ISAPI access control system for Session ID fully transparent transmission

Abstract

The present invention relates to ISAPI access control system with Session full transparent transfer, which can realize user Session maintenance and SessionID transfer without involving, modifying and using Cookie in Web system, and provides user identity identification and visiting control function for Web application on IIS server. It includes four components: ISAPI accessing control filter, Session maintenance engines, authorization decision engines, and identity and authority management system. The present invention resolves referred key technology problem about ISAPI visiting URL chaining adding SessionID information in control filter rewrite respond message successfully, such as transfering related information between filter call-back function, correctly modifying length indication in respond message data block, etc.

Description

technical field [0001] The invention belongs to the technical field of network information security, and is an access control system based on an ISAPI filter, which provides access control functions for Web applications deployed on IIS servers in a manner transparent to Web application systems, especially in The transparent transmission of Session ID is realized without relying on the web system (web container or web application) and without using cookies. Background technique [0002] For many Web application service systems deployed on the Internet, user authentication (Authentication) and access control (Access Control) are essential security functions. Identity authentication, that is, knowing who the other party is, confirming that the other party is the person (or entity) it claims; and access control, that is, deciding whether to allow the user to access a certain resource and perform related operations online according to the user's authority and access control polic...

AI Technical Summary

Problems solved by technology

[0004] (1) The modification workload may be very large, and the whole body may be affected by a single move, which may involve modifying the entire system;

[0005] (2) Modification and development costs are high;

[0006] (3) The original system development documents and developers can no longer be found, and the system is very complicated;

[0008] (5) It may be necessary to suspend the service for a long time, which is not allowed in many cases

[0022] The Session ID transfer of the ISAPI filter-based access control system can either use cookies or URL rewriting. The cookie mechanism has the problem of being not completely transparent to the client and being disabled as mentioned above; using URL rewriting, that is The ISAPI access control filter intercepts the response message and rewrites the URL link pointing to the local in the response content, and there are some technical difficulties

Images