A method and apparatus for implementing a tree topology authentication system group

Abstract

The application belongs to the technical field of information system, and provides an implementation method of a tree topology authentication system group: when a local authentication system receives an authentication access signal of an application, it is judged whether a third-party authentication system exists; if the third-party authentication system exists, the local authentication system requires the browser to transfer the application to jump to the third-party authentication system; when the application provides login credentials to the third-party authentication system through the browser and successfully logs in, the local authentication system acquires an ST issued by the third-party; after the local authentication system checks the ST to the third-party authentication system, a TGT of the local authentication system is generated and bound with the ST of the third-party authentication system; the local authentication system issues an application-side ST to the application based on the TGT of the local system; after the application acquires the application-side ST of the local authentication system and initiates a check to the local authentication system and succeeds, the browser is provided with services.

Description

Technical Field

[0001] This invention relates to the field of information system technology, and more particularly to a method and apparatus for implementing a tree-structured topology authentication system group. Background Technology

[0002] As the complexity of information systems across various industries continues to increase, business application software is gradually being broken down into multiple sub-application systems based on the principle of high cohesion and low coupling. Each application system needs to authenticate and authorize users, making a unified authentication service an indispensable part. After integrating a unified login and authentication system into all sub-application systems, users only need to log in once to access all systems, avoiding repeated logins and achieving a better user experience.

[0003] Currently, unified authentication in application systems commonly uses the Jasig authentication system (Central Authentication Service) as a central single point of unified authentication. For example... Figure 2 As shown: The user's first access to the application involves logging in through the central authentication system. Figure 3 The diagram illustrates the process of a user accessing another application after already being logged into the authentication system. The basic authentication process of the authentication system is as follows:

[0004] 1. When a user accesses application server A, since they are not authorized at this time, application server A directs the user to the authentication server.

[0005] 2. The authentication server detects that the user has not logged in before and requires the user to log in. After the user logs in, a TGT (Ticket Granted Ticket) is issued, indicating that the user has been authorized by the authentication service.

[0006] 3. If the authentication server discovers that the user originally accessed an application server A, it will use the user's TGT to issue an ST (Service Ticket) for the aforementioned application server A and return it to the user.

[0007] 4. After obtaining this ST, the user accesses the aforementioned application server A again.

[0008] 5. When application server A discovers that a user has an ST, it takes the ST to the authentication server to verify the validity of the ticket, that is, to ask the authentication server whether it was issued for its own application service.

[0009] 6. The authentication server returns the ST verification result to the application server A. The application server A places the user session in the trusted queue and provides the user with subsequent application services.

[0010] 7. At this point, when the user accesses another application system B again, since the user session is no longer in B's trusted list, B will still direct the user to directly access the authentication server.

[0011] 8. At this point, the authentication server discovers that the user already has a TGT, indicating that the user has already logged in. It will then issue a new ST for application system B and return it to the user. The user can then access application server B through this ST, avoiding a second login.

[0012] As can be seen from the above process, once both application services are properly integrated with the authentication system, the authentication system can enable users to access resources across applications with a single login. Because the authentication system internally encloses the authentication and issuance process of tickets, it can only obtain a ServiceTicket bound to a specific application service externally. Furthermore, the ST can only be verified once. This makes the issued ticket like a movie ticket for a specific cinema; once it enters the verification process of that specific cinema, it becomes invalid, making it very secure—this is its advantage in authentication. However, for centralized authentication, the caching and issuance of tickets are concentrated on the authentication server. If the ticket caching node or authentication node on this server malfunctions, it will cause a "single point of failure" in the authentication system, which is its weakness in stability.

[0013] At the same time, the closed nature of the authentication system limits its openness and inclusiveness for cascading login authentication. For example, in a production environment where a third-party unified authentication service already exists, and our authentication system needs to integrate with it, both authentication systems target the same browser and can only recognize their own issued TGT tickets, failing to create a universally accepted TGT ticket. In many historical scenarios, third-party authentication systems were often forced to directly transmit usernames and passwords to our authentication system to generate a TGT ticket that we recognized, enabling seamless access between applications under the two authentication systems. Although this data transmission is encrypted, certain security vulnerabilities still exist, and the instability caused by a single point of failure in the authentication system can still lead to business interruptions. Summary of the Invention

[0014] This invention provides a method and apparatus for implementing a tree-structured topology authentication system group, overcoming the above-mentioned problems.

[0015] The technical solution provided by this invention is as follows:

[0016] On one hand, the present invention provides a method for implementing a tree-structured topology authentication system group, comprising:

[0017] When the local authentication system receives an authentication access signal from an application, it determines whether a third-party authentication system exists.

[0018] If a third-party authentication system exists, the local authentication system requires the browser to redirect the application to the third-party authentication system.

[0019] When the application provides login credentials to the third-party authentication system through the browser and successfully logs in, the local authentication system obtains the ST issued by the third party;

[0020] After the local authentication system verifies the ST with the third-party authentication system, it generates the TGT of the local authentication system and binds it to the ST of the third-party authentication system.

[0021] The application-side ST is issued to the application through the local authentication system based on the TGT of the local system;

[0022] Once the application obtains the application-side ST of the local authentication system and initiates verification with the local authentication system successfully, it provides services to the browser.

[0023] In some embodiments, the method further includes: when the native authentication system serves as the central authentication system for the application, directly authenticating the application.

[0024] In some embodiments, the method further includes: when the local authentication system uses the third-party authentication system as the central authentication system, the local authentication system acts as an application system and interfaces with the third-party authentication system.

[0025] In some embodiments, the method further includes: when the third-party authentication system logs out of the application's authentication process, the TGT of the local authentication system and the ST of the bound third party are simultaneously deregistered.

[0026] In some embodiments, the local authentication system performs one-way authentication cascading when more than one authentication service exists.

[0027] In some embodiments, the present invention also provides an implementation apparatus for a tree-structured authentication system group, comprising: a plurality of local authentication systems, each of the local authentication systems comprising:

[0028] The judgment module is used to determine whether a third-party authentication system exists when the local authentication system receives an authentication access signal from the application.

[0029] The migration module is used to redirect the application to the third-party authentication system if no third-party authentication system exists, in which case the local authentication system requires the browser to provide login credentials.

[0030] The acquisition module is used to obtain the ST issued by the third party when the application provides login credentials to the third-party authentication system through the browser and the login is successful.

[0031] The binding module is used to generate a TGT for the local authentication system and bind it to the ST of the third-party authentication system after the local authentication system verifies the ST with the third-party authentication system.

[0032] The issuance module is used to issue an application-side ST to the application through the local authentication system based on the local system's TGT;

[0033] The verification module is used to provide services to the browser after the application obtains the application-side ST of the local authentication system and initiates verification with the local authentication system and succeeds.

[0034] In some embodiments, the native authentication system is also used to directly authenticate the application when the native authentication system serves as the central authentication system for the application.

[0035] In some embodiments, the native authentication system is further configured to interface with the third-party authentication system when the native authentication system uses the third-party authentication system as the central authentication system.

[0036] In some embodiments, the native authentication system is further configured to synchronously deregister the TGT of the native authentication system and the ST of the bound third party after the third-party authentication system logs out of the application's authentication process.

[0037] In some embodiments, the native authentication system is further configured to perform one-way authentication cascading when more than one authentication service exists.

[0038] The method and apparatus for implementing a tree-structured topology authentication system group provided by this invention have at least one of the following beneficial effects:

[0039] This invention enables authentication based on nodes in other networks even after a node in an authentication network group loses its connection, essentially eliminating the "single point" failure in single sign-on and achieving "each for its own authentication" while maintaining "interconnectivity".

[0040] This invention can be securely integrated into a third-party authentication system for networking.

[0041] This invention can realize a three-level (multi-level) authentication system connection, similar to "group organization authentication center - subsidiary branch authentication center - department business authentication center", where they can authorize each other but not each other. Attached Figure Description

[0042] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments:

[0043] Figure 1 This is a schematic diagram of an embodiment of a tree-structured authentication system group according to the present invention;

[0044] Figure 2 This is a diagram illustrating the process of a user logging into the application for the first time through the central authentication system.

[0045] Figure 3 This is a diagram illustrating the process of a user accessing another application after already logging into the authentication system.

[0046] Figure 4 This is a schematic diagram illustrating the single authentication system scenario before the modification;

[0047] Figure 5 This is a schematic diagram illustrating the modified multi-authentication system under the TAS system of this invention.

[0048] Figure 6 This is a schematic diagram of the login process when a user first accesses an application under our authentication system after the authentication system of this invention has been modified. Detailed Implementation

[0049] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0050] To keep the drawings concise, only the parts relevant to the invention are shown schematically in each figure, and they do not represent the actual structure of the product. Furthermore, for ease of understanding, in some figures, only one of components with the same structure or function is shown schematically, or only one is labeled. In this document, "one" can mean not only "only one" but also "more than one".

[0051] It should also be further understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0052] In this document, it should be noted that, unless otherwise explicitly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to fixed connections, detachable connections, or integral connections; they can refer to mechanical connections or electrical connections; they can refer to direct connections or indirect connections through an intermediate medium; and they can refer to the internal communication between two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0053] Furthermore, in the description of this application, the terms "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0054] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the specific implementation methods of the present invention will be described below with reference to the accompanying drawings. Obviously, the drawings described below are merely some embodiments of the present invention. For those skilled in the art, other drawings and other implementation methods can be obtained based on these drawings without any creative effort.

[0055] In one embodiment, such as Figure 1 As shown, in one aspect, the present invention provides a method for implementing a tree-structured topology authentication system group, comprising:

[0056] S101 When the local authentication system receives the authentication access signal from the application, it determines whether a third-party authentication system exists;

[0057] S102 If a third-party authentication system exists, the local authentication system requires the browser to redirect the application to the third-party authentication system;

[0058] S103 When the application provides login credentials to the third-party authentication system through the browser and successfully logs in, the local authentication system obtains the ST issued by the third party;

[0059] S104 After the local authentication system verifies the ST with the third-party authentication system, it generates the TGT of the local authentication system and binds it to the ST of the third-party authentication system;

[0060] S105 issues an application-side ST to the application based on the TGT of the local authentication system through the local authentication system;

[0061] S106 When the application obtains the local authentication system's application-side ST and initiates verification with the local authentication system and succeeds, it provides services to the browser.

[0062] In addition, if no third-party authentication system exists, the local authentication system requires the browser to provide login credentials and authenticate.

[0063] For example, considering the characteristics of the aforementioned centralized authentication system, we found that the Jasig open-source project proposed by Yale University provides a highly secure implementation of the CAS ticket-based authentication process, which is its greatest advantage. In the original CAS process, facing three independent authentication systems, the lack of mutual authorization among these systems, each acting as the sole authorizing authority, results in a lack of trust mechanisms and an insufficiently open workflow. In other words, the authentication systems described in the background information are all self-contained; the first 'C' in CAS stands for 'center,' signifying centrality or centralized nature, and the system is not open to other authentication systems.

[0064] To this end, we have invented and disclosed a modification method to improve the external inclusiveness of its processes, thereby enabling certain specific needs scenarios.

[0065] For example, there are currently two CAS authentication services, one provided by a "third party" and the other by "our party." They are incompatible. We will make the following modifications, the basic process of which is as follows:

[0066] 1. We will continue to use our CAS service as the authentication center for our internal applications, which is a capability that the CAS system originally possesses. At the same time, we will treat our CAS service as a regular application system and interface with other companies' CAS services. The interface method is detailed in 2.

[0067] 2. When an application migrates to our CAS to initiate authentication, our CAS first checks if the other party's CAS exists. If it does, proceed to step 3; if it does not exist, our CAS directly requests the browser to provide login credentials, thus preserving the original CAS authentication process.

[0068] 3. When users migrate from our CAS (which is an application system of another CAS), they are directly redirected to the other CAS. The user provides login credentials to the other CAS through the browser. After successful login, our CAS will obtain the ST issued by the other CAS according to the authentication process of the other CAS.

[0069] 4. After our CAS verifies the ST with the other CAS, we generate our CAS TGT and bind it to the ST of the other CAS (in the future, once the other CAS logs out, our TGT will be deregistered synchronously according to the bound other ST).

[0070] 5. Our CAS issues an application-side ST to a certain application accessed in step 2 based on TGT.

[0071] 6. An application obtains the ST of our CAS and initiates a verification to our CAS. After successful verification, it provides services.

[0072] Before the transformation, CAS was a star-shaped authentication relationship, and the authentication server was the center of this star topology, called the Central Authentication Service.

[0073] like Figure 4 The image shows a single CAS scenario before the modification (arrows indicate the direction of authentication integration).

[0074] The modified CAS system of this invention has the dual identity of Server (for application systems) and Client (for third-party CAS). When there are more than one CAS service, it can perform one-way authentication cascading, just like a directed graph composed of unidirectional vectors can be combined serially or in a tree structure. We tentatively refer to this one-way authentication cascading as "attachment".

[0075] For example, this invention deploys multiple CAS authentication system services. Except for selecting one CAS system without attaching to any other CAS system, the remaining CAS systems are attached to only one CAS service. This forms a tree-like authentication topology for the entire authentication system, which we call TAS (Tree-like Authenticate Service) tree-like authentication system. We call the entire system formed by running TAS "authentication tree system group".

[0076] like Figure 5 The diagram shows a scenario where multiple CAS systems have been modified under the TAS system (arrows indicate the direction of authentication integration).

[0077] At this point, if the authentication client can maintain the configuration of several authentication nodes at the same time, once a node in the authentication system group fails, it can be authenticated through other network nodes, thus achieving the hot standby effect of the central authentication service.

[0078] At the same time, even if a node in the authentication network is not built by us, we can still build the network based on its authentication method to achieve authentication from us to other three parties and implement authentication requirements in specific scenarios.

[0079] This invention enables authentication based on nodes in other networks even after a node in an authentication network loses its connection, essentially eliminating the "single point of failure" in single sign-on and achieving both "individual authentication" and "interconnectivity." This invention can securely integrate with third-party authentication systems. It can also facilitate the connection of three (or more) levels of authentication systems, such as a "group organization authentication center - subsidiary / branch office authentication center - departmental business authentication center," where systems mutually trust each other while allowing for independent authorization.

[0080] In one embodiment, the method further includes: when the native authentication system serves as the central authentication system for the application, directly authenticating the application.

[0081] In one embodiment, the method further includes: when the local authentication system uses the third-party authentication system as the central authentication system, the local authentication system acts as an application system and interfaces with the third-party authentication system.

[0082] Each certification center can act as a central CAS or a sub-CAS, determining whether it is a central CAS or a sub-CAS by checking whether a third-party CAS exists.

[0083] For example, in that implementation, if I deploy to a province, the CAS (Content Authentication and Acceptance) architecture (CAS) deployed to the provincial department and the municipal systems is the same. The only difference is that the municipal CAS is attached to the provincial department's CAS service. The user access permissions for the provincial department's CAS are based on the provincial data platform, while the municipal CAS accesses its own platform. In principle, the province covers the data of all municipalities, so data is shared for users logging in within the same city. However, if a user from another city tries to access the local system, it will be considered a "guest privilege." In this case, the local system can simply provide the functions available to the guest, without requiring them to "log in again."

[0084] In terms of data, the data that a child CAS can authenticate is always covered by the parent CAS, but the reverse is not necessarily true. For users whose authentication is successful by the parent CAS but are not recognized by the child CAS, they are considered visitors. This precisely solves a problem: for example, a person from city A logging into the city A system might be authorized as an "administrator" through the city A CAS. When they go to city B, the city B CAS won't allow them to log in again, but will grant them a "visitor" identity. They can then seamlessly access the city B system. The entire process involves a jump through the provincial CAS, but the user is unaware of it. This effect can be achieved by cascading three CAS systems in this way.

[0085] In traditional technology, if someone from city A wants to access the system in city B, they must log in again in city B because the CAS systems for A and B are independent.

[0086] In one embodiment, the method further includes: when the third-party authentication system logs out of the application's authentication process, the TGT of the local authentication system and the ST bound to the third party are simultaneously deregistered.

[0087] In one embodiment, the local authentication system performs one-way authentication cascading when more than one authentication service exists.

[0088] In one embodiment, the present invention also provides an implementation apparatus for a tree-structured authentication system group, comprising: a plurality of local authentication systems, each of the local authentication systems comprising:

[0089] The judgment module is used to determine whether a third-party authentication system exists when the local authentication system receives an authentication access signal from the application.

[0090] The migration module is used to redirect the application to the third-party authentication system if no third-party authentication system exists, in which case the local authentication system requires the browser to provide login credentials.

[0091] The acquisition module is used to obtain the ST issued by the third party when the application provides login credentials to the third-party authentication system through the browser and the login is successful.

[0092] The binding module is used to generate a TGT for the local authentication system and bind it to the ST of the third-party authentication system after the local authentication system verifies the ST with the third-party authentication system.

[0093] The issuance module is used to issue an application-side ST to the application through the local authentication system based on the local system's TGT;

[0094] The verification module is used to provide services to the browser after the application obtains the application-side ST of the local authentication system and initiates verification with the local authentication system and succeeds.

[0095] In one embodiment, the native authentication system is further configured to directly authenticate the application when the native authentication system serves as the central authentication system for the application.

[0096] In one embodiment, the local authentication system is further configured to interface with the third-party authentication system when the local authentication system uses the third-party authentication system as the central authentication system.

[0097] In one embodiment, the native authentication system is further configured to synchronously deregister the TGT of the native authentication system and the ST of the bound third party after the third-party authentication system logs out of the application's authentication process.

[0098] In one embodiment, the local authentication system is further configured to perform one-way authentication cascading when more than one authentication service exists.

[0099] This invention enables authentication based on nodes in other networks even after a node in an authentication network loses its connection, essentially eliminating the "single point of failure" in single sign-on and achieving both "individual authentication" and "interconnectivity." This invention can securely integrate with third-party authentication systems. It can also facilitate the connection of three (or more) levels of authentication systems, such as a "group organization authentication center - subsidiary / branch office authentication center - departmental business authentication center," where systems mutually trust each other while allowing for independent authorization.

[0100] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0101] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative; the division of modules or units is merely a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual couplings or direct couplings or communication connections may be through some interfaces; indirect couplings or communication connections between apparatuses or units may be electrical, mechanical, or other forms.

[0102] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0103] Furthermore, the functional units in the various embodiments of this application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The integrated unit described above can be implemented in hardware or as a software functional unit.

[0104] It should be noted that the above embodiments can be freely combined as needed. The above description is only a preferred embodiment of the present invention. It should be pointed out that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for implementing a tree-structured topology authentication system group, characterized in that, include: When the local authentication system receives an authentication access signal from an application, it determines whether a third-party authentication system exists. If a third-party authentication system exists, the local authentication system requires the browser to redirect the application to the third-party authentication system. When the application provides login credentials to the third-party authentication system through the browser and successfully logs in, the local authentication system obtains the ST issued by the third party; After the local authentication system verifies the ST with the third-party authentication system, it generates the TGT of the local authentication system and binds it to the ST of the third-party authentication system. The application-side ST is issued to the application through the local authentication system based on the TGT of the local authentication system; Once the application obtains the application-side ST of the local authentication system and initiates verification with the local authentication system successfully, it provides services to the browser. When the third-party authentication system logs out of the application's authentication process, the local authentication system listens for the ST failure event of the third party, finds the corresponding TGT of the local authentication system based on the binding relationship obtained after binding the TGT of the local authentication system with the ST of the third party's authentication system, and synchronously cancels the TGT of the local authentication system and the bound ST of the third party. The local authentication system and the third-party authentication system form nodes in a tree-like topology authentication system group. The local authentication system dynamically determines itself as the root node or a child node based on whether a third-party authentication system exists. When there is more than one authentication service, the local authentication system performs one-way authentication cascading, with authentication requests being transmitted unidirectionally from child nodes to parent nodes along the tree topology.

2. The implementation method of the tree-structured authentication system group according to claim 1, characterized in that, Also includes: When the local authentication system acts as the central authentication system for the application, it directly authenticates the application.

3. The implementation method of the tree-structured authentication system group according to claim 1, characterized in that, Also includes: When the local authentication system uses the third-party authentication system as the central authentication system, the local authentication system acts as an application system and interfaces with the third-party authentication system.

4. An implementation apparatus for a tree-structured topology authentication system group, characterized in that, include: Multiple local authentication systems, each of which includes: The judgment module is used to determine whether a third-party authentication system exists when the local authentication system receives an authentication access signal from the application. The migration module is used to require the browser to redirect the application to the third-party authentication system if a third-party authentication system exists. The acquisition module is used to obtain the ST issued by the third party when the application provides login credentials to the third-party authentication system through the browser and the login is successful. The binding module is used to generate a TGT for the local authentication system and bind it to the ST of the third-party authentication system after the local authentication system verifies the ST with the third-party authentication system. The issuance module is used to issue an application-side ST to the application through the local authentication system based on the TGT of the local authentication system; The verification module is used to provide services to the browser after the application obtains the application-side ST of the local authentication system and initiates verification with the local authentication system and succeeds. The deregistration module is used when the third-party authentication system logs out of the application's authentication process. When the local authentication system detects the ST failure event of the third party, it searches for the corresponding TGT of the local authentication system based on the binding relationship obtained after binding the TGT of the local authentication system with the ST of the third party's authentication system, and deregisters the TGT of the local authentication system and the bound ST of the third party synchronously. The local authentication system and the third-party authentication system form nodes in a tree-like topology authentication system group. The local authentication system dynamically determines itself as the root node or a child node based on whether a third-party authentication system exists. The local authentication system is also used to perform one-way authentication cascading when there is more than one authentication service, with the authentication request being transmitted unidirectionally from the child node to the parent node along the tree topology.

5. The apparatus for implementing the tree-structured topology authentication system group according to claim 4, characterized in that, The local authentication system is also used to directly authenticate the application when the local authentication system serves as the central authentication system for the application.

6. The apparatus for implementing the tree-structured authentication system group according to claim 5, characterized in that, The local authentication system is also used to interface with the third-party authentication system when the local authentication system uses the third-party authentication system as the central authentication system.

Images