentication based on a pre-stored user whitelist. The second-mode link is used for authentication based on encrypted user credentials. The third-mode link is used for authentication based on the authentication result returned by a third-party callback interface. The integration request is authenticated through the authentication processing link corresponding to the access party. After the integration request is successfully authenticated, an access token is generated and issued. This method allows computer devices to automatically route to the corresponding authentication processing link based on the configuration information of different access parties, eliminating the need to develop separate access interfaces for each integration scenario, thereby reducing the complexity of development and maintenance. Moreover, different authentication strategies also allow computer devices to be compatible with the user management systems and data compliance requirements of different access parties, further expanding the scope of cross-system integration scenarios.

[0092] In an exemplary embodiment, the authentication processing link corresponding to the access party is a first-mode link, and the "authentication processing of the connection request through the authentication processing link corresponding to the access party" in S203 above, such as Figure 3 As shown, it includes:

[0093] S301, retrieve the user whitelist pre-stored by the access party.

[0094] The user whitelist is a set of authenticated user identifiers that the access party imports in batches through a template file provided by the computer device before initiating the connection request. The user whitelist includes at least one authenticated first user identifier.

[0095] In this embodiment, after determining that the authentication processing link corresponding to the access party is a first-mode link, the computer device reads the user whitelist pre-stored by the access party from the local storage medium. For example, the access party fills in user information according to the Excel template provided by the computer device, which includes at least a user identifier column, and the user identifier is unique and cannot be empty; if a mobile phone number field is also filled in, the computer device performs format validation using the regular expression (^1[3-9]\d{9}$); if an email address field is also filled in, the computer device performs format validation using the regular expression (^[A-Za-z0-9._%+-\u4e00-\u9fa5]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,8}$). After successful validation, the computer device writes the user identifiers from the user whitelist into the user_code field of the user table and sets a unique constraint for this field, thereby ensuring that the same user identifier corresponds to only one unique user record in the computer device. Each first user identifier is used to uniquely identify an authenticated user. For example, the user whitelist includes the authenticated first user IDs zt039238432, zt039238433, and zt039238434.

[0096] S302: Obtain the second user identifier to be authenticated from the access party according to the connection request, and match it based on the first user identifier and the second user identifier in the user whitelist.

[0097] In this embodiment, the computer device extracts the second user identifier to be authenticated from the obtained connection request. For example, the connection request includes an `identifier` field, the value of which is the second user identifier to be authenticated, such as `zt039238432`. After extracting the second user identifier, the computer device uses this second user identifier as a matching condition to perform an exact match within the obtained user whitelist. Specifically, the computer device executes an SQL query statement to precisely match the value of the second user identifier against the `user_code` field in the user table, querying whether the user identifier exists in the user whitelist. For example, when the second user identifier is `zt039238432`, the computer device executes an SQL query statement to determine whether `zt039238432` exists in the `user_code` field of the user table. Since the computer device has pre-imported the user table into the user whitelist, and the `user_code` field has a unique constraint, the query result is unique. This exact matching method ensures that only users who have completed the pre-import process and registration can be authenticated; user identifiers not imported cannot be matched, thus effectively preventing unauthorized user access.

[0098] S303: If the first user identifier and the second user identifier match successfully, confirm that the connection request has passed authentication; if the first user identifier and the second user identifier do not match successfully, return authentication failure information.

[0099] In this embodiment, if the first user identifier and the second user identifier match successfully (i.e., a corresponding user record exists for the second user identifier in the user table), the computer device confirms that the connection request has passed the authentication of the first mode link. For example, if the second user identifier zt039238432 matches a corresponding user record in the user table, the computer device confirms successful authentication. If the first user identifier and the second user identifier do not match successfully (i.e., a corresponding user record does not exist for the second user identifier in the user table), the computer device returns authentication failure information. For example, if the second user identifier zt039238433 does not have a corresponding user record in the user table, the computer device returns authentication failure information indicating that the user identifier was not imported.

[0100] It's important to note that before confirming the authentication of the connection request, the computer device also needs to verify the matched user's status. The `status` field in the user table records the user's status, including normal, frozen, and logged-out status. For example, a `status` value of 1 indicates a normal status; a `status` value of 2 indicates a frozen status; and a `status` value of 9 indicates a logged-out status. If the user's status is normal, the computer device confirms the connection request passes authentication; if the user's status is frozen or logged-out, the computer device returns an authentication failure message indicating that the user's status is unavailable, even if the user's identifier matches successfully in the whitelist. This status verification mechanism prevents users who have been frozen or logged out from continuing to access the platform, ensuring that only users with normal status can pass authentication.

[0101] In an exemplary embodiment, the authentication processing link corresponding to the access party is a second-mode link, and the "authentication processing of the connection request through the authentication processing link corresponding to the access party" in S203 above, such as Figure 4 As shown, it includes:

[0102] S401: Obtain the encrypted field according to the connection request, and obtain the decryption key corresponding to the access party according to the source identifier.

[0103] In this embodiment, after confirming that the authentication processing link corresponding to the access party is a second-mode link, the computer device extracts the ciphertext field from the connection request. For example, the connection request includes a ciphertext field, the value of which is the ciphertext field, such as 6GNY1SOYM+rR4uy / i+tw1gYxn / IBxRO2K9hCsf1l6OHKTTaflpn7imiALQySiC / Zs6hazr+bPkwcE5O7l6xRMrZKKU7AAJaFCyP8lYHJoiuoEuBvbTg2XSg+ / 0AoZjZefZLeUqBELtAonXpDGGXvJaAYhBDBwG+zx8SHh+lp2+A=. This ciphertext field is obtained by encrypting the plaintext user information using a pre-set, agreed-upon encryption algorithm before the access party initiates the connection request.

[0104] While extracting the encrypted fields, the computer device retrieves the decryption key and encryption algorithm type corresponding to the access party from the interface configuration information based on the obtained source identifier. For example, if the source identifier is T00000571, the computer device queries a pre-set passwordless login configuration table based on this source identifier and obtains the corresponding decryption key JRbsZ5gV2bCbf / fOOx+2a9nlFs7Q07UE and encryption algorithm type AES. It is important to note that this decryption key is the same key used by the access party for encryption. This key is pre-agreed upon by the computer device and the access party through offline negotiation or a secure channel before interface connection and is stored on their respective servers. The decryption key stored in the computer device as a configuration table allows the computer device to quickly obtain the corresponding key based on the source identifier when receiving an interface request. Furthermore, the configuration table also stores the encryption algorithm type. The computer device determines the specific algorithm (such as AES or DES) to be used for decryption based on this algorithm type, thereby adapting to the security policy requirements of different access parties.

[0105] S402, decrypt the ciphertext field based on the decryption key to obtain user information and validity period timestamp.

[0106] In the embodiments of the present application, a computer device uses a decryption key and an encryption algorithm type to perform a decryption operation on a ciphertext field, so as to obtain plaintext user information. For example, the computer device uses the AES algorithm and the key JRbsZ5gV2bCbf / fOOx+2a9nlFs7Q07UE to decrypt the ciphertext 6GNY1SOYM+rR4uy / i+tw1gYxn / IBxRO2K9hCsf1l6OHKTTaflpn7imiALQySiC / Zs6hazr+bPkwcE5O7l6xRMrZKKU7AAJaFCyP8lYHJoiuoEuBvbTg2XSg+ / 0AoZjZefZLeUqBELtAonXpDGGXvJaAYhBDBwG+zx8SHh+lp2+A=, and obtains a plaintext string in JSON format: {"identifier":"7202856","valid":1768120402,"user_name":"Jian Chao","mobile":"15760653879","email":"jiangchao@126.com"}. Wherein, identifier is the user identifier to be authenticated, valid is the validity period timestamp, user_name is the user name, mobile is the mobile phone number, and email is the email address.

[0107] It should be noted that the validity period timestamp is set by the access party before encryption, and indicates the valid deadline of this authentication request. For example, when constructing the plaintext, the access party takes the current system timestamp plus a preset valid duration (for example, 3 minutes) as the value of the valid field, that is, valid = current timestamp + 180 seconds. This timestamp mechanism makes each ciphertext valid only for a limited time after generation. Even if the ciphertext is intercepted during transmission, it is difficult for an attacker to use the ciphertext to launch a replay attack outside the validity period.

[0108] S403: Acquire the current time, and compare the current time with the validity period timestamp.

[0109] In the embodiments of the present application, after obtaining the validity period timestamp after decryption, the computer device acquires the current system time of the computer device, and compares the current system time with the validity period timestamp. For example, the computer device acquires the current system timestamp (assuming it is 1768120200), compares it with the decrypted valid value 1768120402, and determines whether the current system time exceeds the validity period timestamp.

[0110] S404 indicates that if the current time has exceeded the expiration timestamp, the connection request has expired and an authentication failure message has been returned; if the current time has not exceeded the expiration timestamp, user matching is performed based on user information to confirm whether the connection request has passed authentication.

[0111] In this embodiment, if the comparison result shows that the current time has exceeded the validity period timestamp, the computer device determines that the connection request has expired, and then returns the authentication failure information indicating the request has expired, without further processing. For example, if the current system timestamp is 1768120500 and the valid value is 1768120402, the current time has exceeded the validity period, and the computer device returns a request expiration message. If the comparison result shows that the current time has not exceeded the validity period timestamp, the computer device performs user matching based on the decrypted user information. Specifically, the computer device precisely matches the decrypted identifier value (i.e., the user identifier to be authenticated) against the user_code field in the user table. If a matching user record is found, the user_name, mobile, and email fields in that user record are updated with the corresponding decrypted values, and the user's status information is obtained for status verification, using the same method as the first-mode link. If no matching user record is found, a new user record is created, the decrypted identifier is written to the user_code field, the decrypted user_name, mobile, and email are written to the corresponding fields, and the user's status is set to normal, confirming that the connection request has passed the authentication of the second-mode link. If the user's status is frozen or logged out, the computer device returns an authentication failure message indicating that the user's status is unavailable. For example, if the status field in the matched user record has a value of 2 (frozen status), the computer device returns a "user status unavailable" message.

[0112] It should be noted that when the computer device determines that the authentication processing link corresponding to the access party is the second mode link, if the obtained connection request also contains parameters unrelated to the second mode link (such as the original identifier field), the computer device will only extract the ciphertext field and will not perform any parsing or processing on the value of the original identifier field.

[0113] In an exemplary embodiment, the authentication processing link corresponding to the access party is a third-mode link, and the "authentication processing of the connection request through the authentication processing link corresponding to the access party" in S203 above, such as Figure 5 As shown, it includes:

[0114] S501: Obtain the original identifier of the access party based on the connection request.

[0115] The original identifier is used to represent the user identity information of the access party.

[0116] In this embodiment, after determining that the authentication processing link corresponding to the access party is a third-mode link, the computer device extracts the original identifier from the connection request. For example, the connection request includes an `originalMarking` field, the value of which is the original identifier, such as `40a8e4ab-b65b-4106-a5a7-0a83c697f67a`. This original identifier is generated by the access party before initiating the connection request; it is a temporary and meaningless random string used to uniquely identify a user to be authenticated within the access party's internal system. After generating this original identifier, the access party associates and stores it with its internal real user information, so that when the access party subsequently receives a query request carrying this original identifier, it can find the corresponding real user information based on the original identifier. Since the original identifier itself does not contain any user personal information, even if the original identifier is intercepted during network transmission, an attacker cannot obtain any user privacy information from it.

[0117] S502: Based on the source identifier, obtain the callback interface address corresponding to the access party, and send a query request to the access party based on the callback interface address.

[0118] The query request includes the original identifier, which is used by the access party for authentication processing.

[0119] In this embodiment, the computer device obtains the callback interface address corresponding to the access party from the interface configuration information based on the source identifier. For example, if the source identifier is T00000201, the computer device queries the passwordless login configuration table based on this source identifier and obtains the corresponding callback interface address as https: / / test-open.gangtise.com.cn / application / user / api / getInfo. This callback interface address is pre-provided by the access party during the configuration phase and points to the interface in the access party's internal system used to verify the original identifier and return user information. After obtaining the callback interface address, the computer device can send a query request to the access party based on this callback interface address. This query request carries the original identifier, which the access party can use for authentication processing. For example, a computer device sends a GET request to https: / / test-open.gangtise.com.cn / application / user / api / getInfo. The request parameters include originalMarking=40a8e4ab-b65b-4106-a5a7-0a83c697f67a, and the request header includes Authorization: Bearer a8b22287-b1bb-4433-a81d-be6529ba2fa6, which allows the access party to confirm whether this callback request was initiated by an authorized system. After receiving the query request, the access party searches for the corresponding user information in its internal system based on the original identifier and verifies the validity of the original identifier (such as whether it has expired or been used). If the verification is successful, it returns an authentication success message; otherwise, it returns an authentication failure message.

[0120] S503, receive the authentication result returned by the access party.

[0121] The authentication result includes either a successful authentication message or an authentication failure message.

[0122] In the embodiments of the present application, the computer device receives a response result of the access party to the query request, and the response result is the authentication result. Meanwhile, the access party returns the authentication result in JSON format, and the computer device distinguishes between authentication success and authentication failure by parsing specific fields in the JSON structure. For example, the JSON structure in the authentication result includes a code field. When the value of the code field is 0, it indicates that the authentication is successful, and the data field carries user information; when the value of the code field is -1, it indicates that the authentication fails, and the msg field carries a description of the failure reason. It should be noted that the user information carried in the authentication success information at least includes a user identifier (identifier field), and may also include a user name (user_name field), a mobile phone number (mobile field), an email address (email field), and the like. For example, when the authentication is successful, it returns {"code":0,"msg":"ok","data":{"identifier":"7202856","user_name":"Jian Chao","mobile":"15760653879","email":"jiangchao@126.com"}}; when the authentication fails, it returns {"code":-1,"msg":"Verification failed"}.

[0123] In S504, when the authentication result is authentication success information, user matching is performed according to the user information carried in the authentication success information, and it is confirmed that the docking request passes the authentication.

[0124] In the embodiments of the present application, if the received authentication result is authentication success information (for example, code=0), the computer device extracts the user information from the authentication success information, and performs a user matching or creation operation according to the user information. Specifically, the computer device precisely matches the identifier value (i.e., the user identifier) in the authentication success information with the user_code field in the user table. If a corresponding user record is matched, the user_name, mobile and email fields in the user record are updated to the corresponding values returned by the access party; if no corresponding user record is matched, a new user record is created, the identifier in the authentication success information is written into the user_code field, and the user_name, mobile and email fields are set to the corresponding returned values. After completing user matching or creation, the computer device also needs to obtain the status information of the user, and perform user status verification in the same manner as the first mode link and the second mode link. If the user status is a normal status, the computer device confirms that the docking request passes the authentication of the third mode link; if the user status is a frozen status or a deactivated status, the computer device returns authentication failure information indicating that the user status is unavailable.

[0125] If the received authentication result is an authentication failure message (e.g., code=-1), the computer device returns the authentication failure message and does not perform user matching or creation operations. For example, the access party returns {"code":-1,"msg":"Verification failed"}, the computer device encapsulates the authentication failure message and returns it to the access party, and the process terminates.

[0126] In summary, based on all the above embodiments, a multi-mode user interface processing method is also provided, such as... Figure 6 As shown, the method includes:

[0127] S601, Obtain the connection request from the access party;

[0128] S602, Based on the source identifier, determine the authentication processing link corresponding to the access party from the pre-configured docking information; the authentication processing link includes a first mode link, a second mode link, and a third mode link; for the first mode link, execute S603-S605; for the second mode link, execute S606-S609; for the third mode link, execute S610-S613.

[0129] S603, retrieve the user whitelist pre-stored by the access party;

[0130] S604: Obtain the second user identifier to be authenticated from the access party according to the connection request, and match it with the first user identifier and the second user identifier in the user whitelist; for connection requests that include encrypted fields and / or original identifiers, execute S614-S616.

[0131] S605: If the first user identifier and the second user identifier match successfully, confirm that the connection request has passed authentication; if the first user identifier and the second user identifier do not match successfully, return authentication failure information.

[0132] S606: Obtain the encrypted field according to the connection request, and obtain the decryption key corresponding to the access party according to the source identifier;

[0133] S607, decrypt the ciphertext field based on the decryption key to obtain user information and validity period timestamp;

[0134] S608, Get the current time and compare it with the expiration timestamp;

[0135] S609: If the current time exceeds the expiration timestamp, the connection request is determined to be expired and an authentication failure message is returned; if the current time has not exceeded the expiration timestamp, user matching is performed based on user information to confirm whether the connection request has passed authentication.

[0136] S610, obtains the original identifier of the access party based on the connection request;

[0137] S611: Based on the source identifier, obtain the callback interface address corresponding to the access party, and send a query request to the access party based on the callback interface address;

[0138] S612, Receive the authentication result returned by the access party;

[0139] S613, if the authentication result is authentication success information, perform user matching based on the user information carried in the authentication success information to confirm that the docking request has passed authentication;

[0140] S614, If the docking request is routed to the first mode link and the docking request also contains a ciphertext field, ignore the ciphertext field;

[0141] S615, if the docking request is routed to the first mode link and the docking request still contains the original identifier, ignore the original identifier;

[0142] S616, when the docking request is routed to the first mode link and the docking request also contains a ciphertext field and the original identifier, the ciphertext field and the original identifier are ignored;

[0143] S617, the connection request is authenticated through the authentication processing link corresponding to the access party;

[0144] S618, Obtain user information obtained after authentication through the authentication processing link;

[0145] S619 generates an access token based on user information and a preset access token structure, and then sends the access token to the access party.

[0146] The methods described in each of the above steps have been described in the foregoing embodiments. For details, please refer to the foregoing descriptions. They will not be repeated here.

[0147] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0148] Based on the same inventive concept, this application also provides a multi-mode user interface processing apparatus for implementing the multi-mode user interface processing method described above. The solution provided by this apparatus is similar to the implementation scheme described in the above method; therefore, the specific limitations in one or more embodiments of the multi-mode user interface processing apparatus provided below can be found in the limitations of the multi-mode user interface processing method described above, and will not be repeated here.

[0149] In one exemplary embodiment, such as Figure 7 As shown, a multi-mode user interface processing device is provided, including:

[0150] The acquisition module 11 is used to acquire the connection request from the access party; the connection request includes the source identifier;

[0151] The routing module 12 is used to determine the authentication processing link corresponding to the access party from the pre-configured docking information based on the source identifier. The authentication processing link includes a first mode link, a second mode link, and a third mode link. The first mode link is used to perform authentication based on a pre-stored user whitelist. The second mode link is used to perform authentication based on the user credentials transmitted in encrypted form. The third mode link is used to perform authentication based on the authentication result returned by the callback interface of a third party.

[0152] Authentication module 13 is used to authenticate the connection request through the authentication processing link corresponding to the access party;

[0153] The distribution module 14 is used to generate and distribute access tokens after the connection request is authenticated.

[0154] In one embodiment, the routing module 12 includes a first link unit, which specifically includes:

[0155] The storage subunit is used to obtain the user whitelist pre-stored by the access party; the user whitelist includes at least one authenticated first user identifier.

[0156] The matching subunit is used to obtain the second user identifier to be authenticated from the access party according to the connection request, and to match it based on the first user identifier and the second user identifier in the user whitelist;

[0157] The first confirmation subunit is used to confirm that the docking request has passed authentication if the first user identifier and the second user identifier match successfully; and to return authentication failure information if the first user identifier and the second user identifier do not match successfully.

[0158] In one embodiment, the routing module 12 includes a second link unit, which specifically includes:

[0159] The corresponding subunit is used to obtain the encrypted field according to the docking request, and to obtain the decryption key corresponding to the access party according to the source identifier;

[0160] The decryption subunit is used to decrypt the ciphertext field based on the decryption key to obtain user information and validity period timestamp;

[0161] The comparison sub-unit is used to obtain the current time and compare it with the expiration timestamp;

[0162] The second confirmation subunit is used to determine that the connection request has expired if the current time exceeds the expiration timestamp and to return an authentication failure message; if the current time has not exceeded the expiration timestamp, it performs user matching based on user information and confirms whether the connection request has passed authentication.

[0163] In one embodiment, the routing module 12 includes a third link unit, which specifically includes:

[0164] The original subunit is used to obtain the original identifier of the access party based on the connection request; the original identifier is used to represent the user identity information of the access party.

[0165] The callback subunit is used to obtain the callback interface address corresponding to the access party based on the source identifier, and send a query request to the access party based on the callback interface address; the query request includes the original identifier, and the query request is used by the access party to perform authentication processing based on the original identifier;

[0166] The receiving subunit is used to receive the authentication result returned by the access party; the authentication result includes authentication success information or authentication failure information.

[0167] The third confirmation subunit is used to perform user matching based on the user information carried in the authentication success information when the authentication result is authentication success information, and to confirm that the docking request has passed authentication.

[0168] In one embodiment, the aforementioned sending module 14 includes:

[0169] The first issuing unit is used to obtain user information obtained after authentication through the authentication processing link; the user information includes user identifier, user name and tenant identifier;

[0170] The second distribution unit is used to generate an access token based on user information and a preset access token structure, and then distribute the access token to the access party; the access token includes at least a user identifier, a tenant identifier, and the validity period of the access token.

[0171] In one embodiment, the first link unit further includes:

[0172] The first ignore subunit is used to ignore the ciphertext field when the docking request is routed to the first mode link and the docking request also contains the ciphertext field.

[0173] The second ignore subunit is used to ignore the original identifier when the docking request is routed to the first mode link and the docking request still contains the original identifier;

[0174] The third ignore subunit is used to ignore the ciphertext field and the original identifier when the docking request is routed to the first mode link and the docking request also contains the ciphertext field and the original identifier.

[0175] Each module in the aforementioned multi-mode user interface processing device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of a computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0176] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0177] Obtain the connection request from the access party; the connection request includes the source identifier;

[0178] Based on the source identifier, the authentication processing link corresponding to the access party is determined from the pre-configured docking information; the authentication processing link includes a first mode link, a second mode link, and a third mode link; the first mode link is used for authentication based on a pre-stored user whitelist; the second mode link is used for authentication based on the encrypted user credentials; and the third mode link is used for authentication based on the authentication result returned by the third party's callback interface.

[0179] The connection request is authenticated and processed through the authentication processing link corresponding to the access party;

[0180] After the connection request is authenticated, an access token is generated and issued.

[0181] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0182] Obtain the user whitelist pre-stored by the access party; the user whitelist must include at least one authenticated first user identifier;

[0183] The system obtains the second user identifier to be authenticated from the access party based on the connection request, and matches it with the first user identifier and the second user identifier in the user whitelist.

[0184] If the first user identifier and the second user identifier match successfully, the connection request is confirmed to have passed authentication; if the first user identifier and the second user identifier do not match successfully, an authentication failure message is returned.

[0185] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0186] Obtain the encrypted field based on the connection request, and obtain the decryption key corresponding to the access party based on the source identifier;

[0187] The encrypted fields are decrypted using the decryption key to obtain user information and validity period timestamp;

[0188] Get the current time and compare it with the expiration timestamp;

[0189] If the current time exceeds the expiration timestamp, the connection request is deemed expired, and an authentication failure message is returned; if the current time has not exceeded the expiration timestamp, user matching is performed based on user information to confirm whether the connection request has passed authentication.

[0190] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0191] Obtain the original identifier of the access party based on the connection request; the original identifier is used to identify the user identity information of the access party;

[0192] Based on the source identifier, obtain the callback interface address corresponding to the access party, and send a query request to the access party based on the callback interface address; the query request includes the original identifier, and the query request is used by the access party to perform authentication processing based on the original identifier;

[0193] Receive the authentication result returned by the access party; the authentication result includes authentication success information or authentication failure information;

[0194] If the authentication result is successful, user matching is performed based on the user information carried in the successful authentication message to confirm that the connection request has passed authentication.

[0195] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0196] Obtain user information obtained after authentication through the authentication processing link; user information includes user identifier, user name, and tenant identifier;

[0197] Based on user information and a preset access token structure, an access token is generated and distributed to the access party; the access token includes at least the user identifier, the tenant identifier, and the validity period of the access token.

[0198] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0199] If the connection request is routed to the first-mode link and the connection request also contains a ciphertext field, the ciphertext field is ignored;

[0200] If the docking request is routed to the first-mode link and the docking request still contains the original identifier, ignore the original identifier;

[0201] If the docking request is routed to the first-mode link and the docking request also contains a ciphertext field and the original identifier, the ciphertext field and the original identifier are ignored.

[0202] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0203] Obtain the connection request from the access party; the connection request includes the source identifier;

[0204] Based on the source identifier, the authentication processing link corresponding to the access party is determined from the pre-configured docking information; the authentication processing link includes a first mode link, a second mode link, and a third mode link; the first mode link is used for authentication based on a pre-stored user whitelist; the second mode link is used for authentication based on the encrypted user credentials; and the third mode link is used for authentication based on the authentication result returned by the third party's callback interface.

[0205] The connection request is authenticated and processed through the authentication processing link corresponding to the access party;

[0206] After the connection request is authenticated, an access token is generated and issued.

[0207] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0208] Obtain the user whitelist pre-stored by the access party; the user whitelist must include at least one authenticated first user identifier;

[0209] The system obtains the second user identifier to be authenticated from the access party based on the connection request, and matches it with the first user identifier and the second user identifier in the user whitelist.

[0210] If the first user identifier and the second user identifier match successfully, the connection request is confirmed to have passed authentication; if the first user identifier and the second user identifier do not match successfully, an authentication failure message is returned.

[0211] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0212] Obtain the encrypted field based on the connection request, and obtain the decryption key corresponding to the access party based on the source identifier;

[0213] The encrypted fields are decrypted using the decryption key to obtain user information and validity period timestamp;

[0214] Get the current time and compare it with the expiration timestamp;

[0215] If the current time exceeds the expiration timestamp, the connection request is deemed expired, and an authentication failure message is returned; if the current time has not exceeded the expiration timestamp, user matching is performed based on user information to confirm whether the connection request has passed authentication.

[0216] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0217] Obtain the original identifier of the access party based on the connection request; the original identifier is used to identify the user identity information of the access party;

[0218] Based on the source identifier, obtain the callback interface address corresponding to the access party, and send a query request to the access party based on the callback interface address; the query request includes the original identifier, and the query request is used by the access party to perform authentication processing based on the original identifier;

[0219] Receive the authentication result returned by the access party; the authentication result includes authentication success information or authentication failure information;

[0220] If the authentication result is successful, user matching is performed based on the user information carried in the successful authentication message to confirm that the connection request has passed authentication.

[0221] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0222] Obtain user information obtained after authentication through the authentication processing link; user information includes user identifier, user name, and tenant identifier;

[0223] Based on user information and a preset access token structure, an access token is generated and distributed to the access party; the access token includes at least the user identifier, the tenant identifier, and the validity period of the access token.

[0224] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0225] If the connection request is routed to the first-mode link and the connection request also contains a ciphertext field, the ciphertext field is ignored;

[0226] If the docking request is routed to the first-mode link and the docking request still contains the original identifier, ignore the original identifier;

[0227] If the docking request is routed to the first-mode link and the docking request also contains a ciphertext field and the original identifier, the ciphertext field and the original identifier are ignored.

[0228] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, performs the following steps:

[0229] Obtain the connection request from the access party; the connection request includes the source identifier;

[0230] Based on the source identifier, the authentication processing link corresponding to the access party is determined from the pre-configured docking information; the authentication processing link includes a first mode link, a second mode link, and a third mode link; the first mode link is used for authentication based on a pre-stored user whitelist; the second mode link is used for authentication based on the encrypted user credentials; and the third mode link is used for authentication based on the authentication result returned by the third party's callback interface.

[0231] The connection request is authenticated and processed through the authentication processing link corresponding to the access party;

[0232] After the connection request is authenticated, an access token is generated and issued.

[0233] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0234] Obtain the user whitelist pre-stored by the access party; the user whitelist must include at least one authenticated first user identifier;

[0235] The system obtains the second user identifier to be authenticated from the access party based on the connection request, and matches it with the first user identifier and the second user identifier in the user whitelist.

[0236] If the first user identifier and the second user identifier match successfully, the connection request is confirmed to have passed authentication; if the first user identifier and the second user identifier do not match successfully, an authentication failure message is returned.

[0237] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0238] Obtain the encrypted field based on the connection request, and obtain the decryption key corresponding to the access party based on the source identifier;

[0239] The encrypted fields are decrypted using the decryption key to obtain user information and validity period timestamp;

[0240] Get the current time and compare it with the expiration timestamp;

[0241] If the current time exceeds the expiration timestamp, the connection request is deemed expired, and an authentication failure message is returned; if the current time has not exceeded the expiration timestamp, user matching is performed based on user information to confirm whether the connection request has passed authentication.

[0242] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0243] Obtain the original identifier of the access party based on the connection request; the original identifier is used to identify the user identity information of the access party;

[0244] Based on the source identifier, obtain the callback interface address corresponding to the access party, and send a query request to the access party based on the callback interface address; the query request includes the original identifier, and the query request is used by the access party to perform authentication processing based on the original identifier;

[0245] Receive the authentication result returned by the access party; the authentication result includes authentication success information or authentication failure information;

[0246] If the authentication result is successful, user matching is performed based on the user information carried in the successful authentication message to confirm that the connection request has passed authentication.

[0247] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0248] Obtain user information obtained after authentication through the authentication processing link; user information includes user identifier, user name, and tenant identifier;

[0249] Based on user information and a preset access token structure, an access token is generated and distributed to the access party; the access token includes at least the user identifier, the tenant identifier, and the validity period of the access token.

[0250] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0251] If the connection request is routed to the first-mode link and the connection request also contains a ciphertext field, the ciphertext field is ignored;

[0252] If the docking request is routed to the first-mode link and the docking request still contains the original identifier, ignore the original identifier;

[0253] If the docking request is routed to the first-mode link and the docking request also contains a ciphertext field and the original identifier, the ciphertext field and the original identifier are ignored.

[0254] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0255] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0256] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A multi-mode user interface processing method, characterized in that, The method includes: Obtain the connection request from the access party; the connection request includes a source identifier; Based on the source identifier, the authentication processing link corresponding to the access party is determined from the pre-configured docking information; the authentication processing link includes a first mode link, a second mode link, and a third mode link; the first mode link is used for authentication based on a pre-stored user whitelist; the second mode link is used for authentication based on the encrypted user credentials; the third mode link is used for authentication based on the authentication result returned by the callback interface of a third party; The connection request is authenticated through the authentication processing link corresponding to the access party; After the connection request is authenticated, an access token is generated and issued.

2. The method according to claim 1, characterized in that, The authentication processing link corresponding to the access party is the first mode link. The authentication processing of the connection request through the authentication processing link corresponding to the access party includes: Obtain the user whitelist pre-stored by the access party; the user whitelist includes at least one authenticated first user identifier; The second user identifier to be authenticated from the access party is obtained according to the connection request, and a match is made between the first user identifier and the second user identifier in the user whitelist. If the first user identifier and the second user identifier match successfully, the connection request is confirmed to have passed authentication; if the first user identifier and the second user identifier do not match successfully, an authentication failure message is returned.

3. The method according to claim 1, characterized in that, The authentication processing link corresponding to the access party is the second mode link. The authentication processing of the connection request through the authentication processing link corresponding to the access party includes: The encrypted field is obtained according to the connection request, and the decryption key corresponding to the access party is obtained according to the source identifier; The encrypted field is decrypted based on the decryption key to obtain user information and validity period timestamp; Obtain the current time and compare it with the expiration timestamp; If the current time exceeds the validity period timestamp, the connection request is determined to have expired, and an authentication failure message is returned; if the current time does not exceed the validity period timestamp, user matching is performed based on the user information to confirm whether the connection request has passed authentication.

4. The method according to claim 1, characterized in that, The authentication processing link corresponding to the access party is the third mode link. The authentication processing of the connection request through the authentication processing link corresponding to the access party includes: The original identifier of the access party is obtained according to the connection request; the original identifier is used to represent the user identity information of the access party; Based on the source identifier, obtain the callback interface address corresponding to the access party, and send a query request to the access party based on the callback interface address; the query request includes the original identifier, and the query request is used by the access party to perform authentication processing based on the original identifier; Receive the authentication result returned by the access party; the authentication result includes authentication success information or authentication failure information; If the authentication result is the authentication success information, user matching is performed based on the user information carried in the authentication success information to confirm that the docking request has passed authentication.

5. The method according to claim 1, characterized in that, The step of generating and issuing an access token after the connection request has been authenticated through the authentication processing link includes: Obtain user information obtained after authentication through the authentication processing link; the user information includes user identifier, user name, and tenant identifier; Based on the user information and the preset access token structure, the access token is generated and sent to the access party; the access token includes at least the user identifier, the tenant identifier, and the validity period of the access token.

6. The method according to claim 1, characterized in that, The method further includes: If the connection request is routed to the first mode link and the connection request also contains a ciphertext field, the ciphertext field is ignored; If the docking request is routed to the first mode link and the docking request also contains the original identifier, the original identifier is ignored; If the docking request is routed to the first mode link and the docking request also contains a ciphertext field and the original identifier, the ciphertext field and the original identifier are ignored.

7. A multi-mode user interface processing device, characterized in that, The device includes: The acquisition module is used to acquire the connection request from the access party; the connection request includes a source identifier; The routing module is used to determine the authentication processing link corresponding to the access party from pre-configured connection information based on the source identifier; the authentication processing link includes a first mode link, a second mode link, and a third mode link; the first mode link is used to perform authentication based on a pre-stored user whitelist; the second mode link is used to perform authentication based on user credentials transmitted in encrypted form; and the third mode link is used to perform authentication based on the authentication result returned by a callback interface from a third party. The authentication module is used to authenticate the connection request through the authentication processing link corresponding to the access party; The distribution module is used to generate and distribute an access token after the connection request is authenticated.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images