CN112016065A - Dual-user authentication method and device - Google Patents
Dual-user authentication method and device Download PDFInfo
- Publication number
- CN112016065A CN112016065A CN201910473118.9A CN201910473118A CN112016065A CN 112016065 A CN112016065 A CN 112016065A CN 201910473118 A CN201910473118 A CN 201910473118A CN 112016065 A CN112016065 A CN 112016065A
- Authority
- CN
- China
- Prior art keywords
- service
- user
- identifier
- dual
- processed
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/31—User authentication
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/45—Structures or tools for the administration of authentication
Abstract
The embodiment of the application provides a dual-user authentication method and a dual-user authentication device, which relate to the technical field of computers, wherein the method is applied to electronic equipment and comprises the following steps: acquiring a first user identifier of a first user carried by a first service request and a target service identifier of a service to be processed; if the dual-user authentication is determined to be carried out according to the first user identification and/or the target service identification, sending a preset dual-user authentication message to prompt a second user with the authorization authority of the service to be processed to execute a preset authorization operation; and obtaining the authorization message of the service to be processed, and providing the service to be processed for the first user. By adopting the method and the device, the authority management can be more flexible.
Description
Technical Field
The present application relates to the field of computer technologies, and in particular, to a method and an apparatus for dual-user authentication.
Background
In the authority management of a business system, different users using the business system have different operation authorities. For example, in a surveillance video management system, the identities of users include a manager and a general user, the manager has operation authority for all operations, and the general user has operation authority for partial operations, such as playing back surveillance videos and downloading surveillance videos.
In the related art, when a general user wants to process a service without an operation right through an electronic device, the general user may request an administrator for authorization, and the specific processing procedure includes: and the manager executes preset configuration operation to send a configuration request to the electronic equipment, wherein the configuration request carries the first user identifier of the common user and the target service identifier of the service to be processed. After receiving the configuration request, the electronic device may correspondingly store the first user identifier and the target service identifier in the pre-stored correspondence between the user identifier and the service identifier, so as to allocate the operation permission of the service to be processed to the common user. After receiving the service request of the common user, the electronic device may determine that a target service identifier corresponding to the first user identifier is locally stored, and provide a service to be processed for the first user.
However, after the common user completes the service to be processed, in order to prevent the common user from having the operation permission of the service to be processed all the time, the administrator can only execute the preset cancellation operation, so that the electronic device deletes the target service identifier corresponding to the user identifier of the common user, that is, manually changes the operation permission that has been given, resulting in low authorization efficiency.
Disclosure of Invention
An object of the embodiments of the present application is to provide a method and an apparatus for dual-user authentication, so that rights management is more flexible. The specific technical scheme is as follows:
in a first aspect, a dual-user authentication method is provided, where the method is applied to an electronic device, and the method includes:
acquiring a first user identifier of a first user carried by a first service request and a target service identifier of a service to be processed;
if the dual-user authentication is determined to be carried out according to the first user identification and/or the target service identification, sending a preset dual-user authentication message to prompt a second user with the authorization authority of the service to be processed to execute a preset authorization operation;
and obtaining the authorization message of the service to be processed, and providing the service to be processed for the first user.
Optionally, the determining to perform dual-user authentication includes:
and if the first user identification and/or the double user authentication identification corresponding to the target service identification are/is locally stored, determining to perform double user authentication.
Optionally, the determining to perform dual-user authentication includes:
judging whether the target service identifier is a service identifier corresponding to the first user identifier or not according to a corresponding relation between a pre-stored service identifier and a user identifier;
and if the target service identification is the service identification corresponding to the first user identification, determining to perform dual-user authentication.
Optionally, before sending the preset dual-user authentication message, the method further includes:
determining a data transmission protocol required for processing the service to be processed;
and if the data transmission protocol is a preset data transmission protocol, executing the step of sending the preset dual-user authentication message, wherein the preset data transmission protocol is a data transmission protocol with a protocol extension function.
Optionally, after obtaining the authorization message of the service to be processed, the method further includes:
determining the authority expiration time according to the receiving time of the authorization message and the preset authorization effective duration;
if the receiving time of the received second service request is within the authority expiration time, providing the service to be processed for the first user, wherein the second service request carries the first user identifier and the target service identifier, and the receiving time of the second service request is later than that of the first service request;
and if the receiving time of the second service request is not within the authority expiration time, executing the step of sending the preset dual-user authentication message.
Optionally, if the receiving time of the received second service request is within the permission expiration time, the method further includes:
and determining the updated authority expiration time according to the preset processing time of the to-be-processed service corresponding to the second service request and the authority expiration time.
Optionally, before the obtaining of the first user identifier of the first user carried in the first service request and the target service identifier of the service to be processed, the method further includes:
acquiring a user identifier and a service identifier carried by a configuration request;
and establishing a corresponding relation between the service identification and the user identification according to the user identification and the service identification.
In a second aspect, a dual-user authentication apparatus is provided, which is applied to an electronic device, and includes:
the first obtaining module is used for obtaining a first user identifier of a first user carried by the first service request and a target service identifier of a service to be processed;
the first determining module is used for sending a preset double-user authentication message to prompt a second user with the authorization authority of the service to be processed to execute preset authorization operation when double-user authentication is determined according to the first user identification and/or the target service identification;
and the providing module is used for obtaining the authorization message of the service to be processed and providing the service to be processed for the first user.
Optionally, the first determining module includes:
and the first determining sub-module is configured to determine to perform dual-user authentication when the first user identifier and/or the dual-user authentication identifier corresponding to the target service identifier is locally stored.
Optionally, the first determining module includes:
the judging submodule is used for judging whether the target service identifier is the service identifier corresponding to the first user identifier according to the corresponding relation between the pre-stored service identifier and the user identifier;
and the second determining submodule is used for determining to perform dual-user authentication when the target service identifier is the service identifier corresponding to the first user identifier.
Optionally, the apparatus further comprises:
the second determining module is used for determining a data transmission protocol required by processing the service to be processed;
and the execution module is used for executing the step of sending the preset dual-user authentication message when the data transmission protocol is a preset data transmission protocol, wherein the preset data transmission protocol is a data transmission protocol with a protocol extension function.
Optionally, the apparatus further comprises:
a third determining module, configured to determine an authority expiration time according to the receiving time of the authorization message and a preset authorization effective duration;
the providing module is further configured to provide the to-be-processed service for the first user when the receiving time of the received second service request is within the permission expiration time, where the second service request carries the first user identifier and the target service identifier, and the receiving time of the second service request is later than the receiving time of the first service request;
and the execution module is further used for executing the step of sending the preset dual-user authentication message when the receiving time of the second service request is not within the authority expiration time.
Optionally, if the receiving time of the received second service request is within the permission expiration time, the apparatus further includes:
and the fourth determining module is used for determining the updated authority expiration time according to the preset processing time of the service to be processed corresponding to the second service request and the authority expiration time.
Optionally, the apparatus further comprises:
the second obtaining module is used for obtaining the user identifier and the service identifier carried by the configuration request;
and the establishing module is used for establishing the corresponding relation between the service identification and the user identification according to the user identification and the service identification.
In a third aspect, an electronic device is provided, which includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory complete communication with each other through the communication bus;
a memory for storing a computer program;
a processor adapted to perform the method steps of any of the first aspects when executing a program stored in the memory.
In a fourth aspect, a computer-readable storage medium is provided, having stored thereon a computer program which, when being executed by a processor, carries out the method steps of any of the first aspects.
The method and the device for dual-user authentication provided by the embodiment of the application are applied to electronic equipment, and can acquire a first user identifier of a first user carried by a first service request and a target service identifier of a service to be processed; if the dual-user authentication is determined to be carried out according to the first user identification and/or the target service identification, sending a preset dual-user authentication message to prompt a second user with the authorization authority of the service to be processed to execute a preset authorization operation; and then, obtaining the authorization message of the service to be processed, and providing the service to be processed for the first user. As for the received first service request, after determining to perform dual-user authentication and receiving the authorization message of the second user, the service to be processed is provided for the first user, so that the authority management can be more flexible.
Of course, not all advantages described above need to be achieved at the same time in the practice of any one product or method of the present application.
Drawings
In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other drawings can be obtained according to the drawings without creative efforts.
Fig. 1 is a flowchart of a dual-user authentication method according to an embodiment of the present application;
fig. 2a is a schematic diagram of a dual-user authentication message according to an embodiment of the present application;
fig. 2b is a schematic diagram of another dual user authentication message provided in an embodiment of the present application;
fig. 3 is a flowchart of a dual-user authentication method according to an embodiment of the present application;
fig. 4 is a flowchart of a dual-user authentication method according to an embodiment of the present application;
fig. 5 is a flowchart of a dual-user authentication method according to an embodiment of the present application;
fig. 6 is a schematic structural diagram of a dual-user authentication device according to an embodiment of the present application;
fig. 7 is a schematic structural diagram of an electronic device according to an embodiment of the present application.
Detailed Description
The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it is obvious that the described embodiments are only a part of the embodiments of the present application, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.
The embodiment of the application provides a dual-user authentication method, which is applied to an electronic device, where the electronic device may be a server of a service system, for example, the electronic device may be a server of a surveillance video management system. The server of the service system can be in communication connection with the user terminal of the remote service system, and dual-user authentication can be realized based on communication between the server and the user terminal. The electronic device may also be a user terminal of a service system, for example, the electronic device may be a computer in which an application program for monitoring a Video management system is installed in a monitoring room, and an NVR (Network Video Recorder) connected to a display. When authentication information required for performing dual-user authentication is pre-stored in the user terminal, dual-user authentication can be realized through the user terminal, and the authentication information comprises a user identifier of a user to be subjected to dual-user authentication.
In the embodiment of the present application, the service system may be an affair management system that needs to ensure operation security through cross authentication between two users, for example, an oa (office automation) office automation system of an enterprise, and a monitoring video management system. The embodiment of the present application takes a service system as a surveillance video management system and an electronic device as a server of the surveillance video management system as an example, and describes a specific processing procedure of a dual-user authentication method. When the electronic device is a user terminal, the specific processing procedure of the dual-user authentication method is similar to that of the user terminal, and is not described herein again.
In the service system, the user identity includes an administrator, a user to be authorized and an authorized user. The user to be authorized has the operation authority of part of the service, and the authorized user has the authorization authority of part of the service. The manager not only has the operation authority and the authorization authority of all services, but also can distribute the operation authority of a certain user to be authorized and the authorization authority of a certain authorized user. In a possible implementation manner, a user to be authorized, who does not have an operation right of a certain service, may have an authorization right of another service, and thus, the user to be authorized may serve as an authorized user of the user to be authorized, who requests to execute another service.
For example, user a does not have the operation right of service 1 and has the authorization right of service 2, user B has the authorization right of service 1, and user C does not have the operation right of service 2. If the user A wants to request the service 1 without the operation authority, the user A is a user to be authorized, the user B with the authorization authority of the service 1 is an authorized user, and the user A needs to request the user B to authorize the user. If the user C wants to request the service 2 without the operation right, the user C is a to-be-authorized user, and the user a with the authorization right of the service 2 is an authorized user, that is, the to-be-authorized user (user a) requesting the service 1 can be an authorized user of the to-be-authorized user (user C) requesting the service 2.
According to the method and the device, the authority for executing a certain service is divided into the operation authority and the authorization authority, the two authorities are correspondingly distributed to the two users, and the service is provided for the users with the operation authority based on the common verification result of the two users, so that the safety of service processing is guaranteed based on the idea of differentiation authority, and the authority management can be more flexible.
Optionally, before the user logs in the service system, the administrator needs to allocate a corresponding operation right to the user to be authorized and allocate a corresponding authorization right to the authorized user, and an embodiment of the present application provides a processing procedure for the administrator to allocate the operation right and the authorization right through the electronic device, including:
step 1, obtaining a user identifier and a service identifier carried by a configuration request.
In implementation, a manager may log in a user terminal installed with an application program of the surveillance video management system, and perform a first preset operation to generate a configuration request including a user identifier and a service identifier. The first preset operation may be to click a user identifier icon of the user to be authorized (or a user identifier icon of the authorized user) and a service identifier icon of the service to which the operation right is to be assigned (or the authorization right is to be assigned) in a preset configuration page of the surveillance video management system. The first preset operation may also be inputting a user identifier of a user to be authorized (or a user identifier of an authorized user) and a service identifier of a service to which an operation right is to be assigned (or an authorization right is to be assigned) in a preset input field of the surveillance video management system. The user terminal may then send a configuration request to the electronic device.
Then, the electronic device may receive the configuration request, and obtain the user identifier and the service identifier carried in the configuration request.
And 2, establishing a corresponding relation between the service identification and the user identification according to the user identification and the service identification.
In implementation, the electronic device may store the user identifier and the service identifier correspondingly, so as to obtain a corresponding relationship between the service identifier and the user identifier.
In a feasible implementation manner, the electronic device may respectively establish a correspondence between the service identifier and the user identifier for the authorized user and the user to be authorized. In another possible implementation manner, different user identifier naming rules may be set for the authorized user and the user to be authorized, so that the electronic device determines, in the correspondence between the service identifier and the user identifier, that the user to which a certain user identifier belongs has the operation right or the authorization right of the service corresponding to the user identifier according to the user identifier naming rules. In another feasible implementation manner, the electronic device may set different service identifier naming rules for the service identifier to which the authorization right is to be assigned and the service identifier to which the operation right is to be assigned, so that the electronic device determines, in the correspondence between the service identifier and the user identifier, that the user corresponding to a certain service identifier has the operation right or the authorization right of the service to which the service identifier belongs according to the service identifier naming rules.
In the embodiment of the application, when the service system is a surveillance video management system, a manager can configure the operation authority of the user to be authorized and the authorization authority of the authorized user for each video channel. For example, an authorized user has the authorization right to download the surveillance video in channel a, but does not have the authorization right to download the surveillance video in channel B.
In the embodiment of the application, the electronic device can acquire the user identifier and the service identifier carried by the configuration request, and establish the corresponding relationship between the service identifier and the user identifier, so that when the service request is subsequently received, whether dual-user authentication is started for the service request or not is determined according to the corresponding relationship, and the received authorization information is verified, thereby comprehensively controlling the operation of the user, and enabling the authority management to be more flexible.
As shown in fig. 1, a specific processing procedure of a dual-user authentication method provided in an embodiment of the present application includes:
When the service system is a surveillance video management system, the service request received by the electronic device may be one of a playback request, a download request, and a preview request of a surveillance video. For different service systems, the service requests received by the electronic device may be various, and the embodiment of the present application is not particularly limited.
In implementation, when the first user wants to process a certain service, the first user may perform a second preset operation to generate a first service request including a first user identifier of the first user and a target service identifier of the service to be processed. The second preset operation may be to click an icon representing a to-be-processed service in a preset configuration page of the surveillance video management system. The second preset operation may also be to input a target service identifier of a service to be processed in a preset input field of the surveillance video management system. The user terminal may then send the first service request to the electronic device.
The electronic device may obtain a first user identifier of the first user carried by the first service request and a target service identifier of the service to be processed.
For example, when the first User wants to play back the surveillance video, the first User may click on an icon representing the playback in a preset configuration page of the surveillance video management system to generate the first service request including the first User identification User1 and the target service identification HF of the playback.
And 102, if the dual-user authentication is determined according to the first user identification and/or the target service identification, sending a preset dual-user authentication message to prompt a second user with the authorization authority of the service to be processed to execute a preset authorization operation.
The electronic device may be preset with a dual-user authentication message, where the dual-user authentication message is used to prompt a second user with an authorization right of the service to be processed to execute a preset authorization operation. The preset authorization operation may be inputting a preset authorization password, or inputting a fingerprint of the second user, or clicking a preset confirmation icon.
In implementation, the electronic device may determine whether to perform dual-user authentication according to the first user identifier and/or the target service identifier, and a detailed description will be provided subsequently to a specific processing procedure.
If the dual-user authentication is determined, the electronic device may send a preset dual-user authentication message. If the dual-user authentication is determined not to be performed, the electronic device may directly provide the pending service to the first user.
In the embodiment of the application, for different users to be authorized, the dual-user authentication messages sent by the electronic device may be the same or different. As shown in fig. 2a, for a schematic diagram of a dual-user authentication message provided in the embodiment of the present application, an electronic device may send the dual-user authentication message for each user to be authorized. As shown in fig. 2b, which is a schematic diagram of another dual-user authentication message provided in the embodiment of the present application, the electronic device may determine, for each to-be-authorized user, a second user having authorization authority of the to-be-processed service, and generate a dual-user authentication message including a second user identifier of the second user.
In one possible implementation, the electronic device may send a dual-user authentication message to a user terminal of the first user, so that the first user requests the second user to perform a preset authorization operation. In another possible implementation manner, the electronic device may send the dual-user authentication message to a user terminal of the second user, so that the second user performs a preset authorization operation based on the received dual-user authentication message. When the second user is authorized, the login state of whether the second user logs in the service system is not specifically limited. The way of sending the dual-user authentication message by the electronic device is also various, for example, sending a short message and sending an email.
In implementation, the second user may perform a preset authorization operation to generate an authorization message, and send the authorization message to the electronic device, where the authorization message may carry a second user identifier of the second user and a target service identifier of the service to be processed.
Then, the electronic device may obtain an authorization message of the pending service and provide the pending service to the first user.
For example, when receiving the authorization message containing the second User identifier User2 and the target service identifier HF, the electronic device may play the surveillance video corresponding to the first service request.
In the embodiment of the application, the electronic device may obtain a first user identifier of a first user carried by a first service request and a target service identifier of a service to be processed; if the dual-user authentication is determined to be carried out according to the first user identification and/or the target service identification, sending a preset dual-user authentication message to prompt a second user with the authorization authority of the service to be processed to execute a preset authorization operation; and then, obtaining the authorization message of the service to be processed, and providing the service to be processed for the first user. As for the received first service request, after determining to perform dual-user authentication and receiving the authorization message, the service to be processed is provided for the first user, so that the authority management can be more flexible.
In a possible implementation manner, after receiving the authorization message, the electronic device may store the relevant authentication information of the secondary authentication, where the relevant authentication information includes one or more of a time of receiving the first service request, the first user identifier, the second user identifier, and the target service identifier. Therefore, the subsequent checking of the relevant authentication information is facilitated, and the history processing event of the service system is recorded and managed.
Optionally, the electronic device determines whether to perform dual-user authentication in various ways, and in a feasible implementation manner, for a user or a service that needs to perform dual-user authentication, a dual-user authentication identifier corresponding to the user identifier and/or the service identifier may be stored in advance in the electronic device. Therefore, the electronic device can determine whether to perform dual-user authentication according to whether dual-user authentication identifiers corresponding to the user identifiers and/or the service identifiers are stored locally, and the specific processing process includes: and if the dual-user authentication identification corresponding to the first user identification and/or the target service identification is locally stored, determining to perform dual-user authentication.
In implementation, after receiving the first service request, the electronic device may obtain the first user identifier and the target service identifier carried in the first service request. The electronic device may determine whether a dual-user authentication identifier corresponding to the first user identifier, or a dual-user authentication identifier corresponding to the target service identifier, or a dual-user authentication identifier corresponding to the first user identifier and the target service identifier is locally stored. If the dual-user authentication identifier is locally stored, the electronic device may determine to perform dual-user authentication; if the dual-user authentication identifier is not stored locally, the electronic device may provide pending service for the first user.
In the embodiment of the application, the electronic device may determine whether a dual-user authentication identifier corresponding to the first user identifier and/or the target service identifier is locally stored, and determine to perform dual-user authentication if the dual-user authentication identifier corresponding to the first user identifier and/or the target service identifier is locally stored. Therefore, by means of the mode of dual-user authentication identification for user and service storage, the electronic equipment can set different service processing strategies for users with different service processing requirements, and the functional diversity of service processing is convenient to improve.
Optionally, in another feasible implementation manner, the electronic device may determine whether to perform dual-user authentication according to a correspondence between the service identifier and the user identifier, where the specific processing procedure includes:
step one, judging whether a target service identifier is a service identifier corresponding to a first user identifier according to a corresponding relation between a pre-stored service identifier and the user identifier.
In implementation, the electronic device may determine, in the correspondence between the service identifier and the user identifier, a service identifier corresponding to the first user identifier, and then, the electronic device may determine whether the target service identifier is the service identifier corresponding to the first user identifier.
If the target service identifier is the service identifier corresponding to the first user identifier, the electronic device may execute step two; and if the target service identifier is not the service identifier corresponding to the first user identifier, the electronic device may execute step three.
And step two, determining to perform dual-user authentication.
And step three, providing the service to be processed for the first user.
In the embodiment of the application, the electronic device may determine whether the target service identifier is the service identifier corresponding to the first user identifier according to the corresponding relationship between the service identifier and the user identifier. If the target service identifier is not the service identifier corresponding to the first user identifier, it indicates that the first user has the authority to execute the service to be processed, and the electronic device may directly provide the service to be processed for the first user. If the target service identifier is the service identifier corresponding to the first user identifier, it indicates that the first user does not have the authority to execute the service to be processed, but only has the operation authority of the service to be processed, and the electronic device may determine to perform dual-user authentication. Therefore, by judging whether the target service identifier is the service identifier corresponding to the first user identifier, the electronic device can set different service processing strategies for users with different service processing requirements, and the functional diversity of service processing is improved conveniently.
Optionally, when the electronic device needs to process the service to be processed based on the data transmission protocol, the electronic device may determine whether the data transmission protocol to be used supports dual-user authentication before sending the dual-user authentication message, as shown in fig. 3, where the specific processing procedure includes:
The electronic device may be stored with a data transfer Protocol such as SCTP (Stream Control Transmission Protocol) and RTSP (Real Time Streaming Protocol). According to the difference of the services to be processed, the data transmission protocols required by the electronic equipment for processing the services to be processed are also different. When a certain data transmission protocol has a protocol extension function, the data transmission protocol can support dual-user authentication, the data transmission protocol is a preset data transmission protocol, for example, SCTP is the preset data transmission protocol, and RTSP is not the preset data transmission protocol.
In implementation, the electronic device may use the data transmission protocol used when the same service to be processed is processed last time as the data transmission protocol required for processing the service to be processed this time.
Or, the electronic device may also pre-store a corresponding relationship between the service identifier and a protocol identifier of the data transmission protocol, and the electronic device may use the data transmission protocol corresponding to the target service identifier in the corresponding relationship as the data transmission protocol required for processing the service to be processed.
Then, the electronic device may determine whether the data transmission protocol is a preset data transmission protocol, and if the data transmission protocol is the preset data transmission protocol, the electronic device may determine that the data transmission protocol can support performing dual-user authentication, and then the electronic device may perform step 302. If the data transmission protocol is not the preset data transmission protocol, the electronic device may determine that the data transmission protocol does not support dual-user authentication, and then the electronic device may perform step 303.
In the embodiment of the application, when the electronic device is a user terminal of a service system, since communication with a server of the service system is not involved, the electronic device does not need to process a service to be processed based on a data transmission protocol, and therefore, the electronic device does not need to execute the steps of determining whether the data transmission protocol to be used supports dual-user authentication and the like.
In the embodiment of the application, the electronic device determines a data transmission protocol required for processing the service to be processed, and then judges whether the data transmission protocol is a preset data transmission protocol or not so as to judge whether the data transmission protocol can support the dual-user authentication. And when the data transmission protocol is judged to be the preset data transmission protocol, sending a dual-user authentication message. Therefore, the electronic equipment cannot process the service to be processed based on the data transmission protocol which cannot support dual-user authentication, and the effectiveness of service processing based on the dual-user authentication mode can be ensured, so that the flexibility of authority management can be improved through the dual-user authentication mode.
Optionally, after receiving the authorization message, in order to avoid a problem that the first user needs to request authorization frequently when requesting the service to be processed for multiple times within a preset time period, an embodiment of the present application provides an implementation manner, and as shown in fig. 4, a specific processing procedure includes:
The preset authorization effective duration may be stored in the electronic device in advance, and the administrator may set a specific numerical value of the preset authorization effective duration, where the preset authorization effective duration is, for example, 100 s.
In implementation, the electronic device may delay the receiving time of the authorization message by a time after a preset authorization validity duration, as the authorization expiration time.
For example, if the receiving time of the authorization message is 8:55:00 at 14/4/2019, and the preset authorization validity duration is 100s, the electronic device may determine that the authorization expiration time is 8:56:40 at 14/4/2019.
After the electronic device provides the service to be processed for the first user, if the first user requests to process the service again, the first user may execute a preset second operation, so that the user terminal generates a second service request carrying the first user identifier and the target service identifier, and sends the second service request to the electronic device.
The electronic device may then record the time of receipt of the second service request. When the electronic device determines that the user identifier carried by the second service request is the first user identifier and the service identifier is the target service identifier, the electronic device may determine whether the receiving time of the second service request is within the authority expiration time. If the receiving time is within the permission expiration time, the electronic device may perform step 402; if the reception time is not within the rights expiration time, the electronic device may perform step 403.
For example, when the first user wants to play back another monitored video, the first user may perform a second preset operation to enable the user terminal to generate a second service request and send the second service request to the electronic device. Then, the electronic device may determine that the receiving time of the second service request is 2019, 4, month, 14, day 8:56:00, determine that the receiving time is within 2019, 4, month, 14, day 8:56:40, and then, the electronic device may provide the first user with a service to be processed, i.e., play back another monitoring video.
In a feasible implementation manner, the electronic device may obtain a processing time length required by the first user to process the service to be processed, and then the electronic device may use the receiving time of the authorization message, the time after delaying the preset authorization effective time length and the processing time length, as the authority expiration time.
For example, the first service request is to playback a surveillance video, the service to be processed is a surveillance video with a playing time of 5min, and the electronic device may use a time length required for playing back the surveillance video (i.e., the playing time length of the surveillance video) as a processing time length required for the first user to process the service to be processed. The receiving time of the authorization message is 8:55:00 at 14 months and 14 days in 2019, the preset authorization effective duration is 10s, and the electronic device can determine that the authority expiration time is 9:00:10 at 14 months and 4 months in 2019.
In the embodiment of the application, after receiving the authorization message, the electronic device may determine the authority expiration time according to the preset authorization effective duration, and provide the to-be-processed service for the first user within the authority expiration time, so as to avoid a problem that the first user needs to request authorization frequently when requesting the to-be-processed service within the preset time period. Thus, rights management can be made more flexible.
Optionally, after receiving the second service request, the electronic device may further update the right expiration time, where the specific processing procedure is as follows: and determining the updated authority expiration time according to the preset processing time and the authority expiration time of the service to be processed corresponding to the second service request.
In implementation, the electronic device may determine a preset processing duration of the to-be-processed service corresponding to the second service request, and then, the electronic device may delay the permission expiration time by the preset processing duration, and use the obtained time as the updated permission expiration time.
For example, when the second service request is to play back another monitored video, the electronic device may use a playing time length of 4min of the another monitored video as a preset processing time length of a to-be-processed service corresponding to the second service request, and then, the electronic device may delay the authority expiration time 2019 by 4, 14, 9:00:10 by 4min, and then use the delayed authority expiration time 2019 by 4, 14, 9:04:10 as an updated authority expiration time.
In this embodiment of the application, after receiving the second service request, the electronic device may update the permission due time according to the preset processing duration of the to-be-processed service corresponding to the second service request, and provide the to-be-processed service for the first user within the updated permission due time, so as to avoid a problem that the first user needs to request authorization frequently when requesting the to-be-processed service within a preset time period. Thus, rights management can be made more flexible.
An embodiment of the present application provides a specific processing procedure of a dual-user authentication method, and as shown in fig. 5, the specific processing procedure includes:
In the implementation, the specific processing procedure of this step is similar to that of step 101, and is not described herein again.
In implementation, the above-mentioned content already describes a specific process for determining to perform dual-user authentication according to the first user identifier and/or the target service identifier, and details are not repeated here. After determining that the dual-user authentication is performed, if the data transmission protocol required for processing the service to be processed is not the preset data transmission protocol, the electronic device may perform step 503, and if the data transmission protocol is the preset data transmission protocol, the electronic device may perform step 504.
In the implementation, the specific processing procedure of this step is similar to that of step 102, and is not described here again.
And 505, acquiring an authorization message of the service to be processed, and providing the service to be processed for the first user.
In the implementation, the specific processing procedure of this step is similar to that of step 103, and is not described here again.
In the implementation, the specific processing procedure of this step is similar to that of step 401, and is not described herein again.
In an implementation, if the receiving time of the received second service request is within the authority expiration time, the electronic device may perform step 505.
In an implementation, if the reception time of the second service request is not within the rights expiration time, the electronic device may perform step 504.
The dual-user authentication method provided by the embodiment of the application can acquire the first user identifier of the first user carried by the first service request and the target service identifier of the service to be processed; and if the double-user authentication is determined according to the first user identification and/or the target service identification, determining a data transmission protocol required by processing the service to be processed. If the data transmission protocol is a preset data transmission protocol, sending a preset dual-user authentication message to prompt a second user with the authorization authority of the service to be processed to execute a preset authorization operation; and then, obtaining the authorization message of the service to be processed, and providing the service to be processed for the first user. On one hand, aiming at the received first service request, after determining to perform dual-user authentication and receiving the authorization message of the second user, the service to be processed is provided for the first user, so that the authority management can be more flexible. On the other hand, the authority expiration time is determined according to the first service request, so that the problem that the first user needs to request authorization frequently when requesting the service to be processed in the preset time period is avoided, and the authority management can be more flexible.
An embodiment of the present application further provides a dual-user authentication device, as shown in fig. 6, where the device is applied to an electronic device, and the device includes:
a first obtaining module 610, configured to obtain a first user identifier of a first user carried in the first service request and a target service identifier of a service to be processed;
a first determining module 620, configured to send a preset dual-user authentication message to prompt a second user with an authorization authority of the service to be processed to execute a preset authorization operation when determining that dual-user authentication is performed according to the first user identifier and/or the target service identifier;
a providing module 630, configured to obtain an authorization message of the service to be processed, and provide the service to be processed for the first user.
Optionally, the first determining module includes:
and the first determining sub-module is configured to determine to perform dual-user authentication when the first user identifier and/or the dual-user authentication identifier corresponding to the target service identifier is locally stored.
Optionally, the first determining module includes:
the judging submodule is used for judging whether the target service identifier is the service identifier corresponding to the first user identifier according to the corresponding relation between the pre-stored service identifier and the user identifier;
and the second determining submodule is used for determining to perform dual-user authentication when the target service identifier is the service identifier corresponding to the first user identifier.
Optionally, the apparatus further comprises:
the second determining module is used for determining a data transmission protocol required by processing the service to be processed;
and the execution module is used for executing the step of sending the preset dual-user authentication message when the data transmission protocol is a preset data transmission protocol, wherein the preset data transmission protocol is a data transmission protocol with a protocol extension function.
Optionally, the apparatus further comprises:
a third determining module, configured to determine an authority expiration time according to the receiving time of the authorization message and a preset authorization effective duration;
the providing module is further configured to provide the to-be-processed service for the first user when the receiving time of the received second service request is within the permission expiration time, where the second service request carries the first user identifier and the target service identifier, and the receiving time of the second service request is later than the receiving time of the first service request;
and the execution module is further used for executing the step of sending the preset dual-user authentication message when the receiving time of the second service request is not within the authority expiration time.
Optionally, if the receiving time of the received second service request is within the permission expiration time, the apparatus further includes:
and the fourth determining module is used for determining the updated authority expiration time according to the preset processing time of the service to be processed corresponding to the second service request and the authority expiration time.
Optionally, the apparatus further comprises:
the second obtaining module is used for obtaining the user identifier and the service identifier carried by the configuration request;
and the establishing module is used for establishing the corresponding relation between the service identification and the user identification according to the user identification and the service identification.
The dual-user authentication device provided by the embodiment of the application can acquire the first user identifier of the first user carried by the first service request and the target service identifier of the service to be processed; if the dual-user authentication is determined to be carried out according to the first user identification and/or the target service identification, sending a preset dual-user authentication message to prompt a second user with the authorization authority of the service to be processed to execute a preset authorization operation; and then, obtaining the authorization message of the service to be processed, and providing the service to be processed for the first user. As for the received first service request, after determining to perform dual-user authentication and receiving the authorization message of the second user, the service to be processed is provided for the first user, so that the authority management can be more flexible.
The embodiment of the present application further provides an electronic device, as shown in fig. 7, which includes a processor 701, a communication interface 702, a memory 703 and a communication bus 704, where the processor 701, the communication interface 702, and the memory 703 complete mutual communication through the communication bus 704,
a memory 703 for storing a computer program;
the processor 701 is configured to implement the following steps when executing the program stored in the memory 703:
acquiring a first user identifier of a first user carried by a first service request and a target service identifier of a service to be processed;
if the dual-user authentication is determined to be carried out according to the first user identification and/or the target service identification, sending a preset dual-user authentication message to prompt a second user with the authorization authority of the service to be processed to execute a preset authorization operation;
and obtaining the authorization message of the service to be processed, and providing the service to be processed for the first user.
Optionally, the determining to perform dual-user authentication includes:
and if the first user identification and/or the double user authentication identification corresponding to the target service identification are/is locally stored, determining to perform double user authentication.
Optionally, the determining to perform dual-user authentication includes:
judging whether the target service identifier is a service identifier corresponding to the first user identifier or not according to a corresponding relation between a pre-stored service identifier and a user identifier;
and if the target service identification is the service identification corresponding to the first user identification, determining to perform dual-user authentication.
Optionally, before sending the preset dual-user authentication message, the method further includes:
determining a data transmission protocol required for processing the service to be processed;
and if the data transmission protocol is a preset data transmission protocol, executing the step of sending a preset dual-user authentication message, wherein the preset data transmission protocol is a data transmission protocol with a protocol extension function.
Optionally, after obtaining the authorization message of the service to be processed, the method further includes:
determining the authority expiration time according to the receiving time of the authorization message and the preset authorization effective duration;
if the receiving time of the received second service request is within the authority expiration time, providing the service to be processed for the first user, wherein the second service request carries the first user identifier and the target service identifier, and the receiving time of the second service request is later than that of the first service request;
and if the receiving time of the second service request is not within the authority expiration time, executing a step of sending a preset dual-user authentication message.
Optionally, if the receiving time of the received second service request is within the permission expiration time, the method further includes:
and determining the updated authority expiration time according to the preset processing time of the to-be-processed service corresponding to the second service request and the authority expiration time.
Optionally, before the obtaining of the first user identifier of the first user carried in the first service request and the target service identifier of the service to be processed, the method further includes:
acquiring a user identifier and a service identifier carried by a configuration request;
and establishing a corresponding relation between the service identification and the user identification according to the user identification and the service identification.
The communication bus mentioned in the electronic device may be a Peripheral Component Interconnect (PCI) bus, an Extended Industry Standard Architecture (EISA) bus, or the like. The communication bus may be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, only one thick line is shown, but this does not mean that there is only one bus or one type of bus.
The communication interface is used for communication between the electronic equipment and other equipment.
The Memory may include a Random Access Memory (RAM) or a Non-Volatile Memory (NVM), such as at least one disk Memory. Optionally, the memory may also be at least one memory device located remotely from the processor.
The Processor may be a general-purpose Processor, including a Central Processing Unit (CPU), a Network Processor (NP), and the like; but also Digital Signal Processors (DSPs), Application Specific Integrated Circuits (ASICs), Field Programmable Gate Arrays (FPGAs) or other Programmable logic devices, discrete Gate or transistor logic devices, discrete hardware components.
The electronic device provided by the embodiment of the application can acquire the first user identifier of the first user carried by the first service request and the target service identifier of the service to be processed; if the dual-user authentication is determined to be carried out according to the first user identification and/or the target service identification, sending a preset dual-user authentication message to prompt a second user with the authorization authority of the service to be processed to execute a preset authorization operation; and then, obtaining the authorization message of the service to be processed, and providing the service to be processed for the first user. As for the received first service request, after determining to perform dual-user authentication and receiving the authorization message of the second user, the service to be processed is provided for the first user, so that the authority management can be more flexible.
In yet another embodiment provided herein, there is also provided a computer readable storage medium having stored therein a computer program which, when executed by a processor, implements the steps of any of the above-described dual-user authentication methods.
In yet another embodiment provided herein, there is also provided a computer program product containing instructions that, when run on a computer, cause the computer to perform any of the above-described embodiments of dual-user authentication methods.
In the above embodiments, the implementation may be wholly or partially realized by software, hardware, firmware, or any combination thereof. When implemented in software, may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When loaded and executed on a computer, cause the processes or functions described in accordance with the embodiments of the application to occur, in whole or in part. The computer may be a general purpose computer, a special purpose computer, a network of computers, or other programmable device. The computer instructions may be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another, for example, from one website site, computer, server, or data center to another website site, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, Digital Subscriber Line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device, such as a server, a data center, etc., that incorporates one or more of the available media. The usable medium may be a magnetic medium (e.g., floppy Disk, hard Disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., Solid State Disk (SSD)), among others.
It is noted that, herein, relational terms such as first and second, and the like may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Also, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other identical elements in a process, method, article, or apparatus that comprises the element.
All the embodiments in the present specification are described in a related manner, and the same and similar parts among the embodiments may be referred to each other, and each embodiment focuses on the differences from the other embodiments. In particular, as for the apparatus embodiment, since it is substantially similar to the method embodiment, the description is relatively simple, and for the relevant points, reference may be made to the partial description of the method embodiment.
The above description is only for the preferred embodiment of the present application, and is not intended to limit the scope of the present application. Any modification, equivalent replacement, improvement and the like made within the spirit and principle of the present application are included in the protection scope of the present application.
Claims (10)
1. A dual-user authentication method, applied to an electronic device, the method comprising:
acquiring a first user identifier of a first user carried by a first service request and a target service identifier of a service to be processed;
if the dual-user authentication is determined to be carried out according to the first user identification and/or the target service identification, sending a preset dual-user authentication message to prompt a second user with the authorization authority of the service to be processed to execute a preset authorization operation;
and obtaining the authorization message of the service to be processed, and providing the service to be processed for the first user.
2. The method of claim 1, wherein determining a manner of dual user authentication comprises:
and if the first user identification and/or the double user authentication identification corresponding to the target service identification are/is locally stored, determining to perform double user authentication.
3. The method of claim 1, wherein determining a manner of dual user authentication comprises:
judging whether the target service identifier is a service identifier corresponding to the first user identifier or not according to a corresponding relation between a pre-stored service identifier and a user identifier;
and if the target service identification is the service identification corresponding to the first user identification, determining to perform dual-user authentication.
4. The method of claim 1, wherein before sending the pre-set dual-user authentication message, further comprising:
determining a data transmission protocol required for processing the service to be processed;
and if the data transmission protocol is a preset data transmission protocol, executing the step of sending the preset dual-user authentication message, wherein the preset data transmission protocol is a data transmission protocol with a protocol extension function.
5. The method according to any one of claims 1 to 4, wherein after the obtaining the authorization message of the pending service, the method further comprises:
determining the authority expiration time according to the receiving time of the authorization message and the preset authorization effective duration;
if the receiving time of the received second service request is within the authority expiration time, providing the service to be processed for the first user, wherein the second service request carries the first user identifier and the target service identifier, and the receiving time of the second service request is later than that of the first service request;
and if the receiving time of the second service request is not within the authority expiration time, executing the step of sending the preset dual-user authentication message.
6. The method of claim 5, wherein if the receiving time of the received second service request is within the rights expiration time, the method further comprises:
and determining the updated authority expiration time according to the preset processing time of the to-be-processed service corresponding to the second service request and the authority expiration time.
7. The method according to claim 3, wherein before the obtaining of the first user identifier of the first user carried in the first service request and the target service identifier of the service to be processed, the method further comprises:
acquiring a user identifier and a service identifier carried by a configuration request;
and establishing a corresponding relation between the service identification and the user identification according to the user identification and the service identification.
8. A dual-user authentication apparatus, applied to an electronic device, the apparatus comprising:
the first obtaining module is used for obtaining a first user identifier of a first user carried by the first service request and a target service identifier of a service to be processed;
the first determining module is used for sending a preset double-user authentication message to prompt a second user with the authorization authority of the service to be processed to execute preset authorization operation when double-user authentication is determined according to the first user identification and/or the target service identification;
and the providing module is used for obtaining the authorization message of the service to be processed and providing the service to be processed for the first user.
9. An electronic device is characterized by comprising a processor, a communication interface, a memory and a communication bus, wherein the processor and the communication interface are used for realizing mutual communication by the memory through the communication bus;
a memory for storing a computer program;
a processor for implementing the method steps of any of claims 1 to 7 when executing a program stored in the memory.
10. A computer-readable storage medium, characterized in that a computer program is stored in the computer-readable storage medium, which computer program, when being executed by a processor, carries out the method steps of any one of claims 1 to 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910473118.9A CN112016065B (en) | 2019-05-31 | 2019-05-31 | Dual-user authentication method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910473118.9A CN112016065B (en) | 2019-05-31 | 2019-05-31 | Dual-user authentication method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN112016065A true CN112016065A (en) | 2020-12-01 |
| CN112016065B CN112016065B (en) | 2023-10-10 |
Family
ID=73506358
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910473118.9A Active CN112016065B (en) | 2019-05-31 | 2019-05-31 | Dual-user authentication method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112016065B (en) |
Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20130174223A1 (en) * | 2011-12-30 | 2013-07-04 | United Video Properties, Inc. | Systems and methods for temporary assignment and exchange of digital access rights |
| US20150371031A1 (en) * | 2014-06-23 | 2015-12-24 | Fujitsu Limited | Method, system, and authentication device |
| CN105930693A (en) * | 2016-04-29 | 2016-09-07 | 杭州华三通信技术有限公司 | Software authorization method and apparatus |
| US20180018451A1 (en) * | 2016-07-14 | 2018-01-18 | Magic Leap, Inc. | Deep neural network for iris identification |
| US9923927B1 (en) * | 2015-09-29 | 2018-03-20 | Amazon Technologies, Inc. | Methods and systems for enabling access control based on credential properties |
| US10007779B1 (en) * | 2015-09-29 | 2018-06-26 | Amazon Technologies, Inc. | Methods and systems for gradual expiration of credentials |
| CN109033774A (en) * | 2018-08-31 | 2018-12-18 | 阿里巴巴集团控股有限公司 | Acquisition, the method, apparatus of feedback user resource and electronic equipment |
| CN109117658A (en) * | 2018-08-28 | 2019-01-01 | 深圳市鼎昇贸易有限公司 | The right management method and Related product of inventory |
-
2019
- 2019-05-31 CN CN201910473118.9A patent/CN112016065B/en active Active
Patent Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20130174223A1 (en) * | 2011-12-30 | 2013-07-04 | United Video Properties, Inc. | Systems and methods for temporary assignment and exchange of digital access rights |
| US20150371031A1 (en) * | 2014-06-23 | 2015-12-24 | Fujitsu Limited | Method, system, and authentication device |
| US9923927B1 (en) * | 2015-09-29 | 2018-03-20 | Amazon Technologies, Inc. | Methods and systems for enabling access control based on credential properties |
| US10007779B1 (en) * | 2015-09-29 | 2018-06-26 | Amazon Technologies, Inc. | Methods and systems for gradual expiration of credentials |
| CN105930693A (en) * | 2016-04-29 | 2016-09-07 | 杭州华三通信技术有限公司 | Software authorization method and apparatus |
| US20180018451A1 (en) * | 2016-07-14 | 2018-01-18 | Magic Leap, Inc. | Deep neural network for iris identification |
| CN109117658A (en) * | 2018-08-28 | 2019-01-01 | 深圳市鼎昇贸易有限公司 | The right management method and Related product of inventory |
| CN109033774A (en) * | 2018-08-31 | 2018-12-18 | 阿里巴巴集团控股有限公司 | Acquisition, the method, apparatus of feedback user resource and electronic equipment |
Also Published As
| Publication number | Publication date |
|---|---|
| CN112016065B (en) | 2023-10-10 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US11627198B2 (en) | Resource access based on supervisory-subordinate relationship | |
| US10038723B2 (en) | Method and apparatus for reliable token revocation | |
| US8561172B2 (en) | System and method for virtual information cards | |
| US9336378B2 (en) | Credential sharing | |
| US9374372B2 (en) | Systems and methods for profiling client devices | |
| US10542044B2 (en) | Authentication incident detection and management | |
| CN111666539B (en) | Real estate resource management method, device, server and storage medium | |
| CN108289074B (en) | User account login method and device | |
| CN110838971B (en) | Message sending method and device, electronic equipment and storage medium | |
| GB2548441B (en) | Automatically determining restored availability of multi-channel media distributors for authentication or authorization | |
| CN113761498A (en) | Third party login information hosting method, system, equipment and storage medium | |
| US11403091B1 (en) | Application healthcheck communicator | |
| CN110351719B (en) | Wireless network management method, system, electronic equipment and storage medium | |
| CN112016065B (en) | Dual-user authentication method and device | |
| KR20170014532A (en) | METHOD AND HOME IoT SERVICE SYSTEM FOR SETTING USER AUTHORITY | |
| CN110048864B (en) | Method and apparatus for authenticating an administrator of a device-specific message group | |
| US20150381622A1 (en) | Authentication system, authentication method, authentication apparatus, and recording medium | |
| CN112685778A (en) | Data storage method and device | |
| US9900639B2 (en) | Temporary viewer access to videos from programmers while multichannel video programming distributors are unavailable for authentication and authorization | |
| CN112162923A (en) | Interface testing method and device | |
| KR101757202B1 (en) | Method for managing a password of image information processing apparatus, and computer readable recording medium applying the same | |
| CN112506896A (en) | Data deleting method and device and electronic equipment | |
| JP5064126B2 (en) | Server system that controls the services used | |
| CN113765766B (en) | Session control method, device and equipment of virtual private network | |
| CN115022694B (en) | Screen time statistics method, device, system, background server and medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |