A kind of method and system of security level authentication
Technical field
The present invention relates to the digital television techniques field, relate in particular to a kind of method and system of security level authentication.
Background technology
In digital TV field, exist huge architectural framework and numerous physical systems, these systems support different operation systems by various forms, finally show the user in digital television gateway.In this architectural framework, fail safe becomes one of important composition.Because numerous systems of compositional system framework may be developed by many companies, and do not have unified safety standard in architectural framework, making has diverse security architecture in each tame system.Simultaneously,, the understanding of different brackets can occur, make security context when integrated each side operation system, need handle the verification work of different level of securitys, convenient follow-up flow process circulation work safe requirement because each tame technical merit and business model is different.
The general technology that adopts mostly is the mode of single-sign-on now.
The single-sign-on technology makes the user after at the beginning by authentication, need not show login again during other system of subsequent access, but replaces the user to do proof of identity work by single-node login system.Simultaneously, the fail safe in order to guarantee to visit third party's operation system all can be adopted further oppositely proof of identity mode.
When handling the integrated work of multi-service, no matter be B/S pattern or C/S model, all be to adopt the mode of single-sign-on to carry out undoubtedly, can reach the mode of a plurality of operation systems of sign-on access so really.Main flow process is as follows:
1, the user logins by identify label (forms such as user name, password or certificate).
2, single-node login system provides multiple authentication mode authenticated user identity.
In case behind the 3 success identity user identity, single-node login system can be noted user's identify label, and return a corresponding with it secure ID.
4, at this moment the user just can visit direct login system (for example: the portal gate system) operate.
If the system of 5 user captures and other system integration, the user does not need to show login once more when visiting other third party's operation system by gate system, the substitute is, and single-node login system is finished the reverse verification work of identity automatically.
6, after this user can visit third party's operation system normally.
Though the business integration mode of carrying out in the mode of single-sign-on has become security model very general on the market, employed technology and implementation strategy also can be integrated into various systems (heterogeneous system, system of foreign lands) within the security system, but along with the increase of third party's operation system, the business model difference (decision security strategy) that the third party realizes has become more and more distinct issues to the management of third party's operation system and the safety check of different brackets.Mainly show following some:
1, there is not uniform definition at operation system, can not all third party systems of unified management.
2, third party's operation system mostly is ripe product, and employed safe mode difference can not unify to utilize a kind of mode to carry out safety check; And existing single-node login system has just been done checking and has not been verified two kinds of safe modes at fail safe, does not consider the territory security problems under the business strategy, and Validation Mode is single relatively.
3, single Validation Mode also can reduce the performance (at every turn all needing through safety certification as all systems) of system to a certain extent greatly.
4, integrated under the extensive integrated system framework of security system, the problem that embodies is more simply after the safety certification, it is so simple to enter the third party system, the substitute is the integration of safe procedures, charging flow and workflow, this does not have unified flow process controlled function after will appearing at different security level authentications.
Summary of the invention
The objective of the invention is to propose a kind of method and system of security level authentication, open-ended safe class strategy and classification security strategy can be provided, the system that makes easily is integrated in the existing architectural framework, guarantees the fail safe of each system simultaneously.
For reaching this purpose, the present invention by the following technical solutions:
A kind of method of security level authentication may further comprise the steps:
A, third party's system divides is become operation system and application system;
B, service operation and support system define operation system information, and charging policy is formulated in the service of operation system definition;
To the multi-service automotive engine system, the multi-service automotive engine system is finished the registration of operation system with the operation system information synchronization for C, service operation and support system;
D, multi-service automotive engine system definition application system information;
E, the definition of multi-service automotive engine system are also managed the safe class strategy of each described operation system and each described application system;
F, multi-service automotive engine system are classified according to business model to operation system and application system, according to classification results, are different classes of operation system and the corresponding safe class strategy of application system distribution;
G, user through safety certification after, portal entry system, and by operation system or application system in the gate system visit third party system;
The operation system or the application system of H, single-node login system identification user capture, according to described different classes of operation system and the safe class strategy of application system correspondence and the safe class strategy of described operation system or application system self correspondence, carry out corresponding safety verification flow process.
The safe class strategy of described operation system or application system self correspondence comprises following grade:
Do not need the application system of safety verification, the user directly visits;
For the business model of safety in the default domain environment, operation system can be by the transmission of the user name charging flow of being correlated with, and application system can utilize user name to login;
For unsafe business model in the default domain environment, operation system and application system all need to finish further safety verification flow process by single-sign-on front end processor and single-node login system, obtain corresponding User Identity, carry out follow-up charging or browsing process again.
The described different classes of operation system and the safe class strategy of application system correspondence comprise following grade:
After independent operation system or application system obtained identify label, the user can visit service wherein;
After other operation system of middle grade or application system obtained identify label, the user can unify to enter the classification inlet, and does not need once more safety verification just can visit other operation systems or the application system of this classification;
After the operation system of high-grade or application system obtained identify label, the user can unify to enter the classification inlet, and other operation systems or the application system of this classification of user capture need be carried out safety verification once more.
Do not need the application system of safety verification to comprise search system, weather system or announcement systems; Business model for safety in the default domain environment needs the application system of user identity to comprise collection system or bookmarking system, needs the operation system of user identity to comprise integrating system or video on-demand system; For unsafe business model in the default domain environment, comprise figure bell system or stock system.
The management that the management that the multi-service automotive engine system is enabled operation system or stopped using, multi-service automotive engine system are added, delete, enabled the application system or stop using.
A kind of system of security level authentication comprises user terminal, service operation and support system, multi-service automotive engine system, single-node login system, single-sign-on front end processor, gate system, operation system and application system,
Wherein user terminal is used for by gate system access service system or application system;
Service operation and support system are used to define operation system information, charging policy is formulated in the service of operation system definition, and the operation system information synchronization is arrived the multi-service automotive engine system;
The multi-service automotive engine system is used to finish the registration and the definition application system information of operation system, definition is also managed the safe class strategy of each operation system and application system self, and operation system and application system classified according to business model, according to classification results, be different classes of operation system and the corresponding safe class strategy of application system distribution;
Single-node login system is used to discern the operation system or the application system of user capture, according to the safe class strategy of described operation system or application system correspondence, carries out corresponding safety verification flow process;
The single-sign-on front end processor is used to finish the safety verification flow process of operation system and application system;
Operation system and application system are used to provide service.
Operation system comprises integrating system or video on-demand system, and application system comprises search system, weather system, announcement systems, collection system or bookmarking system.
Adopted technical scheme of the present invention,, can make operator organize door pattern and workflow so that environmental system is unified, efficient to system management with more various, flexible way by definition and classification to operation system and application system; For operator provides open-ended safe class strategy and classification security strategy, can guarantee the fail safe of each system simultaneously so that system easily is integrated in the existing architectural framework; By various authentication policy, can also improve the performance of total system greatly; And the single-sign-on front end processor of employing chain type technique construction, not only can guarantee the flexible expansion and the configuration of security strategy and workflow, can also reduce the workload of secondary development greatly, guarantee the stable of system configuration.
Description of drawings
Fig. 1 is the system construction drawing of security level authentication in the specific embodiment of the invention.
Fig. 2 is the flow chart of security level authentication in the specific embodiment of the invention.
Embodiment
Further specify technical scheme of the present invention below in conjunction with accompanying drawing and by embodiment.
Fig. 1 is the system construction drawing of security level authentication in the specific embodiment of the invention.As shown in Figure 1, this security level authentication system comprises user terminal 101, service operation and support system 102, multi-service automotive engine system 103, single-node login system 104, single-sign-on front end processor 105, gate system 106, operation system 107 and application system 108.
Wherein user terminal is by gate system access service system or application system, service operation and support system definition operation system information, charging policy is formulated in service to the operation system definition, and with the operation system information synchronization to the multi-service automotive engine system, the multi-service automotive engine system is finished the registration and the definition application system information of operation system, definition is also managed the safe class strategy of each operation system and application system self, and operation system and application system classified according to business model, according to classification results, be different classes of operation system and the corresponding safe class strategy of application system distribution, the operation system or the application system of single-node login system identification user capture, safe class strategy according to described operation system or application system correspondence, carry out corresponding safety verification flow process, the single-sign-on front end processor is finished the safety verification flow process of operation system and application system, and operation system and application system are used to provide service.
Operation system mainly comprises integrating system or video on-demand system etc., and application system mainly comprises search system, weather system, announcement systems, collection system or bookmarking system etc.
Fig. 2 is the flow chart of security level authentication in the specific embodiment of the invention.As shown in Figure 2, the method for this security level authentication may further comprise the steps:
Step 201, third party's system divides is become operation system and application system.By analyzing the total system environment, at multi-service automotive engine system (Service Authentication Service Engine, SASE) define two kinds of entities of operation system and application system in, can be the abstract separation of various complicated service system, thus clear and definite the control problem of life cycle, the partition problem of safe class, the control problem of safe procedures and the control problem of system works flow process.
Step 202, service operation and support system define operation system information, and charging policy is formulated in the service of operation system definition.
To the multi-service automotive engine system, the multi-service automotive engine system is finished the registration of operation system with the operation system information synchronization for step 203, service operation and support system.
Step 204, multi-service automotive engine system definition application system information are added relevant information.
The management that the management that the multi-service automotive engine system is enabled operation system or stopped using, multi-service automotive engine system are added, delete, enabled the application system or stop using.
Step 205, the definition of multi-service automotive engine system are also managed the safe class strategy of each operation system and each application system.
The safe class strategy of operation system or application system self correspondence comprises following grade:
Do not need the application system of safety verification, the user directly visits;
For the business model of safety in the default domain environment, operation system can be by the transmission of the user name charging flow of being correlated with, and application system can utilize user name to login;
For unsafe business model in the default domain environment, operation system and application system all need to finish further safety verification flow process by single-sign-on front end processor and single-node login system, obtain corresponding User Identity, carry out follow-up charging or browsing process again.
Wherein, do not need the application system of safety verification to comprise search system, weather system or announcement systems, do not need can directly visiting of user identity.
Business model for safety in the default domain environment, need the application system of user identity to comprise collection system or bookmarking system, can directly transmit identify label, corresponding service (the many and same manufacturer of portal service, other system of low level security that also has the third party system to provide) is provided.
Need the operation system of user identity to comprise integrating system or video on-demand system, can directly transmit identify label, finish follow-up charging, watch etc. served (the many and same manufacturer of gate system, other system of low level security that also has the third party system to provide, there is not the capability development security system, then the default domain Environmental security).
For unsafe business model in the default domain environment, comprise figure bell system or stock system, need could to obtain identify label (mostly be the third party system, the system with the same manufacturer of gate system is also arranged partly, but the higher level of security of needs) by further safety certification.
Step 206, multi-service automotive engine system are classified according to business model to operation system and application system, according to classification results, are different classes of operation system and the corresponding safe class strategy of application system distribution.
The safe class strategy of different classes of operation system and application system correspondence comprises following grade:
After independent operation system or application system obtained identify label, the user can visit service wherein;
After other operation system of middle grade or application system obtained identify label, the user can unify to enter the classification inlet, and does not need once more safety verification just can visit other operation systems or the application system of this classification;
After the operation system of high-grade or application system obtained identify label, the user can unify to enter the classification inlet, and other operation systems or the application system of this classification of user capture need be carried out safety verification once more.
Step 207, user through safety certification after, portal entry system, and by operation system or application system in the gate system visit third party system.
The operation system or the application system of step 208, single-node login system identification user capture, at first according to the safe class strategy of different classes of operation system and application system correspondence, carry out corresponding safety verification flow process, after entering classification, according to the safe class strategy of operation system or application system self correspondence, carry out corresponding safety verification flow process again.
By to the classification of operation system and application system (operation system and application system can hybrid classification), can be so that flow process jumps to corresponding inlet.As:
A) VOD film, TV play etc. all belong to the service of video entertainment class, and same video entry address then is provided;
B) services such as stock, fund, online transaction all belong to the service of high level of security, and the port address that is classified into of this class then is provided behind identity verification;
C) with respect to the safety verification of middle grade, as third-party answer and integrating system, then behind identity verification, provide the port address that is classified into of this class, do not need corresponding safety certification when after this user visits again in this classification other system in a period of time;
D) do not have the system of grouping, then directly provide when registration corresponding entry address.
The above; only for the preferable embodiment of the present invention, but protection scope of the present invention is not limited thereto, and anyly is familiar with the people of this technology in the disclosed technical scope of the present invention; the variation that can expect easily or replacement all should be encompassed within protection scope of the present invention.Therefore, protection scope of the present invention should be as the criterion with the protection range of claim.