Dynamic authorization login method based on SSO client security

Abstract

The application discloses a dynamic authorization login method based on SSO client security, and comprises the following steps: after a unified authentication center authenticates business system client information and user information successfully, a dynamic authorization code which is special and is bound with the client information is dynamically generated, and the dynamic authorization code is sent to a business system server; after the business system server receives the dynamic authorization code, the business system server sends the dynamic authorization code to the unified authentication center, and carries server information and request client information; after the unified authentication center verifies successfully, the unified authentication center generates an access token which is special and is bound with the client information for the business system, and returns the access token to the business system; after the business system receives the access token, the business system performs login subsequent processing and returns a business system page; and the application solves the system risk that the access token is easily leaked and stolen.

Description

TECHNICAL FIELD

[0001] The present application relates to the network security technical field, particularly to a dynamic authorization login method based on SSO client security. BACKGROUND

[0002] Currently, single sign-on (SSO) is one of the popular enterprise business system integration solutions, and users only need to log in once to access all trusted business systems. The implementation scheme of SSO is various, and can be evaluated according to the current situation of the business system and the cost of implementation, and the applicable scheme can be flexibly selected.

[0003] Now, the single sign-on based on the authentication center is mostly implemented by generating an access token by the authentication center, and directly sending the access token or the encrypted access token to the business system, which has the following defects:

[0004] 1. By directly sending the access token, the access token is transparent to the outside, and the system security cannot be guaranteed;

[0005] 2. By sending the encrypted access token, the problem of leakage is prevented to a certain extent. However, when the access token is used at the business system end, it is still possible to be stolen by others. SUMMARY

[0006] In order to solve the problems in the prior art, the purpose of the present application is to provide a dynamic authorization login method based on SSO client security. In the present application, the business system generates a special dynamic authorization code binding the client information as an authorized login credential through the authentication center, and exchanges the client-specific access token through the business system service end, thereby solving the system risk of easy leakage and misuse of the access token.

[0007] To achieve the above purpose, the technical scheme adopted by the present application is as follows: a dynamic authorization login method based on SSO client security, comprising the following steps:

[0008] Step 1: After the unified authentication center authenticates the business system client information and user information successfully, a special dynamic authorization code binding the client information is dynamically generated, and the dynamic authorization code is sent to the business system service end;

[0009] Step 2: After the business system service end receives the dynamic authorization code, it is sent to the unified authentication center with the service end information, the request client information and the dynamic authorization code. After the unified authentication center verifies successfully, it generates a special access token binding the client information for the business system and returns it to the business system. After the business system receives the access token, it performs login subsequent processing and returns the business system page.

[0010] As a further improvement of the present application, step 1 specifically comprises the following steps:

[0011] A, register trusted business system information in a unified authentication center, after successful registration, assign corresponding AppId and AppSecret to each business system;

[0012] B, when not logged in, access the business system page, take the business system page address as the redirection address, and pass the AppId of the business system to the login verification page of the unified authentication center as a parameter;

[0013] C, verify the global access token by the login verification page, if valid, directly generate a dedicated dynamic authorization code binding the business system client information, and redirect to the business system page; if invalid, jump to the login verification page of the unified authentication center;

[0014] D, input the username and password on the login verification page, send a login request carrying the client information, and add the AppId and signature information to the request header;

[0015] E, after the unified authentication center verifies successfully, generate a global access token binding the business system client information and a dynamic authorization code binding the client information, and redirect to the business system page carrying the dynamic authorization code.

[0016] As a further improvement of the application, in step A, the business system information includes server information, IP address and IP white list for accessing the business system.

[0017] As a further improvement of the application, in step D, the login request references a third-party library to obtain the client MAC or unique identifier, and uses HMAC-SHA256 signature algorithm for signature.

[0018] As a further improvement of the application, the dynamic authorization code is an encrypted string containing client information, request IP address, business system AppId, user ID and access timestamp.

[0019] As a further improvement of the application, step 2 specifically includes the following steps:

[0020] a, the business system server obtains the dynamic authorization code, and sends it to the unified authentication center carrying the request client information, server information, dynamic authorization code and signature information;

[0021] b, the unified authentication center verifies the related information and extracts the authorization code information and the information carried by the request, and after successful comparison, returns the access token with client information to the business system server, and then returns to the business system page after the business system server completes the login processing;

[0022] c. When a service processing request is initiated at the service system end, the gateway intercepts the request and verifies the access token and request client information, and after successful verification, the service processing API interface is called.

[0023] The beneficial effects of the present application are:

[0024] The present application uses a dedicated dynamic authorization code binding client information as a system authorization login credential to exchange client-specific access tokens in the implementation of single sign-on (SSO), avoiding the risk of tampering and theft of login credentials during request transmission, improving the security and reliability of single sign-on. BRIEF DESCRIPTION OF DRAWINGS

[0025] Figure 1 The flowchart of the embodiment of the present application. DETAILED DESCRIPTION

[0026] The embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0027] Embodiment

[0028] As shown in Figure 1 A dynamic authorization login method based on SSO client security, the present embodiment is based on a unified authentication center, and the business system carries the system address to log in through the authentication center. After the authentication center authenticates the client information and user information successfully, a dedicated authorization code binding client information is dynamically generated, and the authorization code is sent to the business system. After the business system server receives the dynamic authorization code, it carries the server information, request client information and authorization code to send to the authentication center. After the authentication center verifies successfully, it generates a dedicated access token (Token) binding client information for the business system and returns it to the business system. After the business system receives the access token, it logs in for subsequent processing and returns the system page. In this way, the authentication center issues a dedicated dynamic authorization code carrying client information as an authorized login credential, and the business system server exchanges a dedicated access token binding client information using the authorization code, avoiding the risk of easy leakage of access tokens sent directly between systems and the risk of theft of access tokens.

[0029] Specifically, the following steps are included:

[0030] 1. First, the trusted business system information needs to be registered in the authentication center, mainly including the server information, IP address of the deployed business system, and IP white list for accessing the business system, etc. After successful registration, the corresponding AppId and AppSecret are allocated for each business system.

[0031] 2. When not logged in, access the business system page, take the business system page address as the redirection address, and pass the AppId of the business system to the unified authentication center login verification page as a parameter.

[0032] 3. The login verification page (intermediate page) verifies the global access token. If valid, a dedicated dynamic authorization code binding client information is generated and redirected to the business system page. Steps 4 and 5 are skipped, and step 6 is executed. If invalid, jump to the unified login page.

[0033] 4. When entering the username and password in the login page and sending the login request, the client information (client MAC or unique identifier) needs to be carried, and the AppId and signature information need to be added to the request header. The login request is implemented as follows:

[0034] a. Refer to the third-party library to obtain the client MAC or unique identifier.

[0035] b. Use the HMAC-SHA256 signature algorithm for signing. The example code is as follows:

[0036] Install and reference the third-party library code on the front end:

[0037]

[0038]

[0039] Backend signature code:

[0040]

[0041] c. Custom request header information is as follows:

[0042]

[0043] 5. After the authentication center verifies (user information, client information, request IP address, etc.) successfully, a global access token binding client information and an authorization code binding client information are generated, and the authorization code is carried to redirect to the business system page. The authorization code is a string of encrypted strings containing client information, request IP address, business system AppId, user ID, and access timestamp, which is implemented as follows:

[0044] a. Generate global token and append client information declaration, such as:

[0045]

[0046] b. Generate authorization code information as an encrypted string according to the following rules, separated by "|":

[0047] Rule: {Client MAC or unique identifier} | {Request IP} | {Application ID} | {User ID} | {Timestamp}

[0048] c. Redirect to the business system page address.

[0049] 6. The business system server obtains the authorization code, and sends it to the authentication center along with the request client information, server information, authorization code and signature information.

[0050] 7. The authentication center verifies the relevant information and extracts the authorization code information and the information carried by the request. After a successful comparison, it returns the access token with client information to the business system server. After the business system server completes the login process, it returns to the business system page.

[0051] a. The authentication center decrypts and parses the authorization code according to the following rules and compares it with the request information:

[0052] Rule: {Client MAC or unique identifier} | {Request IP} | {Application ID} | {User ID} | {Timestamp}

[0053] b. Generate business system access token and add business system application ID and client information declaration:

[0054]

[0055] 8. When initiating a business processing request on the business system side, the gateway intercepts the request and verifies the access token and request client information. After a successful verification, it calls the business processing API interface.

[0056] Gateway interception example code:

[0057]

[0058]

[0059] The above-described embodiments only express the specific implementation of the present application, and the description is more specific and detailed, but it should not be interpreted as limiting the scope of the present patent. It should be noted that for ordinary skilled persons in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are within the scope of protection of the present application.

Claims

1. A dynamic authorization login method based on SSO client security, characterized in that, The method comprises the following steps: Step 1, after the unified authentication center authenticates the client information and user information of the business system successfully, a dynamic authorization code bound to the client information is dynamically generated, and the dynamic authorization code is sent to the business system server; Step 2, after the business system server receives the dynamic authorization code, the server information, client information and dynamic authorization code are sent to the unified authentication center, and after the unified authentication center verifies successfully, an access token bound to the client information is generated for the business system and returned to the business system, and after the business system receives the access token, subsequent processing is performed after login and the business system page is returned.

2. The method for dynamic authorization login based on SSO client security according to claim 1, characterized in that, The step 1 specifically comprises the following steps: A, register the trusted business system information in the unified authentication center, and after successful registration, assign corresponding AppId and AppSecret to each business system; B, when not logged in, access the business system page, take the business system page address as the redirection address, and pass the AppId of the business system to the login verification page of the unified authentication center as a parameter; C, verify the global access token by the login verification page, if valid, directly generate a dynamic authorization code bound to the client information of the business system, and redirect to the business system page; if invalid, jump to the unified login page of the unified authentication center; D, input the username and password on the unified login page, send a login request carrying the client information, and add the AppId and signature information to the request header; E, after the unified authentication center verifies successfully, a global access token bound to the client information of the business system and a dynamic authorization code bound to the client information are generated, and the dynamic authorization code is redirected to the business system page.

3. The method for dynamic authorization login based on SSO client security according to claim 2, characterized in that, In step A, the business system information includes server information, IP address and IP white list for accessing the business system.

4. The method for dynamic authorization login based on SSO client security according to claim 2, characterized in that, In step D, the login request references a third-party library to obtain the client MAC or unique identifier, and uses the HMAC-SHA256 signature algorithm for signature.

5. The dynamic authorization login method based on SSO client security according to claim 1 or 2, characterized in that, The dynamic authorization code is an encrypted string containing client information, request IP address, business system AppId, user ID and access timestamp.

6. The method for dynamic authorization login based on SSO client security according to claim 2, characterized in that, The step 2 specifically comprises the following steps: a, the business system server obtains the dynamic authorization code, and sends the client information, server information, dynamic authorization code and signature information to the unified authentication center; b, the unified authentication center verifies the related information, extracts the authorization code information and the information carried by the request, and after successful comparison, returns the access token with the client information to the business system server, and then the business system server completes the login processing and returns to the business system page; c, when initiating a business processing request on the business system side, the request is intercepted by the gateway and the access token and client information are verified, and after successful verification, the business processing API interface is called.

Images