A single sign-on method and system thereof

Abstract

The invention provides a single sign on system and method. The system comprises an access module, a redirection module, a login module, an encryption module and an authentication module. The method comprises the steps that: a Web browser accesses a CAS client, and the CAS client obtains authentication information NewTicket in the Web browser for authentication; the NewTicket is generated by a CAS server according to the first time login information of the Web and is stored in the Web browser together with a public key of the CAS server for the next time authentication, the NewTicket comprises Ticket and signature information, the signature information is obtained by converting the Ticket and encrypting the Ticket by a private key of the CAS server, during the authentication, the CAS client decrypts the signature information in the NewTicket by use of the public key of the CAS server to obtain a signature content, and compares whether the signature content is consistent with the converted Ticket, and if so, the authentication is successful; and if not, the authentication is failed. The single sign on system and method provided by the invention are used for realizing the self check and the bidirectional authentication mechanism of the CAS client, greatly reducing the dependence on the CAS server and improving the security at the same time.

Description

technical field [0001] The invention relates to the technical field of computer network information security, in particular to a single sign-on method and system thereof. Background technique [0002] Single Sign On (SSO), referred to as SSO, is currently one of the more popular enterprise business integration solutions. The definition of SSO is that in multiple application systems, users only need to log in once to access all mutually trusted application systems. Single sign-on is an authorization mechanism and unified authentication. At present, the commonly used technology in this technical field is CAS (Central Authentication Service ) is an open source project initiated by Yale University, which aims to provide a stable and reliable single sign-on solution. The CAS client is deployed together with the protected client application to protect the protected resources of the Web application by filtering, such as figure 1 As shown, the basic verification process of the exis...

AI Technical Summary

Problems solved by technology

[0010] 1. In actual environment applications, hundreds or even thousands of application service nodes are often deployed. Because of the verification mechanism of CAS itself, all business links must be verified by the CAS server for security reasons. In order to verify the authenticity of the Ticket string To obtain the necessary user information, it is necessary to initiate requests to the CAS server several times. This highly coupled design mode causes the CAS server to interact too frequently, and the business module is highly dependent on the CAS server. Once the CAS server is abnormal, all business modules will be affected;

[0011] 2. The CAS service only authenticates the Ticket string issued by it. Hackers can easily forge or steal the Ticket string and carry out replay attacks on other machines, resulting in information leakage and insufficient security.

Images