CN115442136A - Application system access method and device - Google Patents

Abstract

The invention discloses an application system access method and a device, which relate to the technical field of network security, wherein the method comprises the following steps: receiving an authorization request sent by a client, wherein the authorization request comprises client identity information, a client IP address and an identifier of an application system to be accessed; according to a plurality of pre-stored client identity information, performing identity authentication on the client identity information in the authorization request; after the identity authentication is passed, generating a first bill for accessing the application system to be accessed according to the client identity information, the client IP address and the identification of the application system to be accessed; encrypting the first bill to obtain an authorization code uniquely corresponding to the first bill; and sending the authorization code to the client so that the client can access the application system to be accessed through the authorization code. The invention can improve the identity authentication and authorization efficiency when the application system accesses.

Description

Application system access method and device

technical field

The invention relates to the technical field of network security, in particular to an application system access method and device.

Background technique

This section is intended to provide a background or context to embodiments of the invention that are recited in the claims. The descriptions herein are not admitted to be prior art by inclusion in this section.

At present, in a business scenario, if a customer needs to access a certain application system, it needs to be authenticated by the identity authentication system first, and then can only be accessed after being authorized by the application system. For example, the mobile banking APP performs user name and password authentication in the identity authentication system. After passing the authentication, it can obtain authorization from the file upload and download module before uploading and downloading files. The authentication and authorization efficiency of this access method is low, and when the application system is faced with a large number of accesses, it cannot give customers timely feedback, which brings poor experience to customers.

Contents of the invention

An embodiment of the present invention provides an application system access method to improve identity authentication and authorization efficiency during application system access and improve customer experience. The method includes:

receiving the authorization request sent by the client, the authorization request including client identity information, client IP address and the identification of the application system to be accessed;

Perform identity authentication on the client identity information in the authorization request according to multiple pre-stored client identity information;

After the identity authentication is passed, generate a first ticket for accessing the application system to be accessed according to the identity information of the client, the IP address of the client and the identification of the application system to be accessed in the authorization request;

Encrypt the first ticket to obtain the unique authorization code corresponding to the first ticket;

Send the authorization code to the client, so that the client accesses the application system to be accessed through the authorization code.

An embodiment of the present invention also provides an application system access device, which is used to improve the efficiency of identity authentication and authorization during application system access and improve customer experience. The device includes:

The receiving module is used to receive the authorization request sent by the client, and the authorization request includes the client identity information, the client IP address and the identification of the application system to be accessed;

An identity authentication module, configured to perform identity authentication on the client identity information in the authorization request according to a plurality of pre-stored client identity information;

A ticket generation module, configured to generate a first ticket for accessing the application system to be accessed according to the identity information of the client in the authorization request, the IP address of the client and the identification of the application system to be accessed after the identity authentication is passed;

An authorization code generation module, configured to encrypt the first ticket to obtain a unique authorization code corresponding to the first ticket;

The sending module is configured to send the authorization code to the client, so that the client accesses the application system to be accessed through the authorization code.

An embodiment of the present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and operable on the processor. When the processor executes the computer program, the above method for accessing the application system is implemented.

An embodiment of the present invention also provides a computer-readable storage medium, where the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the above method for accessing the application system is implemented.

An embodiment of the present invention further provides a computer program product, where the computer program product includes a computer program, and when the computer program is executed by a processor, the above method for accessing the application system is implemented.

In the embodiment of the present invention, the authorization request sent by the client is received, and the authorization request includes the identity information of the client, the IP address of the client and the identification of the application system to be accessed; according to a plurality of identity information of the clients stored in advance, the authorization request After the identity authentication is passed, according to the identity information of the client in the authorization request, the IP address of the client and the identification of the application system to be accessed, a first ticket for accessing the application system to be accessed is generated; Encrypting the first ticket to obtain an authorization code uniquely corresponding to the first ticket; sending the authorization code to the client, so that the client accesses the application system to be accessed through the authorization code. Compared with the existing technical solutions in which different systems perform identity authentication and authorization when accessing application systems, the identity of the client is authenticated through the same system. The ticket is converted into an authorization code and sent to the client. The client can access the application system to be accessed through the authorization code, thereby improving the identity authentication and authorization efficiency of the application system and improving customer experience.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only These are some embodiments of the present invention. Those skilled in the art can also obtain other drawings based on these drawings without creative work. In the attached picture:

FIG. 1 is a flowchart of an application system access method provided in an embodiment of the present invention;

FIG. 2 is a flow chart of an access verification method when accessing an application system to be accessed through an authorization code provided in an embodiment of the present invention;

FIG. 3 is a flow chart of accessing using an application system accessing method provided in an embodiment of the present invention;

FIG. 4 is a schematic diagram of an application system access device provided in an embodiment of the present invention;

Fig. 5 is a schematic diagram of a computer device provided in an embodiment of the present invention.

detailed description

In order to make the purpose, technical solutions and advantages of the embodiments of the present invention more clear, the embodiments of the present invention will be further described in detail below in conjunction with the accompanying drawings. Here, the exemplary embodiments and descriptions of the present invention are used to explain the present invention, but not to limit the present invention.

In the description of this specification, the words "comprising", "comprising", "having", "containing" and so on are all open terms, meaning including but not limited to. A description referring to the terms "one embodiment," "a particular embodiment," "some embodiments," "for example," etc., means that a particular feature, structure, or characteristic described in connection with the embodiment or example is included in at least one of the present application. Examples or examples. In this specification, schematic representations of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the described specific features, structures or characteristics may be combined in any suitable manner in any one or more embodiments or examples. The sequence of steps involved in each embodiment is used to schematically illustrate the implementation of the present application, and the sequence of steps therein is not limited and can be appropriately adjusted as required.

After research, it is found that in a business scenario, if a customer needs to access a certain application system, the identity authentication system needs to be authenticated first, and then the application system can be authorized to access. Specifically, the front-end system A can usually access the services of the application system C only after the identity authentication system B has successfully authenticated and obtained authorization from the application system C. This type of access is authenticated and authorized by different systems, resulting in low authentication and authorization efficiency. When the application system is faced with a large number of accesses, it cannot give customers timely feedback, which brings poor experience to customers.

In view of the above research, the embodiment of the present invention provides a solution that can integrate identity authentication and access authorization.

As shown in FIG. 1, it is a flow chart of an application system access method provided by an embodiment of the present invention. The method may include the following steps:

Step 101, receiving an authorization request sent by the client, the authorization request including the identity information of the client, the IP address of the client and the identification of the application system to be accessed;

Step 102, perform identity authentication on the client identity information in the authorization request according to a plurality of pre-stored client identity information;

Step 103, after the identity authentication is passed, generate a first ticket for accessing the application system to be accessed according to the identity information of the client, the IP address of the client and the identification of the application system to be accessed in the authorization request;

Step 104, encrypting the first ticket to obtain the unique authorization code corresponding to the first ticket;

Step 105, sending the authorization code to the client, so that the client accesses the application system to be accessed through the authorization code.

In the embodiment of the present invention, the authorization request sent by the client is received, and the authorization request includes the identity information of the client, the IP address of the client and the identification of the application system to be accessed; according to a plurality of identity information of the clients stored in advance, the authorization request After the identity authentication is passed, according to the identity information of the client in the authorization request, the IP address of the client and the identification of the application system to be accessed, a first ticket for accessing the application system to be accessed is generated; Encrypting the first ticket to obtain an authorization code uniquely corresponding to the first ticket; sending the authorization code to the client, so that the client accesses the application system to be accessed through the authorization code. Compared with the existing technical solutions in which different systems perform identity authentication and authorization when accessing application systems, the identity of the client is authenticated through the same system. The ticket is converted into an authorization code and sent to the client. The client can access the application system to be accessed through the authorization code, thereby improving the identity authentication and authorization efficiency of the application system and improving customer experience.

The above application system access method may be applied to the application system T that provides identity authentication and access authorization at the same time, and the application system T manages all client identity information.

With regard to the above step 101, the above client may be a client corresponding to a service consumer, and the service consumer may be a user, a process, or an application system requesting access. Correspondingly, the client identity information may be an element provided by the service consumer to represent the identity of the service consumer. For example, the elements of the identity of the service consumer may be: username (identification of the process or application system requesting access) and Password, user fingerprint, user iris, etc.

For the above step 102, the application system T can obtain the client identity information corresponding to the client identity information in the authorization request from the multiple pre-stored client identity information, compare the two, and if the identity information is consistent, then Indicates that the identity authentication is passed.

For the above step 103, after the identity authentication is passed, a pre-set ticket generation algorithm can be used to generate a ticket that can only be used to access the ticket to be accessed according to the client identity information, client IP address and the identification of the application system to be accessed in the authorization request. Application system's first ticket.

During specific implementation, the ticket generation algorithm may adopt cryptographic algorithms such as HMAC and AES.

In the embodiment of the present invention, in order to further improve the security during access, after generating the first ticket for accessing the application system to be accessed, it may further include:

The validity period information of the first ticket is set.

During specific implementation, the validity period information of the first ticket may include information about a time range in which the first ticket can be used, or information about the number of times the first ticket can be used, and the like. For example, the validity period information of the first note may be valid for a long time, or valid for one time.

For the above step 104, in order to protect the security of the note, a corresponding authorization code may be replaced for the first note. Specifically, an encryption key is generated, and the encryption key is used to encrypt the first note to obtain a unique authorization code corresponding to the first note. The application system T stores the association relationship between the encryption key and the authorization code. Wherein, different first notes correspond to different encryption keys.

At the same time, after the authorization code is generated, the client and the application system to be accessed are a mutual trust system, and the application system T can also store the mutual trust relationship between the client and the application system to be accessed.

For the above step 105, the above authorization code is sent to the client, so that the client accesses the application system to be accessed through the authorization code.

To sum up, the application system T not only undertakes the function of identity authentication, but also undertakes the function of authorizing access to the application system to be accessed.

As shown in Figure 2, it is a flow chart of the access verification method when accessing the application system to be accessed through the authorization code provided by the embodiment of the present invention, the method may include the following steps:

Step 201, after the client sends an access request to the application system to be accessed, it receives an access verification request sent by the application system to be accessed; the access verification request includes the identification of the application system to be accessed, the authorization code carried in the access request, the client Client identity information and client IP address;

Step 202, generating a second ticket according to the identifier of the application system to be accessed, and the client identity information and client IP address carried in the access request;

Step 203, comparing the second ticket with the first ticket corresponding to the authorization code;

Step 204, if the second ticket is consistent with the first ticket corresponding to the authorization code, and the validity period information of the first ticket is not expired, send access permission instruction information to the application system to be accessed.

For the above step 201, the service consumer initiates an access request to the application system to be accessed through the client corresponding to the service consumer. Wherein, the access request may carry an authorization code, client identity information and client IP address.

After receiving the access request, the application system to be accessed needs to send the identification of the application system to be accessed, the authorization code in the access request sent by the client, the client identity information and the client IP address to the application system T for access verification. That is, the application system T receives the access verification request sent by the application system to be accessed.

For the above step 202, the application system T first uses a preset ticket generation algorithm (the same as the above-mentioned ticket generation algorithm for generating the first ticket), according to the identification of the application system to be accessed sent by the application system to be accessed and the information carried in the access request. The client identity information and the client IP address are used to generate a second ticket.

For the above step 203, the second ticket can be compared with the first ticket corresponding to the authorization code to verify the consistency of the tickets.

In the embodiment of the present invention, since the authorization code is obtained after encrypting the first ticket, in the embodiment of the present invention, before the above step 203, it may also include:

The authorization code is decrypted to obtain the first ticket corresponding to the authorization code.

During specific implementation, according to the association relationship between the encryption key and the authorization code stored in the application system T, the encryption key associated with the authorization code is used to decrypt the authorization code to obtain the first ticket corresponding to the authorization code.

For the above step 204, if the second ticket is consistent with the first ticket corresponding to the authorization code, and the validity period information of the first ticket has not expired, it means that the authorization code has passed the verification, and the application system T can send a permission to the application system to be accessed. Instructions for accessing.

In the embodiment of the present invention, in order to further realize the protection of resources in the application system to be accessed, the indication information may include access control information, and the access control information may include resource information that is allowed to be accessed when accessing the application system to be accessed, and access The validity period information of the above resource information;

The application system T sends an instruction to allow access to the application system to be accessed, which may include:

The access control information is sent to the application system to be accessed in the form of session control information, so that the application system to be accessed can verify the authority of the client to access the resources of the application system to be accessed according to the session control information.

During specific implementation, after the application system T obtains the authorization code uniquely corresponding to the first ticket, it can also establish a mapping relationship between the authorization code and the application system access control information, store it in the application system access control relationship table, and realize the access control information Information such as the resource information that is allowed to be accessed when the application system is used, and the validity period information of the access resource information are used for security control.

Wherein, the resource information may include information such as services and interfaces in the application system to be accessed.

During specific implementation, when the application system T sends the indication information including the access control information to the application system to be accessed, it may send it in the form of session control information.

Wherein, the form of the session control information refers to session.

It should be noted that session is a server-side conversation technology, which means that the client sends a request to the server resource for the first time, and the session is established until one party disconnects. The session is saved on the server. When the client accesses the server, the server records the client information on the server in some form. When the client visits again, it only needs to find the status of the client from the session.

It can be understood that, in the embodiment of the present invention, the session is used to access protected resources (that is, the resource information allowed to be accessed when accessing the application system to be accessed, and the validity period information for accessing the resource information), and the session control information It carries the session ID, and the application system to be accessed sends the session ID to the client. When the client accesses the application system to be accessed for the second time, it can carry the session ID for access. At this time, the application system T only verifies the session ID corresponding to The validity of the session is sufficient, and there is no need to repeat the above-mentioned complex authentication and authorization processes.

In order to understand the above-mentioned method for accessing the application system more clearly, a specific example is used below to illustrate.

FIG. 3 is a flow chart of accessing using the above-mentioned application system accessing method. As shown in Figure 3, the following steps may be included:

1. The service consumer (that is, the client corresponding to the service consumer) requests identity authentication/authorization from the identity authentication and authorization mutual trust system (that is, the above-mentioned application system T) and applies for an authorization code.

In this step, the service consumer sends the identity information of the client, the IP address of the client and the identification of the service providing system (that is, the application system to be accessed) to the identity authentication and authorization mutual trust system.

2. The identity authentication and authorization mutual trust system allows the request and returns an authorization code.

In this step, the identity authentication authorization mutual trust system performs identity authentication on the client identity information sent by the service consumer according to multiple pre-stored client identity information; after passing the authentication, according to the client identity information sent by the service consumer, The IP address of the client and the identification of the service provider system generate a ticket (the first ticket) that can only be used to access the service provider system; and in order to protect the security of the ticket, encrypt the ticket and replace it with a corresponding authorization code ; Return an authorization code to the service consumer.

3. The service consumer provides the authorization code and requests the service from the service providing system.

In this step, when the service consumer accesses the service of the service providing system, it sends an authorization code, client identity information and client IP address to the service providing system.

4. The service providing system calls the identity authentication authorization mutual trust system to verify the authorization code request.

In this step, the service providing system sends the identification of the service providing system, the authorization code sent by the service consumer, the client identity information and the client IP address to the identity authentication and authorization mutual trust system for verification.

The identity authentication and authorization mutual trust system first generates a ticket to be verified (that is, the second ticket) according to the identification of the service providing system, the client's identity information and the client's IP address; then, the ticket to be verified and the decrypted authorization code The ticket is compared, if the comparison is consistent and within the validity period, the verification is considered to be passed. At this time, a dedicated session session is issued to the service provider system for accessing protected resources (session includes the control of the validity period). Under the service consumer The session ID is provided during the first visit (removing the above-mentioned complex process), and the identity authentication authorization mutual trust system verifies the validity of the session to determine whether it can provide corresponding services for service consumers.

5. The identity authentication and authorization mutual trust system returns the verification result.

6. The service providing system provides services according to the verification results returned by the identity authentication and authorization mutual trust system.

To sum up, the embodiment of the present invention integrates identity authentication and access authorization into an application system, and the application system completes identity authentication, ticket generation, authorized access, ticket verification, etc., and separates the responsibilities of identity authentication and authorization from the responsibilities of providing services Combined with the authorization code and ticket, the system is requested to issue and verify the authorization code, and through the issuance of a dedicated session, access control is performed on the protected application system resources.

The acquisition, storage, use, and processing of data in the technical solution of this application are in compliance with the relevant provisions of national laws and regulations

An embodiment of the present invention also provides an application system access device, as described in the following embodiments. Since the problem-solving principle of the device is similar to that of the application system access method, the implementation of the device can refer to the implementation of the application system access method, and repeated descriptions will not be repeated.

As shown in Figure 4, it is a schematic diagram of an application system access device provided by an embodiment of the present invention, the device may include:

The receiving module 401 is configured to receive an authorization request sent by the client, where the authorization request includes the client identity information, the client IP address and the identification of the application system to be accessed;

An identity authentication module 402, configured to perform identity authentication on the client identity information in the authorization request according to a plurality of pre-stored client identity information;

The ticket generating module 403 is configured to generate a first ticket for accessing the application system to be accessed according to the identity information of the client in the authorization request, the IP address of the client and the identification of the application system to be accessed after the identity authentication is passed;

An authorization code generating module 404, configured to encrypt the first note to obtain a unique authorization code corresponding to the first note;

The sending module 405 is configured to send the authorization code to the client, so that the client accesses the application system to be accessed through the authorization code.

In the embodiment of the present invention, a validity period setting module may also be included, which is used to generate the first authentication for accessing the application system to be accessed according to the identity information of the client in the authorization request, the IP address of the client, and the identification of the application system to be accessed in the ticket generation module. After a note:

The validity period information of the first ticket is set.

In the embodiment of the present invention, an access verification module may also be included for:

After the client sends an access request to the application system to be accessed, it receives the access verification request sent by the application system to be accessed; the access verification request includes the identification of the application system to be accessed, the authorization code carried in the access request, and the client identity information and client IP address;

Generate a second ticket according to the identifier of the application system to be accessed, and the client identity information and client IP address carried in the access request;

Comparing the second ticket with the first ticket corresponding to the authorization code;

If the second ticket is consistent with the first ticket corresponding to the authorization code, and the validity period information of the first ticket has not expired, send access permission instruction information to the application system to be accessed.

In the embodiment of the present invention, the access verification module can also be used before comparing the second ticket with the first ticket corresponding to the authorization code:

The authorization code is decrypted to obtain the first ticket corresponding to the authorization code.

In the embodiment of the present invention, the indication information may include access control information, and the access control information may include resource information that is allowed to be accessed when accessing the application system to be accessed, and validity period information for accessing the resource information;

The access authentication module can also be used to:

The access control information is sent to the application system to be accessed in the form of session control information, so that the application system to be accessed can verify the authority of the client to access the resources of the application system to be accessed according to the session control information.

The embodiment of the present invention also provides a computer device, as shown in FIG. 5 , which is a schematic diagram of the computer device in the embodiment of the present invention. The computer device 500 includes a memory 510, a processor 520, and is stored in the memory 510 and can be processed. A computer program 530 running on the processor 520, when the processing 520 executes the computer program 530, implements the above application system access method.

An embodiment of the present invention also provides a computer-readable storage medium, where the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the above method for accessing the application system is implemented.

An embodiment of the present invention further provides a computer program product, where the computer program product includes a computer program, and when the computer program is executed by a processor, the above method for accessing the application system is implemented.

In the embodiment of the present invention, the authorization request sent by the client is received, and the authorization request includes the identity information of the client, the IP address of the client and the identification of the application system to be accessed; according to a plurality of identity information of the clients stored in advance, the authorization request After the identity authentication is passed, according to the identity information of the client in the authorization request, the IP address of the client and the identification of the application system to be accessed, a first ticket for accessing the application system to be accessed is generated; Encrypting the first ticket to obtain an authorization code uniquely corresponding to the first ticket; sending the authorization code to the client, so that the client accesses the application system to be accessed through the authorization code. Compared with the existing technical solutions in which different systems perform identity authentication and authorization when accessing application systems, the identity of the client is authenticated through the same system. The ticket is converted into an authorization code and sent to the client. The client can access the application system to be accessed through the authorization code, thereby improving the identity authentication and authorization efficiency of the application system and improving customer experience.

Those skilled in the art should understand that the embodiments of the present invention may be provided as methods, systems, or computer program products. Accordingly, the present invention can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It should be understood that each procedure and/or block in the flowchart and/or block diagram, and a combination of procedures and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions may be provided to a general purpose computer, special purpose computer, embedded processor, or processor of other programmable data processing equipment to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing equipment produce a An apparatus for realizing the functions specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions The device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions can also be loaded onto a computer or other programmable data processing device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby The instructions provide steps for implementing the functions specified in the flow chart or blocks of the flowchart and/or the block or blocks of the block diagrams.

The specific embodiments described above have further described the purpose, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above descriptions are only specific embodiments of the present invention and are not intended to limit the scope of the present invention. Protection scope, within the spirit and principles of the present invention, any modification, equivalent replacement, improvement, etc., shall be included in the protection scope of the present invention.

Claims (13)

1. An application system access method, comprising:

receiving an authorization request sent by a client, wherein the authorization request comprises client identity information, a client IP address and an identifier of an application system to be accessed;

according to a plurality of pieces of client identity information stored in advance, identity authentication is carried out on the client identity information in the authorization request;

after the identity authentication is passed, generating a first bill for accessing the application system to be accessed according to the client identity information, the client IP address and the identification of the application system to be accessed in the authorization request;

encrypting the first bill to obtain an authorization code uniquely corresponding to the first bill;

and sending the authorization code to the client so that the client can access the application system to be accessed through the authorization code.

2. The method of claim 1, wherein after generating the first ticket for accessing the application system to be accessed according to the client identity information, the client IP address, and the identifier of the application system to be accessed in the authorization request, the method further comprises:

and setting validity period information of the first bill.

3. The method of claim 2, further comprising:

after a client sends an access request to an application system to be accessed, receiving an access verification request sent by the application system to be accessed; the access verification request comprises an identifier of an application system to be accessed, and an authorization code, client identity information and a client IP address carried in the access request;

generating a second bill according to the identifier of the application system to be accessed, the client identity information and the client IP address carried in the access request;

comparing the second bill with the first bill corresponding to the authorization code;

and if the second bill is consistent with the first bill corresponding to the authorization code and the validity period information of the first bill is not invalid, sending indication information allowing access to the application system to be accessed.

4. The method of claim 3, wherein prior to comparing the second ticket to the first ticket corresponding to the authorization code, further comprising:

and decrypting the authorization code to obtain the first bill corresponding to the authorization code.

5. The method according to claim 3, wherein the indication information includes access control information including resource information that is allowed to be accessed when accessing the application system to be accessed, and validity period information for accessing the resource information;

sending the indication information of access permission to the application system to be accessed, including:

and sending the access control information to the application system to be accessed in the form of session control information so that the application system to be accessed verifies the authority of the client to access the resources of the application system to be accessed according to the session control information.

6. An application system access apparatus, comprising:

the system comprises a receiving module, a sending module and a receiving module, wherein the receiving module is used for receiving an authorization request sent by a client, and the authorization request comprises client identity information, a client IP address and an identifier of an application system to be accessed;

the identity authentication module is used for performing identity authentication on the client identity information in the authorization request according to a plurality of pre-stored client identity information;

the bill generating module is used for generating a first bill for accessing the application system to be accessed according to the client identity information, the client IP address and the identification of the application system to be accessed in the authorization request after the identity authentication is passed;

the authorization code generation module is used for encrypting the first bill to obtain an authorization code uniquely corresponding to the first bill;

and the sending module is used for sending the authorization code to the client so that the client can access the application system to be accessed through the authorization code.

7. The apparatus of claim 6, further comprising a validity period setting module, configured to, after the ticket generating module generates the first ticket for accessing the application system to be accessed according to the client identity information, the client IP address, and the identification of the application system to be accessed in the authorization request:

and setting the validity period information of the first bill.

8. The apparatus of claim 7, further comprising an access validation module to:

after a client sends an access request to an application system to be accessed, receiving an access verification request sent by the application system to be accessed; the access verification request comprises an identifier of an application system to be accessed, and an authorization code, client identity information and a client IP address carried in the access request;

generating a second bill according to the identifier of the application system to be accessed, the client identity information and the client IP address carried in the access request;

comparing the second bill with the first bill corresponding to the authorization code;

and if the second bill is consistent with the first bill corresponding to the authorization code and the validity period information of the first bill is not invalid, sending indication information allowing access to the application system to be accessed.

9. The apparatus of claim 8, wherein the access validation module is further configured to, prior to comparing the second ticket to the first ticket corresponding to the authorization code:

and decrypting the authorization code to obtain the first bill corresponding to the authorization code.

10. The apparatus of claim 8, wherein the indication information includes access control information, the access control information including resource information that is allowed to be accessed when accessing an application to be accessed, and validity period information for accessing the resource information;

an access validation module further to:

and sending the access control information to the application system to be accessed in the form of session control information so that the application system to be accessed verifies the authority of the client to access the resources of the application system to be accessed according to the session control information.

11. A computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor implements the method of any one of claims 1 to 5 when executing the computer program.

12. A computer-readable storage medium, characterized in that it stores a computer program which, when executed by a processor, implements the method of any one of claims 1 to 5.

13. A computer program product, characterized in that the computer program product comprises a computer program which, when being executed by a processor, carries out the method of any one of claims 1 to 5.

Images