TW202447457A - Authorization verification access system - Google Patents

Abstract

The present disclosure provides an authorization verification access system, which includes a plurality of service modules, a logical database, a logical server, an authorization verification server and a user module. The logical database stores a plurality of user authorization data. The logical server integrates the plurality of user authorization data into a service authorization data. The authorization verification server analyzes the service authorization data to generate a plurality of service access certificates. The user module transmits a service access request corresponding to the service module to the authorization verification server. The authorization verification server verifies the user module according to the service access request, and selects and transmits one of the service access certificates to the user module according to an identity verification code, so that the user module accesses the service module. Therefore, the authorization verification mechanisms of various services can be integrated, and the services can be quickly accessed by users.

Description

Authorization and Verification Access System

The present invention relates to an authorization verification access system, and more particularly to an authorization verification access system integrating multiple service authorization verification mechanisms.

With the development of cloud technology, the cloud ecosystem with diversified services can better provide localized services for the different needs of enterprises in various regions, and at the same time, information security has received higher attention. However, when users use different services, they need to go through the cumbersome login procedures of each service, which often causes difficulties in authorization management and information security risks. As services become more and more diversified, the standards for account management methods of each service are different, and the scalability of the existing service authorization system is not as good as expected. Therefore, it is difficult to unify the unified standards for authorization of each service in the cloud ecosystem, and the demand for integration is increasing day by day.

In addition, in the existing authorization verification mechanism of single sign-on services, service owners must adjust the authorization verification mechanism before integrating it into the same authorization system. This will cause service owners to spend more costs when joining the cloud ecosystem. It can be seen from this that there is currently a lack of an authorization verification access system on the market that can unify multiple authorization verification mechanisms for various services, so relevant industry players are looking for solutions.

Therefore, the purpose of the present invention is to provide an authorization verification access system, which integrates the user authorization data corresponding to the service module into a unified service authorization data through a logic server, and then uses the authorization verification server to distribute the service access certificate to the user module according to the service authorization data, so as to achieve a unified management of the authorization verification mechanism and ensure the verification process and information security.

According to an embodiment of the present invention, an authorization verification access system is provided, which includes a plurality of service modules, a logic database, a logic server, an authorization verification server, and a user module. The logic database stores a plurality of user authorization data corresponding to these service modules. The logic server is connected to the logic database, wherein the logic server integrates these user authorization data into a service authorization data and stores the service authorization data in the logic database. The authorization verification server is connected to the logic database and these service modules, wherein the authorization verification server parses the service authorization data to generate a plurality of service access certificates. The user module is connected to the authorization and verification server and transmits a service access request corresponding to at least one service module to the authorization and verification server. The authorization and verification server verifies an identity code of the user module according to the service access request, and the authorization and verification server selects and transmits one of the service access certificates to the user module according to the identity code, so that the user module is connected to the at least one service module through the authorization and verification server and accesses the at least one service module through the one of the service access certificates.

Thus, the authorization verification access system of the present invention connects the user authorization data corresponding to each service module to the authorization verification server, and is not limited by the authorization differences between different services. In this way, the purpose of cross-platform authorization and unified management can be achieved without modifying the existing authorization verification mechanism.

Other embodiments of the aforementioned implementation method are as follows: The aforementioned authorization verification access system further includes a plurality of management modules. These management modules are connected to the logic database and are used to respectively set and update these user authorization data stored in the logic database. The logic server reintegrates these user authorization data to update the service authorization data.

Other embodiments of the aforementioned implementation method are as follows: The aforementioned authorization verification server includes a data receiving module, an authorization verification parsing module and an authorization verification database. The data receiving module receives service authorization data from the logic database. The authorization verification parsing module is connected to the data receiving module and parses the service authorization data to generate these service access certificates. The authorization verification database is connected to the authorization verification parsing module and is used to store these service access certificates.

Other embodiments of the above-mentioned implementation method are as follows: the above-mentioned authorization verification server verifies the above-mentioned at least one service module according to the service access request and obtains at least one service access token corresponding to the above-mentioned at least one service module. The authorization verification server confirms whether there is an authorization relationship between the user module and the above-mentioned at least one service module according to the above-mentioned at least one service access token.

Other embodiments of the aforementioned implementation are as follows: one of the aforementioned service access certificates includes an encrypted message, and the aforementioned at least one service module verifies whether the user module has a usage permission corresponding to the aforementioned at least one service module according to the encrypted message. When the user module has the usage permission, the aforementioned at least one service module is accessible to the user module.

Other implementation examples of the aforementioned implementation method are as follows: the aforementioned authorization verification server executes a hash algorithm on the service access request to generate an identity identification code of the user module.

According to another embodiment of the present invention, an authorization verification access system is provided, which includes a plurality of service modules, a logic database, a logic server, an authorization verification server, an application program interface, and a user module. The logic database stores a plurality of user authorization data corresponding to these service modules. The logic server is connected to the logic database, wherein the logic server integrates these user authorization data into a service authorization data and stores the service authorization data in the logic database. The authorization verification server is connected to the logic database and these service modules, wherein the authorization verification server parses the service authorization data to generate a plurality of service access certificates. The application program interface is connected to the authorization and verification server and is linked to the authorization and verification server account. The user module is connected to and logs into the application program interface, and transmits a service access request corresponding to at least one service module to the authorization and verification server through the application program interface. The authorization and verification server verifies an identity code of the user module according to the service access request, and the authorization and verification server selects and transmits one of the service access certificates to the application program interface according to the identity code, so that the user module is connected to the at least one service module through the application program interface and the authorization and verification server, and accesses the at least one service module through the one of the service access certificates.

Thus, the authorization verification access system of the present invention integrates the user authorization data corresponding to the service module into a unified service authorization data through the logic server, and then uses the authorization verification server to distribute the service access certificate to the user module according to the service authorization data, thereby achieving group-different authorization verification for multiple services and multiple users, and reducing the cost of each service when joining the authorization verification server.

Other embodiments of the aforementioned implementation method are as follows: The aforementioned authorization verification access system further includes a plurality of management modules. These management modules are connected to the logic database and are used to respectively set and update these user authorization data stored in the logic database. The logic server reintegrates these user authorization data to update the service authorization data.

Other embodiments of the above-mentioned implementation method are as follows: the above-mentioned authorization verification server verifies the above-mentioned at least one service module according to the service access request and obtains at least one service access token corresponding to the above-mentioned at least one service module. The authorization verification server confirms whether there is an authorization relationship between the user module and the above-mentioned at least one service module according to the above-mentioned at least one service access token.

Other embodiments of the aforementioned implementation are as follows: one of the aforementioned service access certificates includes an encrypted message, and the aforementioned at least one service module verifies whether the user module has a usage permission corresponding to the aforementioned at least one service module according to the encrypted message. When the user module has the usage permission, the aforementioned at least one service module is accessible to the user module.

The following will describe several embodiments of the present invention with reference to the drawings. For the sake of clarity, many practical details will be described together in the following description. However, it should be understood that these practical details should not be used to limit the present invention. That is to say, in some embodiments of the present invention, these practical details are not necessary. In addition, in order to simplify the drawings, some commonly known structures and components will be depicted in the drawings in a simple schematic manner; and repeated components may be represented by the same number.

In addition, in this article, when a certain component (or unit or module, etc.) is "connected/linked" to another component, it may refer to that the component is directly connected/linked to another component, or it may refer to that a certain component is indirectly connected/linked to another component, that is, there are other components between the component and the other component. When it is clearly stated that a certain component is "directly connected/linked" to another component, it means that there are no other components between the component and the other component. The terms first, second, third, etc. are only used to describe different components, and there is no restriction on the components themselves. Therefore, the first component can also be renamed as the second component. Moreover, the combination of components/units/circuits in this article is not a generally known, conventional or familiar combination in this field. Whether the components/units/circuits themselves are known cannot be used to determine whether their combination relationship is easy to be completed by ordinary knowledgeable people in the technical field.

Please refer to FIG. 1, which is a block diagram of an authorization verification access system 100 according to a first embodiment of the present invention. As shown in FIG. 1, the authorization verification access system 100 includes a service group 200, a logic database 300, a logic server 400, an authorization verification server 500, and a user module 600.

The service group 200 includes a plurality of service modules 210, 220, 230. The logic database 300 stores a plurality of user authorization data 310, 320, 330 corresponding to the service modules 210, 220, 230. The logic server 400 is signal-connected to the logic database 300, and retrieves the user authorization data 310, 320, 330 from the logic database 300 at intervals, integrates the user authorization data 310, 320, 330 into service authorization data 340, and then stores the service authorization data 340 in the logic database 300.

The authorization verification server 500 is signal-connected to the logical database 300 and the service modules 210, 220, and 230 of the service group 200. The authorization verification server 500 retrieves the service authorization data 340 from the logical database 300, and performs a key analysis on the service authorization data 340 to generate a plurality of service access certificates 521. The user module 600 is signal-connected to the authorization verification server 500, and transmits a service access request 610 corresponding to at least one of the service modules 210, 220, and 230 to the authorization verification server 500. The authorization verification server 500 verifies an identity authentication code of the user module 600 according to the service access request 610. Then, the authorization and verification server 500 selects and transmits one of the service access certificates 521 to the user module 600 according to the identity code, so that the user module 600 connects to at least one of the service modules 210, 220, 230 through the authorization and verification server 500, and accesses at least one of the service modules 210, 220, 230 through the aforementioned service access certificate 521.

Thus, the authorization verification access system 100 of the present invention integrates the user authorization data 310, 320, 330 corresponding to the service modules 210, 220, 230 into the service authorization data 340 for unified authorization setting through the logic server 400, and then distributes the parsed service access certificate 521 to the user module 600 through the authorization verification server 500, so as to achieve unified management of the authorization verification mechanisms of all service modules 210, 220, 230 and protect the verification process and information security of the user module 600. Therefore, the present invention can achieve the purpose of cross-platform authorization and unified management without modifying the various authorization verification mechanisms in the service group 200.

Specifically, the logic server 400 and the authorization verification server 500 can be independent server hosts or functional modules in the server hosts. Each service module 210, 220, 230 can be a proxy service or a functional service module of a resource item in a resource server, but the present invention is not limited thereto in actual implementation. The user authorization data 310, 320, 330 stored in the logic database 300 can be information about the level, basic data, declaration data, authorization period, service authorization method and identity verification level of each user in the cloud system of the service modules 210, 220, 230, respectively. The aforementioned information is the authorization verification mechanism of each service module 210, 220, 230. The logic server 400 sets the user authorization data 310, 320, 330 stored in the logic database 300 to a unified service authorization method to generate service authorization data 340.

In addition, the authorization verification access system 100 may further include a management group 700, which is signal-connected to the logic database 300 and includes a plurality of management modules 710, 720, 730. The management modules 710, 720, 730 may be used to respectively set and update the user authorization data 310, 320, 330 stored in the logic database 300. For example, when the number of users of the service module 210 increases or decreases, or when the authorization verification mechanism changes, the management module 710 will update the user authorization data 310 to the logic database 300 in real time. Subsequently, the logic server 400 will reintegrate the updated user authorization data 310 and the user authorization data 320, 330 to update the service authorization data 340. In other words, the logic server 400 can dynamically unify the authorization verification mechanisms of the service modules 210, 220, and 230, and store the latest defined service authorization data 340 in the logic database 300, so that the authorization verification server 500 can verify the user module 600 that issues the service access request 610 according to the latest defined service authorization data 340.

The authorization verification server 500 may include a data receiving module 510, an authorization verification parsing module 520, and an authorization verification database 530. The data receiving module 510 receives the service authorization data 340 from the logic database 300. The authorization verification parsing module 520 is signal-connected to the data receiving module 510, and performs key parsing and verification of the service authorization data 340 to generate a plurality of service access certificates 521 corresponding to different users. The authorization verification database 530 is signal-connected to the authorization verification parsing module 520 and is used to store the parsed service access certificates 521 so that when the user module 600 issues a service access request 610, the authorization verification parsing module 520 can immediately distribute a dedicated service access certificate 521 from the authorization verification database 530 to the user module 600.

For example, if the user module 600 wants to request access and connect to two service modules 210 and 220 that have an authorization relationship, the user module 600 sends a service access request 610 to the authorization verification server 500, and the data receiving module 510 receives the service access request 610. The authorization verification analysis module 520 verifies the service modules 210 and 220 according to the service access request 610 and obtains two service access tokens corresponding to the service modules 210 and 220. The authorization verification analysis module 520 confirms whether there is an authorization relationship between the user module 600 and the two service modules 210 and 220 according to the two service access tokens. When there is no authorization relationship between the user module 600 and the two service modules 210, 220, the authorization verification analysis module 520 returns a verification failure message to the user module 600. When there is an authorization relationship between the user module 600 and the two service modules 210, 220, the authorization verification analysis module 520 executes a hash algorithm on the service access request 610 to generate an identity code of the user module 600. Then, the authorization verification analysis module 520 verifies the identity code of the user module 600, and selects and transmits a service access certificate 521 exclusive to the user module 600 to the user module 600 according to the identity code.

Specifically, the service access certificate 521 dedicated to the user module 600 may include an identity information authentication code of the user module 600 and an access key of the usage rights it has. The aforementioned identity information authentication code can be used by the authorization verification analysis module 520 to verify and identify the identity authentication code of the user module 600. In other embodiments, the authorization verification analysis module 520 may also use, for example, a digital signature (Digital Signature) or other identity authentication technologies to authenticate the user module 600. The access key can provide the user module 600 with user authentication and authorization service scope for accessing the service modules 210 and 220 through the Internet. In addition, the access key may include an encrypted message for the service modules 210 and 220 to identify the holder token (e.g., Token). Therefore, the service modules 210 and 220 can verify whether the user module 600 has the use authority corresponding to the service modules 210 and 220 according to the encrypted message. When the user module 600 has the use authority, each service module 210 and 220 is accessible to the user module 600. In this way, the authorization verification access system 100 of the present invention can not only achieve group-different authorization verification for multiple services and multiple users, but also use the service access certificate 521 pre-stored in the authorization verification database 530 to provide users with fast access to services.

Please refer to FIG. 2, which is a block diagram of an authorization verification access system 100a according to a second embodiment of the present invention. As shown in FIG. 2, the authorization verification access system 100a includes the service group 200, the logic database 300, the logic server 400, the authorization verification server 500, the user module 600 and the management group 700 of FIG. 1.

Different from the first embodiment, the authorization verification access system 100a of FIG. 2 may further include an application programming interface 800. The application programming interface 800 is signal-connected between the authorization verification server 500 and the user module 600, and is linked to the account of the authorization verification server 500. If the user module 600 requests access and connects to the two service modules 210 and 220 with an authorization relationship, the user module 600 logs into the application programming interface 800, and the application programming interface 800 performs a third-party account verification on the user module 600.

When the user module 600's account is successfully authenticated, the user module 600 can transmit a service access request 610 corresponding to the two service modules 210 and 220 to the authorization and verification server 500 via the application programming interface 800. The authorization and verification server 500 verifies the identity code of the user module 600 according to the service access request 610. Then, the authorization and verification server 500 selects and transmits a service access certificate 521 specific to the user module 600 to the application programming interface 800, so that the user module 600 can connect to the two service modules 210 and 220 via the application programming interface 800 and the authorization and verification server 500, and access the two service modules 210 and 220 through the service access certificate 521. Thus, the authorization verification access system 100a of the present invention utilizes the application programming interface 800 as a third-party account verification, and continues to receive the service access certificate 521 distributed from the authorization verification server 500 to the user module 600, thereby achieving group-different authorization verification for multiple services and multiple users, and can reduce the cost of each service when joining the authorization verification server 500.

In summary, the present invention has the following advantages: First, it can integrate the authorization and verification mechanisms of multiple services and provide users with quick access to services. Second, it can provide users with cross-platform access to services and provide a single sign-on integration solution without changing the authorization and verification mechanisms of each service, thereby lowering the threshold for integrating services into the authorization and verification server. Third, unified management of authorization through the authorization and verification server can improve information security. Whether it is the access to sensitive data with high security requirements or the authorization of service user identities, under the management of the authorization and verification access system, third parties can perform authorization in a safe and secure manner without being restricted by the differences in authorization between different services.

Although the present invention has been disclosed as above by way of embodiments, it is not intended to limit the present invention. Anyone skilled in the art may make various changes and modifications without departing from the spirit and scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the scope defined in the attached patent application.

100,100a: Authorization and verification access system 200: Service group 210,220,230: Service module 300: Logical database 310,320,330: User authorization data 340: Service authorization data 400: Logical server 500: Authorization and verification server 510: Data receiving module 520: Authorization and verification parsing module 521: Service access certificate 530: Authorization and verification database 600: User module 610: Service access request 700: Management group 710,720,730: Management module 800: Application programming interface

In order to make the above and other purposes, features, advantages and embodiments of the present invention more obvious and easy to understand, the attached drawings are described as follows: Figure 1 is a block diagram of an authorization verification access system according to the first embodiment of the present invention; and Figure 2 is a block diagram of an authorization verification access system according to the second embodiment of the present invention.

100: Authorization and verification access system

200: Service Group

210,220,230: Service module

300:Logical database

310,320,330: User authorization information

340: Service authorization information

400:Logical Server

500: Authorization verification server

510: Data receiving module

520: Authorization verification analysis module

521: Service Access Token

530: Authorization verification database

600: User module

610: Service access request

700: Management Group

710,720,730: Management module

Claims (10)

An authorization verification access system comprises: a plurality of service modules; a logic database storing a plurality of user authorization data corresponding to the service modules; a logic server connected to the logic database, wherein the logic server integrates the user authorization data into a service authorization data and stores the service authorization data in the logic database; an authorization verification server connected to the logic database and the service modules, wherein the authorization verification server parses the service authorization data to generate a plurality of service access certificates; and a user module connected to the authorization verification server and transmitting a service access request corresponding to at least one of the service modules to the authorization verification server; The authorization verification server verifies an identity code of the user module according to the service access request, and the authorization verification server selects and transmits one of the service access certificates to the user module according to the identity code, so that the user module is connected to the at least one service module through the authorization verification server, and accesses the at least one service module through the one of the service access certificates. The authorization verification access system as described in claim 1 further comprises: A plurality of management modules connected to the logic database and used to respectively set and update the user authorization data stored in the logic database; Wherein, the logic server reintegrates the user authorization data to update the service authorization data. The authorization verification access system as described in claim 1, wherein the authorization verification server comprises: a data receiving module, receiving the service authorization data from the logic database; an authorization verification parsing module, connected to the data receiving module, and parsing the service authorization data to generate the service access certificates; and an authorization verification database, connected to the authorization verification parsing module, and used to store the service access certificates. The authorization verification access system as described in claim 1, wherein the authorization verification server verifies the at least one service module according to the service access request and obtains at least one service access token corresponding to the at least one service module, and the authorization verification server confirms whether there is an authorization relationship between the user module and the at least one service module according to the at least one service access token. An authorization verification access system as described in claim 1, wherein one of the service access certificates includes an encrypted message, and the at least one service module verifies whether the user module has a usage permission corresponding to the at least one service module based on the encrypted message. When the user module has the usage permission, the at least one service module provides access to the user module. The authorization and verification access system as described in claim 1, wherein the authorization and verification server executes a hash algorithm on the service access request to generate the identity authentication code of the user module. An authorization and verification access system includes: a plurality of service modules; a logic database storing a plurality of user authorization data corresponding to the service modules; a logic server connected to the logic database, wherein the logic server integrates the user authorization data into a service authorization data and stores the service authorization data in the logic database; an authorization and verification server connected to the logic database and the service modules, wherein the authorization and verification server parses the service authorization data to generate a plurality of service access certificates; an application program interface connected to the authorization and verification server and linked to the authorization and verification server account; and A user module is connected to and logs into the application program interface, and transmits a service access request corresponding to at least one of the service modules to the authorization verification server through the application program interface; wherein the authorization verification server verifies an identity code of the user module according to the service access request, and the authorization verification server selects and transmits one of the service access certificates to the application program interface according to the identity code, so that the user module connects to the at least one of the service modules through the application program interface and the authorization verification server, and accesses the at least one of the service modules through one of the service access certificates. The authorization verification access system as described in claim 7 further comprises: A plurality of management modules connected to the logical database and used to respectively set and update the user authorization data stored in the logical database; Wherein, the logical server reintegrates the user authorization data to update the service authorization data. An authorization verification access system as described in claim 7, wherein the authorization verification server verifies the at least one service module according to the service access request and obtains at least one service access token corresponding to the at least one service module, and the authorization verification server confirms whether there is an authorization relationship between the user module and the at least one service module according to the at least one service access token. An authorization verification access system as described in claim 7, wherein one of the service access certificates includes an encrypted message, and the at least one service module verifies whether the user module has a usage permission corresponding to the at least one service module based on the encrypted message. When the user module has the usage permission, the at least one service module provides access to the user module.