CN103684770A - Digital certificate authentication based service system agent access method and device - Google Patents

Abstract

The invention discloses a business system proxy access method and device based on digital certificate authentication. The method includes: performing digital certificate authentication on the user, and obtaining identification information identifying the user if the authentication is passed; querying the accessible service system information corresponding to the user identification information in a pre-configured database; the database It is used to save the corresponding relationship between the user's identification information and the business system accessible to the user; to publish the services of the business system accessible to the user according to the user identification; to display the corresponding information corresponding to the user's identification information in a proxy manner. Accessible business system information; receiving any business system access request triggered by the user according to the proxied business system information, and realizing proxy-based access to any business system. The present invention can achieve access to a business system that does not support digital certificate authentication technology without any modification to the business system, and only needs to use digital certificate proxy authentication and business system proxy access technology to achieve the business system's ability to authenticate users with digital certificates The purpose is to finally realize the user's access to the business system.

Description

A business system proxy access method and device based on digital certificate authentication

technical field

The present invention relates to the technical field of information security, in particular to a business system proxy access method and device based on digital certificate authentication.

Background technique

Information security means that the hardware, software and data in the information network are protected from being damaged, changed, or leaked due to accidental or malicious reasons, the system runs continuously and reliably, and the information service is not interrupted. Digital certificate authentication technology is a solution produced in the process of confirming the identity of the operator in the computer network, and it is an effective method to ensure information security. The business system access based on digital certificate authentication technology makes the user's access to the business system more secure.

Currently, in the prior art, digital certificate technology is widely used as a high-strength identity authentication technology. However, since the business system itself does not have an interface implementation function corresponding to the API interface provided by the digital certificate system, when it is necessary to use digital certificate technology for identity authentication to access the business system, it is often necessary to use the API interface provided by the digital certificate system to The business system itself is transformed. Especially when accessing the business system from the construction period to the operation period, when it is temporarily necessary to enable digital certificate technology during identity authentication, it no longer has the corresponding development capabilities.

It can be seen that when the existing technology realizes access to business systems based on digital certificate authentication, it is difficult to implement the use of digital certificate technology, and the threshold for use is too high. Even for a business system with development capabilities, it takes a long time to develop the interface of the business system, which makes the combination of the business system and the digital certificate system realize the long access cycle of business system access based on digital certificate authentication. It is difficult to guarantee the timeliness of business use, which limits the application of digital certificate authentication technology in realizing access to business systems based on digital certificate authentication to a certain extent.

Contents of the invention

In order to solve the above problems, the present invention provides a business system proxy access method and device based on digital certificate authentication, so that when accessing a business system that does not support digital certificate authentication technology, there is no need to make any changes to the business system. Certificate authentication and business system proxy technology can realize business system proxy access based on digital certificate authentication.

In order to achieve the purpose of the present invention, the present invention provides a business system proxy access method based on digital certificate authentication, the method comprising:

Perform digital certificate authentication on the user, and obtain the user's identification information if the authentication is passed;

In the pre-configured database, query the accessible service system corresponding to the user's identification information;

The database is used to store the correspondence between the user's identification information and the business systems accessible to the user;

Proxy the business system accessible to the user;

Displaying the business systems accessible to the user in a proxy manner;

An access request of any business system triggered by the user according to the displayed business systems accessible to the user is received, and access to the any business system is realized.

Preferably, performing digital certificate authentication on the user to obtain identification information identifying the user, specifically,

Verify the user's digital certificate signed by the certificate certification authority to obtain the user's identification information.

Preferably, querying the accessible service system corresponding to the user's identification information includes:

Encrypt and transmit the user's identification information to the pre-configured database;

In the pre-configured database, the accessible service system corresponding to the user's identification information is queried.

Preferably, the encrypted transmission of the user's identification information to a preset database is specifically:

The user's identification information is encrypted and transmitted to the preset database through secure socket layer SSL or transport layer security TLS encryption.

Preferably, before querying the accessible business system corresponding to the user's identification information in the pre-configured database, the query further includes:

Save the user's identification information and the business systems accessible to the user into the database.

Preferably, the displaying the business system accessible to the user in a proxy mode is:

The user-accessible business systems are displayed through a user-defined interface in a proxy manner.

Also provided is a business system proxy access device based on digital certificate authentication, said device comprising:

The identity authentication module is used for digital certificate authentication to the user, and if passed, enters the identification acquisition module;

An identification obtaining module, configured to obtain identification information identifying the user;

The first information query module is used to query the accessible service system corresponding to the identification information of the user in the pre-configured database;

The database is used to store the correspondence between the user's identification information and the business systems accessible to the user;

an agent module, configured to act as an agent for the service system accessible to the user;

An information display module, configured to display the business systems accessible to the user in a proxy manner;

The service access module is configured to receive an access request of any service system triggered by the user according to the displayed service systems accessible to the user, so as to realize access to any service system.

Preferably, the first information query module includes:

The database configuration module is used to save the user's identification information and its accessible business systems into the database;

The second information query module is configured to query the database for accessible service systems corresponding to the user's identification information.

Preferably, the second information query module includes:

The information encryption module is used to encrypt and transmit the user's identification information to a pre-configured database;

The third information query module is configured to query the accessible service system corresponding to the user's identification information in the pre-configured database.

Preferably, the information display module includes:

Interface customization module, used for user-defined interface;

The information display sub-module is used to display and display the service systems accessible to the user through the interface defined by the interface customization module in a proxy manner.

Compared with the prior art, the beneficial effects of the present invention are as follows:

In the present invention, the computer system authenticates the user with a digital certificate, which can ensure the security of the user's access to the business application system. If the user passes the digital certificate authentication performed by the computer system, that is, the user is a safe user, the computer system obtains User identification information used to uniquely identify a user. At the same time, the computer system pre-configures a database for saving the corresponding relationship between user identification information and its accessible business system resources, and searches the corresponding user-accessible business system information in the pre-configured database according to the user identification information, It also acts as a proxy for the business systems that users can access, and then displays the business system information accessible to users in a proxy manner, and the user realizes proxy access to the business system by triggering any business system. The embodiment of the present invention does not carry out any transformation on the business system, and for the business system, there is no need to support the application of the digital certificate authentication system in particular, but the user accesses the business system agent to indirectly realize the authentication based on the digital certificate. Security-authenticated business system access, . With the help of this innovative technology, when users access business application systems that do not support digital certificate authentication technology, they can realize proxy access to business systems based on digital certificate authentication without any modification, and finally achieve the purpose of accessing business systems. It enables various business systems to enjoy various security services provided by the digital certificate authentication system, and greatly improves the promotion of using digital certificate authentication technology to access business systems.

Furthermore, when querying the accessible business system information corresponding to the user identification information, the user identification information is transmitted to the pre-configured database, which can be in encrypted form, which can ensure that no security issues will occur during the transmission of information, and further ensure that users Secure access to business systems.

Furthermore, the business system services represented by the accessible proxy device corresponding to the user identification information are displayed through the user-defined interface, so that it can only display resources accessible to trusted users, which reduces the investment of the gateway and improves security and visibility.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only These are some embodiments described in this application. Those skilled in the art can also obtain other drawings based on these drawings without creative work.

Fig. 1 is a flow chart of a business system proxy access method based on digital certificate authentication according to an embodiment of the present invention;

Fig. 2 is the flowchart of the business system proxy access method based on digital certificate authentication according to Embodiment 2 of the present invention;

3 is a structural diagram of a business system proxy access device based on digital certificate authentication according to Embodiment 3 of the present invention;

4 is a structural diagram of the first information query module of the business system proxy access device based on digital certificate authentication according to Embodiment 3 of the present invention;

5 is a structural diagram of the second information query module of the business system proxy access device based on digital certificate authentication according to Embodiment 3 of the present invention;

FIG. 6 is a structural diagram of an information display module of a business system proxy access device based on digital certificate authentication according to Embodiment 3 of the present invention.

Detailed ways

In order to solve the above problems, an embodiment of the present invention provides a digital certificate authentication-based proxy access method for a business system, which will be described in detail below with reference to the accompanying drawings.

Embodiment one,

Referring to Fig. 1, Fig. 1 is a flow chart of a business system proxy access method based on digital certificate authentication in Embodiment 1 of the present invention. This embodiment may specifically include:

Step 101, carry out digital certificate authentication to the user, if pass authentication, then enter step 102;

Step 102, obtaining user identification information.

In this embodiment, the user realizes access to the business system by accessing the business system proxy device. Before the user accesses the business system proxy device, the computer system implementing the present invention needs to perform identity authentication based on digital certificate technology for the current access user, thereby Determine whether the current user is a safe user. If the user is a safe user, that is, the user has passed the identity authentication of the computer system, the computer system will obtain the user's identification information, which is used to uniquely identify the user, so that in the subsequent steps, the computer system Use of the user's identity.

If the user has not passed the digital certificate verification of the computer system, that is, the user is an insecure user, the computer system cannot obtain the identification information used to uniquely identify the user, and thus cannot perform the following operations.

After each user obtains the digital certificate issued by the certificate certification authority, he obtains the user identification information used to uniquely identify the user. The user passes the identity authentication of the computer system by using his own identification information, which proves that the user is a computer system. A security user of the system.

In this embodiment, the identification information obtained by the computer system to identify the user may be the user's digital certificate key, or other forms of identification information. The specific implementation is therefore not limited in the present invention, and other forms of authentication information also belong to the scope of protection of the present invention.

Step 103, query the accessible service system corresponding to the user's identification information in the pre-configured database.

After the computer system receives the user's identification information, if the user has passed the identity security verification based on the digital certificate technology performed by the computer system, that is, the user currently accessing the business system is a secure user, the computer system will be in the pre-generated In the database, the accessible service system information corresponding to the user identification information is queried according to the user identification information currently accessing the service system.

In practical applications, the security users allowed to access each business system can be preset and stored in a pre-configured database for query, that is, the database stores user identification information, accessible business system agents, and the relationship between the two Correspondence between. This database only needs to be pregenerated before this step.

Step 104, proxying the service systems accessible to the user.

After finding the corresponding accessible service system according to the identification information of the user, the service system is represented by the agent device.

The proxy device may receive a signal for connecting to the business system, and communicate the signal to the business system, and at the same time realize the proxy for the business system.

Step 105, displaying the service systems accessible to the user in a proxy manner.

The computer system queries the database according to the user's identification information, and obtains the information of the accessible business system corresponding to the user's identification information. In order to enable the current user to choose to access one or several business systems through the proxy device, the proxy device needs to use the proxy method Show the user the business systems that the user has access to.

Specifically, the computer system may display the user-accessible business system information to the user through a user-defined interface. When the user customizes the display interface, it can be set according to the actual needs or the actual conditions of the interface display, such as only displaying the business system information represented by the agent device to trusted users, or displaying it in a list, etc.

Step 106: Receive an access request of any business system triggered by the user according to the displayed business systems accessible to the user, and implement access to the any business system.

The computer system displays the information of the business system accessible to the user who is currently accessing the business system agent device, and the user can trigger an accessible business system according to his own needs, and the computer system will realize the business system triggered by the user proxy-based access.

Specifically, there are two access modes for a user to access the service system agent device, namely, a page access mode and a client access mode.

When the user uses a standard web browser to access the business system proxy device in the form of page access, the user does not need to install any plug-ins and controls, and directly accesses the internal network.

When the user accesses the business system proxy device in the client access mode, the user initiates a TCP application in the java or activeX control mode, and there is no need to establish a three-layer tunnel. In this embodiment, the computer system receives the user identification information and performs security verification on the user identification information, which can ensure the security of the user's access to the business application system. At the same time, a database for storing the correspondence between user identification information and its accessible business system resources is preset, and the corresponding accessible business system information is queried and displayed in the database according to the user identification information, and the accessible business system resources are checked and displayed. The system acts as a proxy, and by triggering any business system, the proxy-based access to the business system is realized. This embodiment enables users to access business application systems that do not support identity authentication technology without any modification. Through digital certificate authentication and business system proxy access technology, users can access business systems based on digital certificate authentication. Such business systems can enjoy all kinds of security services provided by the identity authentication system, and the promotion of using digital certificate authentication technology to access business systems has been greatly improved.

Since in this embodiment, when the user identification information is transmitted to the server for database query, the data security is threatened, so the encrypted transmission of the user authentication information is carried out through the secure encrypted transmission method of the second embodiment, which can ensure that the user's data Transport security.

Embodiment two,

Referring to FIG. 2, FIG. 2 is a flowchart of a method for proxy accessing a service system based on digital certificate authentication in Embodiment 2 of the present invention. This embodiment may specifically include:

Step 201, pre-configuring a database for saving the correspondence between user identification information and service systems accessible to them.

The computer system can pre-set security users who are allowed to access each business system, and the computer system saves the user identification information of the security users and the business system information they can access to a pre-configured database for query, which stores the user identification information , accessible business system information and the correspondence between the two. This database configuration process is a pre-completed part of this embodiment.

Step 202, carry out digital certificate authentication to the user, if pass the authentication, then enter step 203;

Step 203 , obtain the identification information of the user, and proceed to step 204 .

In this embodiment, the user accesses the business system by accessing the business system proxy device. Before the user accesses the business system proxy device, the computer system needs to verify whether the user is a safe user through a digital certificate. If the verification is passed, the user If it is a secure user, the computer system obtains the user identification information corresponding to the user, so that in the subsequent steps, the computer system can use the user identification information.

After each user obtains the digital certificate issued by the certificate certification authority, he obtains the user identification information used to uniquely identify the user. The user passes the identity authentication of the computer system by using his own identification information, which proves that the user is a computer system. A security user of the system.

If the computer system does not obtain the user's user identification information when the computer system authenticates the user with a digital certificate, it means that the user has not obtained the digital certificate issued by the certificate certification authority in advance, and the user is not a safe user, that is, the user does not have Identity authentication through the digital certificate authentication system.

Step 204, transmit the user identification information to the database through secure socket layer SSL or transport layer security TLS encryption.

Before the user identification information is transmitted to the database that stores the aforementioned user identification information, accessible business system information and the correspondence between the two for query, the computer system encrypts the user identification information and the transmission channel through SSL or TLS , and transmit the encrypted user identification information to the database for querying the accessible business system information in the database.

The way the computer system encrypts the user identification information and the transmission channel can use the standard SSL protocol to establish a secure channel to ensure that the user identification information is safely transmitted to the database.

Step 205, query the accessible business system information corresponding to the user identification information in the pre-configured database.

First, the computer system authenticates the user based on a digital certificate. If the user passes the identity security verification performed by the computer system, that is, the user currently accessing the business system is a secure user, the computer system obtains a unique ID for the user. User ID information that identifies this user. Then, the computer system transmits the user's identification information to a database for saving the user's identification information, accessible business system information and the correspondence between the two through secure encrypted transmission. Thirdly, the computer system safely decrypts the encrypted identification information sent to the database. Finally, the computer system queries the user's corresponding accessible service system information in the pre-configured database according to the currently decrypted user identification information.

Step 206 , display the accessible service system corresponding to the user identification information through the user-defined interface and proxy it.

The computer system queries the database according to the user identification information used to uniquely identify the user, and obtains the information of the accessible business systems corresponding to the user identification information. In order to enable the current user to select and access the accessible business systems, the computer system The information of the business systems accessible to the user is displayed to the user. According to the different needs of the user, a display interface suitable for the user's needs can be customized, such as opening certain business system resources only to trusted users.

Since the digital certificate authentication system cannot directly communicate with the business system, the business system must act as an agent for it through a proxy device, and the user accesses the proxy device to finally achieve the purpose of accessing the business system.

Step 207: Receive an access request of any service system triggered by the user according to the accessible service system information, and implement access to the any service system.

The computer system displays to the user who currently wants to access the proxy device the information of the proxied business system that the user can access, and the user can trigger an accessible business system according to his own needs, and at the same time, the computer system will realize the business system triggered by the user system access.

In this embodiment, except that when the user can access the business application system that does not support the identity authentication technology, no modification is required, only through the digital certificate proxy authentication and the business system proxy access technology, the user can realize the user's access to the business application system based on the digital certificate. In addition to the effect of authenticated business system access, the encrypted transmission of user authentication information by means of secure encrypted transmission further reduces the threat of data security when user identification information is transmitted to the database for query.

An embodiment of the present invention provides a device for proxy accessing a service system based on digital certificate authentication, which will be described in detail below with reference to the accompanying drawings.

Embodiment three,

Referring to FIG. 3 , it provides a schematic structural diagram of a digital certificate authentication-based business system proxy access device for an embodiment of the present invention. This embodiment may specifically include:

The identity authentication module 301 is used to carry out digital certificate authentication to the user, and if it passes, then enters the identification obtaining module;

An identification obtaining module 302, configured to obtain identification information identifying the user;

The first information query module 303 is configured to query the accessible service system corresponding to the user's identification information in a pre-configured database;

With reference to Fig. 4, described first information inquiry module 303 comprises:

The database configuration module 401 is used to save the user's identification information and its accessible business systems into the database;

The second information query module 402 is configured to query the database for accessible service systems corresponding to the user's identification information.

Referring to FIG. 5, the second information query module 402 includes:

An information encryption module 501, configured to encrypt and transmit the user's identification information to a pre-configured database;

The third information query module 502 is configured to query the accessible service system corresponding to the user's identification information in the pre-configured database.

The database is used to store the correspondence between the user's identification information and the business systems accessible to the user;

A proxy module 304, configured to proxy the service systems accessible to the user;

An information display module 305, configured to display the business systems accessible to the user in a proxy manner; refer to

Referring to Figure 6, the information display module 305 includes:

Interface customization module 601, used for user-defined interface;

The information display sub-module 602 is configured to display the service systems accessible to the user through the interface defined by the interface customization module in a proxy manner.

The service access module 306 is configured to receive an access request of any service system triggered by the user according to the displayed service systems accessible to the user, and implement access to any service system.

In this embodiment, after the user passes the digital certificate security authentication, the computer system obtains the user identification information used to uniquely identify the user, and at the same time, the corresponding relationship between the user identification information and the accessible business system resources is pre-configured The database queries and displays the corresponding accessible business system information in the database according to the user authentication information, and realizes the access to the business system by triggering any business system. This embodiment ensures the security of the user's access to the business application system, and at the same time enables the user to access the business application system that does not support identity authentication technology without any modification, only through digital certificate proxy authentication and business system proxy access technology , the access to the business system based on the security authentication of the user's digital certificate can be realized.

It should be noted that in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is a relationship between these entities or operations. There is no such actual relationship or order between them. Furthermore, the term "comprises", "comprises" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article or apparatus comprising a set of elements includes not only those elements, but also includes elements not expressly listed. other elements of or also include elements inherent in such a process, method, article, or device. Without further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article or apparatus comprising said element.

The method and device for proxy access to business systems based on digital certificate authentication provided by the embodiments of the present invention are described above in detail. In this paper, specific examples are used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only used To help understand the method of the present invention and its core idea; at the same time, for those of ordinary skill in the art, according to the idea of the present invention, there will be changes in the specific implementation and scope of application. In summary, this specification The content should not be construed as a limitation of the invention.

Claims (10)

1. the operation system proxy access method based on digital certificate authentication, is characterized in that, described method comprises:

User is carried out to digital certificate authentication, if by authentication, obtain user's identification information;

In pre-configured database, inquire about described user's addressable operation system corresponding to identification information;

Described database is for preserving the corresponding relation between user's identification information and the operation system of this user-accessible;

Operation system to described user-accessible is acted on behalf of;

The operation system that shows described user-accessible with agent way;

Receive user according to the access request of arbitrary operation system of the operation system triggering of described shown user-accessible, realize the access to this arbitrary operation system.

2. method according to claim 1, is characterized in that, described user is carried out to digital certificate authentication, obtains the identification information of identifying user, be specially,

The customer digital certificate of Dui Bei certificate verification mechanism signature is verified, obtains user's identification information.

3. method according to claim 2, is characterized in that, the addressable operation system corresponding to identification information of inquiring about described user comprises:

User's identification information is encrypted and is sent to pre-configured database;

In described pre-configured database, the addressable operation system that the identification information of inquiring user is corresponding.

4. method according to claim 3, is characterized in that, the described identification information by user is encrypted and is sent to the database setting in advance, and is specially:

By SSL SSL or Transport Layer Security TLS, encrypt user's identification information is encrypted and is sent to the database setting in advance.

5. method according to claim 4, is characterized in that, described in pre-configured database, and the addressable operation system corresponding to identification information of inquiring about described user also comprises before:

The operation system of user's identification information and this user-accessible is saved in database.

6. method according to claim 5, is characterized in that, described take operation system that agent way shows described user-accessible as:

With agent way by the operation system of user-accessible described in user-defined interface display.

7. the operation system proxy access device based on digital certificate authentication, is characterized in that, described device comprises:

Authentication module, for user is carried out to digital certificate authentication, if pass through, enters sign and obtains module;

Sign obtains module, for obtaining the identification information of identifying user;

First information enquiry module, for the database pre-configured, inquires about described user's addressable operation system corresponding to identification information;

Described database is for preserving the corresponding relation between user's identification information and the operation system of this user-accessible;

Proxy module, acts on behalf of for the operation system to described user-accessible;

Information display module, for showing the operation system of described user-accessible with agent way;

Operational Visit module, for receiving user according to the access request of arbitrary operation system of the operation system triggering of described shown user-accessible, realizes the access to arbitrary operation system.

8. device according to claim 7, is characterized in that, described first information enquiry module comprises:

Database configuration module, for being saved to database by user's identification information and its addressable operation system;

The second information inquiry module, at described database, inquires about described user's addressable operation system corresponding to identification information.

9. device according to claim 8, is characterized in that, described the second information inquiry module comprises:

Information encryption module, for encrypting user's identification information to be sent to pre-configured database;

The 3rd information inquiry module, at described pre-configured database, the addressable operation system that the identification information of inquiring user is corresponding.

10. device according to claim 9, is characterized in that, described information display module comprises:

Interface custom block, for user-defined interface;

Information display sub-module, for showing the operation system of described user-accessible by the interface display of described interface custom block definition with agent way.

Images