TW201701181A - Cloud service authentication method verifying the electronic apparatus is successfully authenticated or not on the basis of the authority authentication result - Google Patents

Abstract

Disclosed is a cloud service authentication and access method, including the following steps: (A) upon receiving authentication data which comes from an electronic apparatus and includes apparatus data, an Internet address corresponding to a first authenticating end and account data, a server transmitting the account data to the first authentication end; (B) upon receiving reference account data from the first authenticating end, the server generating an account authentication result on the basis of the account data and the reference account data and transmitting the account authentication result and the apparatus data to the second authenticating end; and (C) upon receiving an authority authentication result from the second authenticating end, the server verifying if the electronic apparatus is successfully authenticated or not on the basis of the authority authentication result.

Description

Cloud service authentication and access method

The present invention relates to a method for providing a cloud service, and more particularly to a method for authenticating and accessing a cloud service.

Enterprise Resource Planning (ERP) system refers to a management platform based on information technology, with systematic management ideas, and providing decision-making operational means for enterprise decision-making layers and employees. Enterprise resource planning is also an important tool for implementing enterprise process reengineering. 80% of the world's top 500 companies use ERP software as their decision-making tool and manage their daily workflow.

However, for SMEs, the cost of establishing an ERP system to manage their day-to-day workflow is very high. As of the end of 2011, there were about 1.28 million SMEs in Taiwan, and there were about 10.8 million employees. Due to the limited operating costs, there is a general lack of information technology research and development energy.

Therefore, how to extend the scope of existing ERP services to the cloud architecture to help small and medium-sized enterprises or small enterprises to use electronic resources in an unlimited manner and to make traditional ERP services enter the mobile and cloud era becomes an important issue. However, at present, small and medium-sized enterprises or micro-enterprises are still worried about the security of enterprise data stored in the cloud, so how to create on the Internet A safe, fast and reliable data circulation environment is also valued by small and medium-sized enterprises.

Accordingly, it is an object of the present invention to provide an authentication and access method for a cloud service that enhances data security through network authentication.

Therefore, the authentication and access method of the cloud service of the present invention is implemented by a server, and the server is connected to at least one electronic device, a first authentication terminal and a second authentication terminal via a network, and the cloud service is The authentication and access method includes the following steps: (A) receiving, by the server, an information from the electronic device and including device information related to the electronic device, and an internet address corresponding to the first authentication end And the account information is transmitted to the first authentication end; (B) by the server, when receiving the reference account information from the first authentication end, according to the account information and the Referring to the account information, generating an account authentication result, and transmitting the account authentication result and the device data to the second authentication end; and (C) receiving, by the server, a second authentication end, and receiving The second authentication end is generated according to the account authentication result, the device data, and a lookup table of the reference device data pre-stored in the first authentication end and the usage authority data corresponding to the reference device data. When the permission authentication result, according to the permission authentication result, the electronic device determines whether the authentication is successful.

The effect of the present invention is that the server transmits the same The account information and the device information are sent to the first authentication terminal and the second authentication terminal to perform authentication of the account data and the device data, thereby confirming the validity of the electronic device that accesses the cloud service by using the server.

1‧‧‧Cloud Service System

11‧‧‧Electronic devices

12‧‧‧First authentication end

13‧‧‧Second authentication end

14‧‧‧ server

15‧‧‧ Recording end

16‧‧‧Management

100‧‧‧Network

201~208‧‧‧Steps

301~311‧‧‧Steps

401~423‧‧‧Steps

Other features and effects of the present invention will be apparent from the embodiments of the present invention. FIG. 1 is a block diagram illustrating a cloud service system for implementing the authentication and access method of the cloud service of the present invention; Is a flowchart illustrating a registration procedure of an embodiment of the authentication and access method of the cloud service of the present invention; and FIG. 3 is a flowchart illustrating a management procedure of an embodiment of the authentication and access method of the cloud service of the present invention; 4 is a flow chart showing whether the number of determination links in a service data access procedure of an embodiment of the authentication and access method of the cloud service of the present invention is greater than a predetermined number of detailed processes; FIG. 5 is a flowchart A detailed flow of generating a privilege authentication result in a service data access procedure of an embodiment of the authentication and access method of the cloud service of the present invention; FIG. 6 is a flowchart illustrating the authentication and access of the cloud service of the present invention; a detailed process of determining whether an electronic device is successfully authenticated in a service data access program of an embodiment of the method; and FIG. 7 is a schematic diagram illustrating a service link page .

Referring to FIG. 1, an embodiment of a method for authenticating and accessing a cloud service of the present invention is implemented by a cloud service system 1. The cloud service system 1 includes a plurality of electronic devices 11 connected to a network 100, a first authentication terminal 12 storing service data, a second authentication terminal 13, a server 14, a recording terminal 15, and a management device. End 16.

In this embodiment, the implementation of the electronic device 11 is, for example, a portable electronic device 11 such as a tablet computer, a notebook computer, or a smart phone. In addition, each electronic device 11 cooperates with an application that includes a plurality of instructions to implement the authentication and access method of the cloud service of the present invention.

It is worth mentioning that there is a cooperative relationship between a service provider of the server 14 and a data provider of the first authentication terminal 12.

The embodiments of the authentication and access method of the cloud service of the present invention and the operation details of each component in the cloud service system 1 are described below, and the steps are summarized into a registration procedure, a management procedure, and A service data access program.

Referring to FIG. 1 and FIG. 2, before a plurality of users want to use the electronic device 11 to access the cloud service provided by the server 14 respectively, it is necessary to register the device information of each electronic device 11 first, which is worth one. It is mentioned that the registration procedure performed by each electronic device 11 is the same, so only one electronic device 11 will be described below, and the registration procedure includes the following steps.

In step 201, the electronic device 11 generates an Internet (Internet Protocol) corresponding to the first authentication terminal 12, including the device data associated with the electronic device 11 in response to execution of the application. , referred to as the IP address, and the registration data corresponding to the account information of the first authentication terminal 12, and the registration data is transmitted to the server 14 via the network 100. In this embodiment, the device data includes a machine code of the electronic device 11 and a code generated by the application executed by the electronic device 11.

In step 202, the server 14 transmits the account data to the first authentication terminal 12 when receiving the registration data from the electronic device 11.

In step 203, the first authentication terminal 12 transmits the reference account data pre-stored in the first authentication terminal 12 to the server 14 via the network 100 when receiving the account information.

In step 204, when receiving the reference account data, the server 14 generates an account determination result according to the account information and the reference account data, and transmits the account determination result and the device data to the device 100 via the network 100. The second authentication terminal 13. The server 14 generates the account determination result by comparing whether the account data matches the reference account data.

In step 205, the second authenticating end 13 determines whether to store the device data in a lookup table based on the account determination result. When the determination result is YES, that is, the account determination result indicates that the account data authentication is successful, step 206 is performed. When the determination result is no, that is, the account determination result indicates that the account data authentication has failed, step 207 is performed.

In step 206, the second authentication end 13 stores the device data in the lookup table, and regards the device data stored in the lookup table as the reference device data, and transmits an indication via the network 100. registered A successful registration message to the server 14.

In step 207, the second authentication terminal 13 transmits a registration message indicating registration failure to the server 14 via the network 100.

In step 208, the server 14 transmits the registration message to the electronic device 11 via the network 100 upon receiving the registration message.

Referring to FIG. 1 and FIG. 3, after the electronic device 11 successfully completes the registration process, that is, after the electronic device 11 receives the registration message indicating that the registration is successful, an administrator can use the management terminal 16 to manage the electronic device. 11 Use rights to multiple service links that provide different service materials. The management program includes the following steps.

In step 301, the management terminal 16 transmits the IP address and login data corresponding to the first authentication terminal 12 to the server 14 via the network 100.

In step 302, the server 14 transmits the login data to the first authentication terminal 12 when receiving the IP address and the login data from the management terminal 16.

In step 303, the first authentication end 12 transmits the reference login data pre-stored to the first authentication terminal 12 to the server 14 via the network 100 when receiving the login data.

In step 304, the server 14 compares the login data with the reference login data when receiving the reference login data. When the comparison result is YES, proceed to step 305, and when the comparison result is no, proceed to step 306.

In step 305, the server 14 transmits a management webpage to The management terminal 16 is such that the management web page is displayed on the management terminal 16.

In step 306, the server 14 notifies the management terminal 16 that the login has failed.

In step 307, the server 14 transmits the login data to the record terminal 15.

In step 308, the recording terminal 15 records the login data and a current time when receiving the login data.

In step 309, the management terminal 16 transmits the usage authority data corresponding to the reference device data to the server 14 via the network 100, and the usage authority data includes the reference device data to provide different service materials. Access to the service link.

In step 310, the server 14 transmits the usage authority data to the second authentication terminal 13 when receiving the usage authority data.

In step 311, the second authentication end 13 stores the usage authority data corresponding to the reference device data in the lookup table when receiving the usage authority data.

It is to be noted that, in this embodiment, before the management program is completed, the usage permission data stored in the lookup table corresponding to the reference device data is preset to be inaccessible to the service links. The state of one. In addition, the data provider can serve as the administrator to manage the usage authority data corresponding to the reference device data of the electronic device 11, thereby enabling authorization setting for the specific electronic device 11, thereby achieving limitation of the specific electronic device 11 Take the needs of these service links.

Referring to Figures 1, 4, 5 and 6, when the user wants to benefit When the service data is accessed by the electronic device 11, the service data access program includes the following steps.

In step 401, the electronic device 11 generates, in response to the execution of the application, the device information including the device and the electronic device 11, the internet address corresponding to the first authentication terminal 12, and the account data. The authentication data is transmitted to the server 14 via the network 100.

In step 402, the server 14 determines whether the number of the electronic devices 11 currently connected to the first authentication terminal 12 is equal to a predetermined number when receiving the authentication data. When the determination result is YES, step 403 is performed, and when the determination result is no, step 404 is performed.

In step 403, the server 14 notifies the electronic device 11 that the service data cannot be accessed at present. In this embodiment, the server 14 can transmit a notification message indicating that the number of the electronic devices 11 that currently use the server 14 to access the service data of the first authentication terminal 12 has reached a limit to the electronic device. 11. Thereby, the number of electronic devices 11 that utilize the server 14 to access the service data of the first authentication terminal 12 can be effectively controlled.

In step 404, the server 14 transmits the account information to the first authentication terminal 12.

In step 405, the server 14 transmits the authentication material to the record terminal 15.

In step 406, the recording terminal 15 records the authentication data and a current time when receiving the authentication data.

In step 407, the first authentication terminal 12 transmits the reference account data pre-stored in the first authentication terminal 12 and the permission data corresponding to the reference account data via the network 100 when receiving the account information. To the server 14.

In step 408, the server 14 generates an account authentication result according to the account information and the reference account data when receiving the reference account information and the authority data corresponding to the reference account data, and the account authentication result and The device data is transmitted to the second authentication terminal 13 via the network 100. The server 14 generates the account authentication result by comparing whether the account data matches the reference account data.

In step 409, the second authentication end 13 determines whether the account information is successfully authenticated according to the account authentication result. When the determination result is YES, step 410 is performed, and when the determination result is no, step 411 is performed.

In step 410, the second authenticating end 13 determines whether the device data matches the reference device data according to the device data and the lookup table. When the determination result is yes, step 412 is performed, and when the determination result is no, Go to step 413.

In step 411, the second authenticating end 13 generates a rights authentication result indicating that the account data authentication failed according to the account authentication result, and transmits the rights authentication result to the server 14.

In step 412, the second authenticating end 13 compares the usage authority data of the matched reference device data with the lookup table according to the matched reference device data.

In step 413, the second authentication terminal 13 generates an indication The device authentication fails the authentication result of the authorization, and transmits the authorization authentication result to the server 14.

In step 414, the second authentication end 13 generates a rights authentication result including the usage rights data according to the used permission data in step 412, and transmits the rights authentication result to the server 14.

In step 415, when the server 14 receives the authorization authentication result, the server 14 determines whether the electronic device 11 is successfully authenticated according to the authority authentication result. When the determination result is YES, step 416 is performed, and when the determination result is no, step 417 is performed.

In step 416, the service terminal 14 transmits a service link webpage to the electronic device 11 based on the usage rights data, so that the service link webpage is displayed on the electronic device 11, wherein the service link webpage includes the service links. At least one of them. It is worth mentioning that when the device information has access to each of the service links, the service link page contains all of the service links, and the device information is linked to the service. When a part has access rights, the service link page contains the service link of the part. In the present embodiment, the service links are displayed on the service link webpage (see FIG. 7) in a button-like manner, and the service links include a customer query link for providing customer information, and Provide a quotation link for product price information, a service link for providing service station information, a contact link for providing contact information, an order inquiry link for providing order information, and one for providing a visit Record the visit record of the data, one is used to provide product inventory ERP service links for providing ERP service information, such as inventory checklists of data, and product inquiry links for providing product information.

In step 417, the server 14 generates an authentication message indicating that the account data authentication failed according to the authority authentication result, and transmits the authentication message to the electronic device 11.

In step 418, the electronic device 11 generates a link request related to the service connection in response to execution of the application, and transmits the link request to the server 14 via the network 100.

In step 419, when receiving the connection request, the server 14 determines whether to transmit a service link corresponding to the service link according to the account information and the permission data corresponding to the reference account data received in step 408. The information of the service material provided is requested to the first authentication terminal 12. When the determination result is YES, step 420 is performed, and when the determination result is NO, step 421 is performed.

In step 420, the server 14 transmits the data request to the first authentication terminal 12.

In step 421, the server 14 transmits, via the network 100, an insufficient authority message indicating that the account information does not have access rights to the service data to the electronic device 11.

In step 422, the first authentication terminal 12 transmits the service data corresponding to the data request to the server 14 via the network 100 upon receiving the data request.

In step 423, the server 14 transmits a service containing the service data when receiving the service data from the first authentication terminal 12. The service webpage is to the electronic device 11, so that the service profile webpage is displayed on the electronic device 11.

It is to be noted that, in this embodiment, the service data webpage only has access rights to the service link of the service data of the device information of the electronic device 11, and at the same time, the account data of the service data of the service data is also When the user has access rights, the first authentication terminal 12 for providing the service data can also control the access rights of the service data for different account materials. However, in other embodiments of the present invention, the service data webpage may be transmitted to the electronic device 11 when the device data of the electronic device 11 has access rights to the service link of the service data. In step 407, the first authentication terminal 12 does not transmit the authority data corresponding to the reference account data to the server 14, and steps 419 and 421 are not executed.

In addition, in the present embodiment, the server 14 is configured to provide the service link webpage and the service profile webpage corresponding to different service links, such as a customer profile inquiry webpage, a product quotation inquiry webpage, a repair service webpage, a contact inquiry webpage, an order inquiry webpage, a visit record inquiry webpage, a stock inventory webpage, and a product information inquiry webpage, and the like, but the service data included in each service material webpage is the first The authentication terminal 12 provides its own. Therefore, the data provider is only responsible for the maintenance and management of the service data. Instead of setting up and maintaining the website itself, the web page providing the service information is entrusted to the service provider for establishment and maintenance.

In this embodiment, the server 14 is a cloud server. 14. It can provide the same service link page and, for example, the same customer information inquiry page, the same product quotation inquiry page, the same repair service page, the same contact person inquiry page, the same order inquiry page, the same visit record inquiry page, the same inventory count The same service data page, such as the webpage and the same product data query page, is used by a number of different data providers. The same service link page displays different service links for different data providers' visual data providers. The same service data page The included service data is provided by the first authentication terminal 12 built by different data providers. In addition, in other embodiments of the present invention, the functions provided by the service link webpage and the service profile webpages may also be implemented using an Android programming language, and when the functions are implemented by using the Android programming language, the service link webpage is That is, a service link form, each of the service material pages is a service data form. The functions provided by the Android programming language for implementing the service link web page and the service material web pages are known to those skilled in the art, and their details are omitted here.

In summary, the server 14 provides the service link webpage and the service profile webpages, so that the first authentication terminal 12 only needs to manage and maintain the service profile, thereby greatly reducing the profile provider. The cost of establishing and maintaining the webpage is further managed by the management terminal 16 and the first authentication terminal 12, respectively, and is not managed by the server 14, whereby the data is managed. The provider can more conveniently perform the usage permission data and the control of the permission data, and further, in order to respond to the employee's use of the personal electronic device 11 (bring your own device, referred to as BYOD), by the second Authentication terminal 13 for the device The data is authenticated to determine whether the electronic device 11 can access the service data, thereby improving the security of the service data, and further authenticating the account data by the first authentication terminal 12, thereby authenticating The user's identity is used to achieve the effect of the two-factor authentication. In addition, the server 14 can control the number of the electronic devices 11 that access the service data provided by the first authentication terminal 12, and the larger the preset number, That is, on behalf of the service provider, the more electronic devices 11 can use the server 14 to access the service data of the first authentication terminal 12 at the same time, so that the object of the present invention can be achieved.

However, the above is only the embodiment of the present invention, and the scope of the present invention is not limited thereto, that is, the simple equivalent changes and modifications made by the patent application scope and the patent specification of the present invention are still It is within the scope of the patent of the present invention.

415~423‧‧‧Steps

Claims (10)

A method for authenticating and accessing a cloud service is implemented by a server, and the server is connected to at least one electronic device, a first authentication terminal and a second authentication terminal via a network, and the cloud service is authenticated and The access method includes the following steps: (A) receiving, by the server, an information from the electronic device, including device information related to the electronic device, an internet address corresponding to the first authentication end, and The account information is transmitted to the first authentication end; (B) by the server, when receiving the reference account information from the first authentication end, according to the account information and the reference account Generating an account authentication result, and transmitting the account authentication result and the device data to the second authentication end; and (C) receiving, by the server, a second authentication terminal from the server a permission generated by the authentication end according to the account authentication result, the device data, and the lookup table of the reference device data pre-stored in the second authentication terminal and the usage authority data corresponding to the reference device data When the authentication result, according to the results of the certification authority to determine whether the electronic device authentication is successful. The authentication and access method of the cloud service according to claim 1, wherein the server is connected to the plurality of electronic devices via the network, wherein the step (A) includes the following substeps: (A-1) The server determines, when receiving the authentication data, whether the number of electronic devices currently connected to the first authentication end is greater than And equal to a preset quantity; and (A-2), when the determination result is no, the account information is transmitted to the first authentication end by the server. The authentication and access method of the cloud service according to claim 1, wherein in the step (C), the authority authentication result is determined by the second authentication terminal to determine whether the account data is authenticated according to the account authentication result. If the result of the determination is YES, the usage authority data corresponding to the device data is compared according to the device data and the lookup table, and generated according to the usage authority data. The method for authenticating and accessing the cloud service according to claim 3, after step (C), further comprising a step (D), when the determination result is yes, by the server, according to the authority authentication result, Transmitting a service link webpage to the electronic device such that the service link webpage is displayed on the electronic device, wherein the rights authentication result includes access rights of the device profile to a plurality of service links providing different service materials, the service The link page contains at least one of the service links. The method for authenticating and accessing the cloud service according to claim 4, wherein in step (D), the service data is provided by the first authentication end, and after step (D), further comprising a step (E) When the server receives a connection request from the electronic device and is associated with the service connection, the server transmits a service data page including the service data corresponding to the service connection to the connection request to the server to The electronic device is such that the service material web page is displayed on the electronic device. The method for authenticating and accessing the cloud service according to claim 5, wherein Step (E) includes the following sub-steps: (E-1) when the server receives the connection request from the electronic device and is associated with the service connection, by the server transmitting a corresponding connection to the service connection The service data is requested to be sent to the first authentication end; and (E-2), when receiving the service data from the first authentication terminal, by the server, transmitting the service data webpage including the service data to the Electronic device. The method for authenticating and accessing the cloud service according to claim 5, wherein in step (B), the server further receives the authority data corresponding to the reference account data from the first authentication terminal, and the step (E) comprising the following sub-steps: (E-1) when the server receives the connection request from the electronic device and is related to the service connection, the server determines, according to the account information and the permission data, Whether to transmit a data request corresponding to the service data provided by the service link to the first authentication end; (E-2) when the determination result is yes, the server transmits the data request to the first authentication And (E-2), when receiving the service data corresponding to the data request from the first authentication end, transmitting, by the server, the service data webpage including the service data to the electronic device. The method for authenticating and accessing the cloud service according to claim 1, wherein the server is further connected to a record terminal via the network, and after the step (A), further comprising a step (F) by using the service End, send the certification data to At the recording end, the authentication data enables the recording terminal to record the authentication data and a current time. The method for authenticating and accessing the cloud service according to claim 1 further comprises, after the step (A), the following steps: (G) receiving, by the server, the electronic device, and including the related Transmitting the account data to the first authentication end with the device data of the electronic device, the Internet address corresponding to the first authentication end, and the registration data of the account information; and (H) The server, when receiving the reference account data from the first authentication end, generates an account determination result according to the account information and the reference account data, and transmits the account determination result and the device data to the second authentication end The account determination result enables the second authenticating end to determine whether to store the device data in the lookup table. When the determination result is yes, the device data is stored in the lookup table as the reference device data. The method for authenticating and accessing the cloud service according to claim 9, wherein the server is further connected to a management terminal via the network, and between the step (H) and the step (A), the following steps are further included: I), by the server, transmitting the usage right data to the second authentication end when receiving the usage permission data from the management terminal and corresponding to the reference device data, the usage permission data making the first The second authentication end can store the usage authority data corresponding to the reference device data in the lookup table.