Password-free single sign-on system and method

Abstract

The present invention provides a password-free single sign-on system and method, which can be used in the field of distributed technology. The system includes: a first application is used to generate a token; generate a jump link of a second application; jump to the second application after the user successfully logs in; the second application is used to obtain a token when jumping to the second application, package an uploading message, the uploading message includes a transfer code and a token, and feed back the uploading message to the first application; the first application is also used to parse and obtain a transfer code and a token after receiving the uploading message, decode the transfer code and check, and send a return message when the transfer code is successfully checked and the token of the first application is consistent with the token obtained by parsing, the return message includes a user number and a success code; the second application is also used to perform password-free login according to the user number when the return message includes a success code. The present invention can perform password-free single sign-on with high security.

Description

Technical Field

[0001] The present invention relates to the field of distributed technology, and in particular to a password-free single sign-on system and method. Background Art

[0002] Currently, independent applications all require separate logins when used. When a user needs to jump to another application, the user needs to repeatedly enter the user name and password, which causes unnecessary trouble to the user.

[0003] There is currently single sign-on technology, but it has the disadvantage of poor security, especially for applications like banks that have high security requirements.

[0004] Therefore, there is currently a lack of a solution that can solve the problem of secure password-free jump login. Summary of the invention

[0005] The embodiment of the present invention provides a password-free single sign-on system for performing password-free single sign-on with high security. The system includes:

[0006] The first application is used to: configure the login address of the second application and generate a token; generate a jump link of the second application according to the login address and the token; after the user successfully logs in, receive a click command from the user on the jump link of the second application and jump to the second application;

[0007] The second application is used to: when jumping to the second application through the jump link, obtain a token, package an uploading message, the uploading message includes a transfer code and a token, and feed back the uploading message to the first application;

[0008] The first application is further configured to: after receiving the sent message, parse and obtain the transfer code and token, decode and verify the transfer code, and when the transfer code verification is successful and the token of the first application is consistent with the token obtained by parsing, send a return message to the second application, wherein the return message includes a user number and a success code;

[0009] The second application is also used for: when the returned message includes a success code, performing password-free login according to the user number.

[0010] The embodiment of the present invention provides a password-free single sign-on method for performing password-free single sign-on with high security. The method includes:

[0011] Configure the login address of the second application and generate a token;

[0012] Generate a jump link to the second application according to the login address and token;

[0013] After the user successfully logs in, a click command of the user on the jump link of the second application is received, and the second application is jumped to; when the second application jumps to the second application through the jump link, the second application obtains a token, packages an uploading message, the uploading message includes a transfer code and a token, and feeds back the uploading message to the first application;

[0014] After receiving the upward message, the transfer code and token are obtained by parsing, the transfer code is decoded and verified, and when the transfer code verification is successful and the token of the first application is consistent with the token obtained by parsing, a return message is sent to the second application, and the return message includes the user number and a success code; when the return message of the second application includes the success code, the second application performs a password-free login according to the user number.

[0015] The embodiment of the present invention provides another password-free single sign-on method for performing password-free single sign-on with high security. The method includes:

[0016] When jumping to the second application through the jump link, a token is obtained, and a message is packaged and sent, wherein the message includes a transfer code and a token; wherein the jump link is generated by the first application according to the login address of the second application and the token of the first user;

[0017] Feedback the sent message to the first application; wherein, after receiving the sent message, the first application parses to obtain the transfer code and token, decodes the transfer code and verifies it, and when the transfer code verification is successful and the token of the first application is consistent with the token obtained by parsing, sends a return message to the second application, wherein the return message includes a user number and a success code;

[0018] When the received return message includes a success code, password-free login is performed according to the user number.

[0019] An embodiment of the present invention further provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned password-free single sign-on method when executing the computer program.

[0020] An embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the above-mentioned password-free single sign-on method is implemented.

[0021] An embodiment of the present invention further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the above-mentioned password-free single sign-on method is implemented.

[0022] In an embodiment of the present invention, the first application is used to: configure the login address of the second application and generate a token; generate a jump link of the second application based on the login address and token; after the user logs in successfully, receive the user's click command on the jump link of the second application and jump to the second application; the second application is used to: when jumping to the second application through the jump link, obtain the token, package the uploaded message, the uploaded message includes a transfer code and a token, and feed back the uploaded message to the first application; the first application is also used to: after receiving the uploaded message, parse to obtain the transfer code and token, decode the transfer code and verify, and when the transfer code verification is successful and the token of the first application is consistent with the token obtained by parsing, send a return message to the second application, the return message includes a user number and a success code; the second application is also used to: when the return message includes a success code, perform password-free login according to the user number. In the above process, compared with the existing single sign-on technology, by passing the code and token, the first application sends a token to the second application, the second application sends an upward message to the first application, and the first application sends a return message to the second application. This three-way handshake interaction improves the security of password-free login. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0024] Figure 1 A schematic diagram of a password-free single sign-on system in an embodiment of the present invention;

[0025] Figure 2 is a sequence diagram of the interaction between the first application and the second application in an embodiment of the present invention;

[0026] Figure 3 Flow chart of a password-free single sign-on method in an embodiment of the present invention;

[0027] Figure 4 This is a flow chart of another password-free single sign-on method in an embodiment of the present invention;

[0028] Figure 5 Schematic diagram of a computer device in an embodiment of the present invention. DETAILED DESCRIPTION

[0029] To make the purpose, technical solution and advantages of the embodiments of the present invention more clear, the embodiments of the present invention are further described in detail below in conjunction with the accompanying drawings. Here, the exemplary embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0030] In the description of this specification, the terms "include", "including", "have", "contain", etc. are all open terms, which mean including but not limited to. The descriptions with reference to the terms "one embodiment", "a specific embodiment", "some embodiments", "for example", etc. mean that the specific features, structures or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures or characteristics described may be combined in a suitable manner in any one or more embodiments or examples. The order of steps involved in each embodiment is used to schematically illustrate the implementation of the present application, and the order of steps is not limited and can be appropriately adjusted as needed.

[0031] Figure 1 FIG. 1 is a schematic diagram of a password-free single sign-on system according to an embodiment of the present invention. Figure 1 As shown, the system includes:

[0032] The first application is used to: configure the login address of the second application and generate a token; generate a jump link of the second application according to the login address and the token; after the user successfully logs in, receive a click command from the user on the jump link of the second application and jump to the second application;

[0033] The second application is used to: when jumping to the second application through the jump link, obtain a token, package an uploading message, the uploading message includes a transfer code and a token, and feed back the uploading message to the first application;

[0034] The first application is further configured to: after receiving the sent message, parse and obtain the transfer code and token, decode and verify the transfer code, and when the transfer code verification is successful and the token of the first application is consistent with the token obtained by parsing, send a return message to the second application, wherein the return message includes a user number and a success code;

[0035] The second application is also used for: when the returned message includes a success code, performing password-free login according to the user number.

[0036] In the embodiment of the present invention, compared with the existing single sign-on technology, by passing the code and token, it is possible to achieve the first application sending a token to the second application, the second application sending an upward message to the first application, and the first application sending a return message to the first application. This three-way handshake interaction improves the security of password-free login.

[0037] Password-free login means that after a user has logged into an app, the user can link to other apps in the app and log in directly without a password by clicking on it.

[0038] Token is a string of characters generated by the first application. It is used as a token for the first application's request. The first application generates a token for the second application. After that, the second application only needs to bring the token to request data. Token can prevent illegal login and illegal attacks.

[0039] The http request is a request from the second application to the first application and a response from the first application to the second application. The get request method is used to define an interface. The second application sends a request including a transfer code consisting of a token, a random number, and a password. The first application returns the user number after successful decryption and verification.

[0040] In one embodiment, the first application is further configured to: send a return message including an error code to the second application when the transfer code verification fails or the token of the first application is inconsistent with the token obtained by parsing;

[0041] The second application is also used to: generate reminder information when the returned message includes an error code, and the reminder information is used to remind the user to perform identity authentication.

[0042] That is, the present invention can allow users to perform non-password-free identity authentication.

[0043] In one embodiment, the delivery code includes an agreed password and an agreed random number between the first application and the second application;

[0044] The second application is specifically used to: generate a transfer code according to the agreed password and agreed random number between the first application and the second application;

[0045] The first application is also used to: decode the transfer code to obtain the agreed password and the agreed random number; check the decoded agreed password with the pre-stored agreed password, and check the decoded agreed random number with the pre-stored agreed random number.

[0046] In addition, the sent message also includes the codes of the first application and the second application.

[0047] In one embodiment, the second application is further used to: after generating the transfer code, encrypt the transfer code using the base64 algorithm and the 3des algorithm;

[0048] The first application is further used for: after obtaining the encrypted delivery code, decrypting it to obtain the delivery code.

[0049] In one embodiment, the second application is specifically used to: access the interface of the first application, and send a message to the first application as feedback.

[0050] Based on the above embodiments, Figure 2 This is a sequence diagram of the interaction between the first application and the second application in the embodiment of the present invention. It can be seen that the first handshake between the first application and the second application is the first application jumping to the second application; the second handshake is the second application sending an uplink message to the first application; the third handshake is the first application sending a return message to the second application. Through the three-way handshake, a secure password-free login to the second application is achieved. In addition, since the transfer code is encrypted, data transmission is more secure.

[0051] The embodiment of the present invention further proposes a password-free single sign-on method, the principle of which is similar to that of the password-free single sign-on system, and will not be repeated here.

[0052] Figure 3 The flowchart of the password-free single sign-on method in an embodiment of the present invention includes:

[0053] Step 301, configure the login address of the second application and generate a token;

[0054] Step 302: Generate a jump link to the second application according to the login address and token;

[0055] Step 303: After the user successfully logs in, a click command of the user on the jump link of the second application is received, and the second application is jumped to; when the second application jumps to the second application through the jump link, the second application obtains a token, packages an uploading message, the uploading message includes a transfer code and a token, and feeds back the uploading message to the first application;

[0056] Step 304, after receiving the upward message, parse to obtain the transfer code and token, decode and verify the transfer code, and when the transfer code verification is successful and the token of the first application is consistent with the token obtained by parsing, send a return message to the second application, the return message includes the user number and the success code; when the return message of the second application includes the success code, the second application performs password-free login according to the user number.

[0057] In one embodiment, the method further comprises:

[0058] When the transmission code verification fails or the token of the first application is inconsistent with the token obtained by parsing, a return message including an error code is sent to the second application. When the return message includes an error code, the second application generates a reminder message, and the reminder message is used to remind the user to perform identity authentication.

[0059] In one embodiment, the delivery code includes an agreed password and an agreed random number between the first application and the second application;

[0060] The method further comprises:

[0061] Decoding the transfer code to obtain an agreed password and an agreed random number; comparing the agreed password obtained by decoding with the agreed password stored in advance, and comparing the agreed random number obtained by decoding with the agreed random number stored in advance;

[0062] The transfer code is generated by the second application according to the agreed password and agreed random number between the first application and the second application.

[0063] In one embodiment, the method further comprises:

[0064] After obtaining the encrypted transfer code, the transfer code is decrypted to obtain the transfer code, wherein, after generating the transfer code, the second application uses the base64 algorithm and the 3des algorithm to encrypt the transfer code.

[0065] In one embodiment, the second application feeds back a message to the first application by accessing the interface of the first application.

[0066] To summarize, in the method proposed in the embodiment of the present invention, the login address of the second application is configured and a token is generated; a jump link of the second application is generated according to the login address and the token; after the user logs in successfully, a click command of the user on the jump link of the second application is received, and the user jumps to the second application; when the second application jumps to the second application through the jump link, the token is obtained, a message is packaged and sent, the message includes a transfer code and a token, and the message is fed back to the first application; after receiving the message, the transfer code and the token are obtained by parsing, the transfer code is decoded and checked, and when the transfer code is successfully checked and the token of the first application is consistent with the token obtained by parsing, a return message is sent to the second application, the return message includes a user number and a success code; when the return message of the second application includes a success code, the second application performs a password-free login according to the user number. In the above process, compared with the existing single sign-on technology, by passing the code and token, the first application sends a token to the second application, the second application sends an upward message to the first application, and the first application sends a return message to the second application. This three-way handshake interaction improves the security of password-free login.

[0067] The embodiment of the present invention further proposes another password-free single sign-on method, the principle of which is similar to that of the password-free single sign-on system and will not be described in detail here.

[0068] Figure 4 The flowchart of another password-free single sign-on method in an embodiment of the present invention includes:

[0069] Step 401, when jumping to the second application through the jump link, obtaining a token, packaging and sending a message, wherein the sending message includes a transfer code and a token; wherein the jump link is generated by the first application according to the login address of the second application and the token of the first user;

[0070] Step 402, feeding back the sent message to the first application; wherein, after receiving the sent message, the first application parses to obtain the transfer code and token, decodes the transfer code and verifies, and when the transfer code verification is successful and the token of the first application is consistent with the token obtained by parsing, sends a return message to the second application, the return message including the user number and the success code;

[0071] Step 403: When the received return message includes a success code, password-free login is performed according to the user ID.

[0072] In one embodiment, the method further comprises:

[0073] When the return message includes an error code, a reminder message is generated, and the reminder message is used to remind the user to perform identity authentication. When the first application fails to verify the transmission code or the token of the first application is inconsistent with the token obtained by parsing, the first application sends a return message containing an error code to the second application.

[0074] In one embodiment, the delivery code includes an agreed password and an agreed random number between the first application and the second application;

[0075] The method further comprises:

[0076] A transfer code is generated according to the agreed password and agreed random number of the first application and the second application; wherein the first application decodes the transfer code to obtain the agreed password and the agreed random number; the decoded agreed password is compared with the pre-stored agreed password, and the decoded agreed random number is compared with the pre-stored agreed random number.

[0077] In one embodiment, the method further comprises:

[0078] After the transfer code is generated, the transfer code is encrypted using the base64 algorithm and the 3des algorithm; after obtaining the encrypted transfer code, the first application decrypts the code to obtain the transfer code.

[0079] In one embodiment, the method further comprises:

[0080] Access the interface of the first application and send a message to the first application.

[0081] In summary, in the method proposed in the embodiment of the present invention, when jumping to the second application through the jump link, a token is obtained, and a message is packaged and sent, and the message includes a transfer code and a token; wherein the jump link is generated by the first application according to the login address of the second application and the token of the first user; the message is fed back to the first application; wherein, after receiving the message, the first application parses and obtains the transfer code and the token, decodes and verifies the transfer code, and when the transfer code is successfully verified and the token of the first application is consistent with the token obtained by parsing, a return message is sent to the second application, and the return message includes a user number and a success code; when the received return message includes a success code, a password-free login is performed according to the user number. In the above process, compared with the existing single sign-on technology, through the transfer code and token, the first application sends a token to the second application, the second application sends an upload message to the first application, and the first application sends a return message to the first application, and the three-way handshake interaction improves the security of the password-free login.

[0082] An embodiment of the present invention further provides a computer device, Figure 5 This is a schematic diagram of a computer device in an embodiment of the present invention. The computer device 500 includes a memory 510, a processor 520, and a computer program 530 stored in the memory 510 and executable on the processor 520. When the processor 520 executes the computer program 530, the above-mentioned password-free single sign-on method is implemented.

[0083] An embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the above-mentioned password-free single sign-on method is implemented.

[0084] An embodiment of the present invention further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the above-mentioned password-free single sign-on method is implemented.

[0085] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program business systems. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program business system implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0086] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program business systems according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0087] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0088] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0089] The specific embodiments described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A password-free single sign-on system, characterized in that: include: The first application is used to: configure the login address of the second application and generate a token; Generate a jump link to the second application according to the login address and token; After the user logs in successfully, receiving a click command from the user on a jump link of the second application, and jumping to the second application; The second application is used to: when jumping to the second application through the jump link, obtain a token, package an uploading message, the uploading message includes a transfer code and a token, and feed back the uploading message to the first application; The first application is further configured to: after receiving the sent message, parse and obtain the transfer code and token, decode and verify the transfer code, and when the transfer code verification is successful and the token of the first application is consistent with the token obtained by parsing, send a return message to the second application, wherein the return message includes a user number and a success code; The second application is also used for: when the returned message includes a success code, performing password-free login according to the user number.

2. The system according to claim 1, characterized in that The first application is further configured to: send a return message including an error code to the second application when the transfer code verification fails or the token of the first application is inconsistent with the token obtained by parsing; The second application is also used to: generate reminder information when the returned message includes an error code, and the reminder information is used to remind the user to perform identity authentication.

3. The system according to claim 1, characterized in that The transfer code includes the agreed password and the agreed random number of the first application and the second application; The second application is specifically used to: generate a transfer code according to the agreed password and agreed random number between the first application and the second application; The first application is also used to: decode the transfer code to obtain the agreed password and the agreed random number; check the decoded agreed password with the pre-stored agreed password, and check the decoded agreed random number with the pre-stored agreed random number.

4. The system according to claim 3, characterized in that The second application is also used to: after the transfer code is generated, encrypt the transfer code using the base64 algorithm and the 3des algorithm; The first application is further used for: after obtaining the encrypted delivery code, decrypting it to obtain the delivery code.

5. The system according to claim 1, wherein: The second application is specifically used to: access the interface of the first application, and send a message to the first application as feedback.

6. A password-free single sign-on method, characterized in that: include: Configure the login address of the second application and generate a token; Generate a jump link to the second application according to the login address and token; After the user logs in successfully, receiving a click command from the user on a jump link of the second application, and jumping to the second application; When the second application jumps to the second application through the jump link, the second application obtains the token, packages the sent message, the sent message includes the transfer code and the token, and feeds back the sent message to the first application; After receiving the upward message, the transfer code and token are obtained by parsing, the transfer code is decoded and verified, and when the transfer code verification is successful and the token of the first application is consistent with the token obtained by parsing, a return message is sent to the second application, and the return message includes the user number and a success code; when the return message of the second application includes the success code, the second application performs a password-free login according to the user number.

7. The method according to claim 6, characterized in that Also includes: When the transmission code verification fails or the token of the first application is inconsistent with the token obtained by parsing, a return message including an error code is sent to the second application. When the return message includes an error code, the second application generates a reminder message, and the reminder message is used to remind the user to perform identity authentication.

8. The method according to claim 6, characterized in that The transfer code includes the agreed password and the agreed random number of the first application and the second application; The method further comprises: Decoding the transfer code to obtain an agreed password and an agreed random number; comparing the agreed password obtained by decoding with the agreed password stored in advance, and comparing the agreed random number obtained by decoding with the agreed random number stored in advance; The transfer code is generated by the second application according to the agreed password and agreed random number between the first application and the second application.

9. The method according to claim 8, characterized in that The method further comprises: After obtaining the encrypted transfer code, the transfer code is decrypted to obtain the transfer code, wherein, after generating the transfer code, the second application uses the base64 algorithm and the 3des algorithm to encrypt the transfer code.

10. The method according to claim 6, characterized in that The second application sends a message to the first application by accessing the interface of the first application.

11. A password-free single sign-on method, characterized in that: include: When jumping to the second application through the jump link, a token is obtained, and a message is packaged and sent, wherein the message includes a transfer code and a token; wherein the jump link is generated by the first application according to the login address of the second application and the token of the first user; Feedback the sent message to the first application; wherein, after receiving the sent message, the first application parses to obtain the transfer code and token, decodes the transfer code and verifies it, and when the transfer code verification is successful and the token of the first application is consistent with the token obtained by parsing, sends a return message to the second application, wherein the return message includes a user number and a success code; When the received return message includes a success code, password-free login is performed according to the user number.

12. The method according to claim 11, characterized in that Also includes: When the return message includes an error code, a reminder message is generated, and the reminder message is used to remind the user to perform identity authentication. When the first application fails to verify the transmission code or the token of the first application is inconsistent with the token obtained by parsing, the first application sends a return message containing an error code to the second application.

13. The method according to claim 11, characterized in that The transfer code includes the agreed password and the agreed random number of the first application and the second application; The method further comprises: A transfer code is generated according to the agreed password and agreed random number of the first application and the second application; wherein the first application decodes the transfer code to obtain the agreed password and the agreed random number; the decoded agreed password is compared with the pre-stored agreed password, and the decoded agreed random number is compared with the pre-stored agreed random number.

14. The method according to claim 13, characterized in that Also includes: After the transfer code is generated, the base64 algorithm and 3des algorithm are used to encrypt the transfer code; After obtaining the encrypted transfer code, the first application decrypts the code to obtain the transfer code.

15. The method according to claim 11, characterized in that Also includes: Access the interface of the first application and send a message to the first application.

16. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 6 to 15 is implemented.

17. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 6 to 15 is implemented.

18. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the method according to any one of claims 6 to 15 is implemented.

Images