A cross-border multi-store operation management platform account single sign-on processing system and method

Abstract

The application discloses a cross-border multi-store operation management platform account single sign-on processing system and method, the system comprises: a scheduling service management unit, which is used for assigning a login scheduling server to a region field in a login request after receiving the login request, and the login scheduling server assigns a single sign-on server in the region corresponding to the region field to process the login request; a login service management unit, which is used for assigning a single sign-on server to a login request; a login data synchronization unit, which is used for packing, encrypting and decrypting login information, and distributing the login information to specified or all region login scheduling servers when receiving a user login information update request, and writing or updating related data in the single sign-on server in the region through a login data synchronization unit of a receiver; and a communication management unit, which uses a corresponding communication management method according to different compliance requirements. The application can meet the compliance requirements of different regions and different industries, and improve user experience.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of cross-border e-commerce operation management, in particular to a cross-border multi-store operation management platform account single sign-on processing system and method. BACKGROUND

[0002] E-commerce operation companies may open multiple stores in different regions and on different platforms to improve sales performance due to business requirements. As the number of stores increases, e-commerce operation personnel need to log in to different stores each time to manage them, increasing the difficulty and workload of operation. Some e-commerce operation companies develop internal operation management platforms to manage multiple stores on different platforms uniformly in order to improve internal operation management efficiency. For example, after importing orders, complaints, etc. from multiple platforms into the operation management platform, all order processing, logistics, warehousing, and complaint management can be managed centrally, greatly improving operational efficiency.

[0003] However, due to compliance requirements in different countries and industries, some customer and transaction data need to be saved in the country or designated region and cannot be disclosed to third parties. Due to these compliance requirements, cross-border e-commerce operation systems in certain industries need to geographically isolate various data.

[0004] Because e-commerce operation management requires personnel in multiple positions to log in to the operation management platform to manage related businesses, such as different suppliers providing different goods for stores in different regions, some suppliers only serving stores in a certain region, and some suppliers needing to provide goods for stores across regions. Store operation personnel such as customer service, order processing, and financial personnel may provide various services to customers of different or cross-regional stores in different countries. This relationship between operation personnel and stores can be one-to-many or many-to-many. These personnel need to access the corresponding system for business processing every day, and if there is no method for logging into multiple remote systems at once, the operation efficiency will be very low. The common processing methods are: different groups of operation personnel use different operation management platforms; switch between different operation management platforms.

[0005] The existing SSO (Single Sign On) design generally logs in through a login server and then uses the token formed after login to access other services. All other services within the scope of the SSO use the token after the login server login by default. However, due to different policy compliance requirements in each country and region, the design of single sign-on with all login account data in a centralized login server cannot meet the compliance requirements of cross-border business processing in certain industries. Therefore, the current SSO design can meet the requirements in a single country and region, but it becomes unfeasible when dealing with cross-border business processing in certain industries. SUMMARY

[0006] The application aims to provide a cross-border multi-store operation management platform account single sign-on processing system and method, which can meet the compliance requirements of different regions and different industries and improve user experience.

[0007] To achieve the above-mentioned purpose, the application provides the following solutions:

[0008] A cross-border multi-store operation management platform account single sign-on processing system comprises a login scheduling server and a scheduling service management unit, a login service management unit, a login data synchronization unit and a communication management unit connected with the login scheduling server.

[0009] The scheduling service management unit is configured to assign a login scheduling server to a region field in a login request according to a set scheduling algorithm after receiving the login request, and the login scheduling server is configured to assign a single sign-on server in the region corresponding to the region field to process the login request.

[0010] The login service management unit is configured to assign a single sign-on server to a login request according to a set scheduling algorithm after receiving the login request, and the single sign-on server is configured to perform single sign-on in the region where the login account data is located according to the login request.

[0011] The login data synchronization unit is configured to pack, encrypt and decrypt the login information and distribute it to the login scheduling server in the specified or all regions when receiving a user login information update request, and write or update the related data in the single sign-on server in the region through the login data synchronization unit of the receiver.

[0012] The communication management unit is configured to manage the symmetric and asymmetric encryption algorithms, communication protocols, and communication message processing methods for encapsulation and decapsulation used in the communication process according to different compliance requirements.

[0013] Further, the scheduling service management unit is also configured to maintain all login scheduling servers, and all login scheduling servers notify the unit when they are online or offline.

[0014] Further, the scheduling service management unit is configured to assign a login scheduling server to a region field in a login request according to a set scheduling algorithm after receiving the login request, and the login scheduling server is configured to assign a single sign-on server in the region corresponding to the region field to process the login request.

[0015] Obtain the region code field in the login message.

[0016] Find the alive login scheduling server in the specified region through the region code.

[0017] Judge whether there is a live login scheduling server in the specified area, if yes, assign the login scheduling server through the area field using the set scheduling algorithm, if no, return the login failure.

[0018] Further, the login service management unit is further used for maintaining all single sign-on servers, saving the compliance requirements according to geographical data, maintaining one or more single sign-on servers in a scheduling range in a local database, and notifying the unit when all single sign-on servers are online or offline.

[0019] Further, the single sign-on server comprises a login management unit, an application management unit and a communication packaging unit.

[0020] The login management unit is used for parsing and verifying the login request after receiving the login request, returning the application access token in the requested login management range if the login state of the request terminal is still in the valid period, performing the login operation according to the login request if the login state has expired, returning the login token if the login is successful, and returning the application access token and the permission by the application management unit;

[0021] The application management unit is used for maintaining all application servers supporting unified login management, notifying the unit when all application servers are online or offline, returning the application access token and the permission by the application management unit after the login management unit succeeds in login, and enabling the request terminal to communicate with the application server.

[0022] The communication packaging unit is used for managing the symmetric and asymmetric encryption algorithms, communication protocols, and packaging and unpackaging communication messages used in the communication process according to different protocol requirements.

[0023] The application further provides a cross-border multi-store operation management platform account single sign-on processing method applied to the cross-border multi-store operation management platform account single sign-on processing system, and comprising the following steps:

[0024] S1, the login scheduling server transmits the login request to the single sign-on server in the corresponding area through the region information in the user login information.

[0025] S2, different resource servers in the local area request to be processed by the single sign-on server in the local area, and multiple logins are not required.

[0026] S3, when the business in the local area is completed and the business in different areas needs to be processed, the single sign-on server in the local area is logged out, or automatically logged out after timeout.

[0027] S4, re-logins automatically by switching to the single sign-on server of the corresponding region through the login dispatch server of step S1, and the state in the single sign-on server of the current region is not synchronized to the single sign-on server of the isolated region.

[0028] Further, before step S1, the method further comprises, after receiving the login request, assigning the login dispatch server to the region field in the login request according to a set dispatch algorithm, and specifically comprising:

[0029] obtaining the region field in the login message;

[0030] finding the live login dispatch server in the specified region through the region code;

[0031] judging whether there is a live login dispatch server in the specified region, if yes, assigning the login dispatch server to the region field according to the set dispatch algorithm, and if no, returning a login failure.

[0032] Further, the method further comprises, the single sign-on server performing single sign-on of the region where the login account data is located according to the login request, and specifically comprising:

[0033] after receiving the login request, parsing and verifying the login request, if the login state of the request terminal is still within the valid period, returning the application access token requested in the login management range; if the login state has expired, performing a login operation according to the login request, if the login is successful, returning the login token, and returning the application access token and the permission by the application management unit, so that the request terminal communicates with the application server.

[0034] According to the embodiments provided by the application, the cross-border multi-store operation management platform account single sign-on processing system and method disclosed by the application have the following technical effects:

[0035] (1) one login dispatch server can distribute the login request to the single sign-on server of the region where the login account data is located;

[0036] (2) the login dispatch server adopts a distributed cluster design, can be deployed on the same physical server as each single sign-on server, reduces the deployment cost, improves the response speed, and at the same time increases the disaster recovery function, when one dispatch server stops running, other deployments can provide services in time;

[0037] (3) The login account data can be saved on a regional login server or a multi-regional login server according to business requirements, for example, most suppliers only serve customers in a certain region, but some suppliers need to supply goods to customers in several countries or regions, and users who require single account cross-regional operation can synchronize account information to other login servers when updating account information on a certain server through account synchronization service, thereby improving user experience when updating account data;

[0038] (4) The login server performs single sign-on in the region through login information, and the service request in the region no longer needs to be logged in twice through the standard single sign-on method; the token generated by single sign-on is only saved in the login server in the region, and when the user needs to process cross-regional business after processing the business in the region, the current login server performs logout operation, and simultaneously performs automatic re-login to the target regional login server through the login scheduling server, and the token data of the current login server is not synchronized to the target regional login server, thereby avoiding data leakage; this operation increases the operation amount and waiting time of the login operation, but since the computing power of the current computer is sufficient, the calculation amount and time required by the repeated login algorithm can be ignored, and manual intervention is not required during scheduling, so the influence on user experience can also be ignored, and this method reduces the risk of data leakage and compliance with additional computing power;

[0039] (5) The synchronization service sends an account information synchronization request to the login data synchronization unit of the target region through the login scheduling server, and the login data synchronization unit performs data writing, and does not provide a data reading interface, thereby avoiding the technical possibility of data leakage;

[0040] In summary, the application can meet the compliance requirements of different regions and different industries, and improve user experience. BRIEF DESCRIPTION OF DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the embodiments of the application or the prior art, the following will briefly introduce the drawings needed in the embodiments. Obviously, the drawings in the following description only constitute some embodiments of the application, and for those skilled in the art, other drawings can also be obtained without creative labor.

[0042] Figure 1 The structural block diagram of the cross-border multi-store operation management platform account single sign-on processing system of the application;

[0043] Figure 2 The structural block diagram of the single sign-on server of the application;

[0044] Figure 3 The login scheduling flowchart of the application;

[0045] Figure 4 A cross-border multi-store operation management platform account single sign-on processing flowchart. DETAILED DESCRIPTION

[0046] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0047] The purpose of the present application is to provide a cross-border multi-store operation management platform account single sign-on processing system and method, which can meet the compliance requirements of different regions and different industries, so that users do not feel the geographical isolation of various data, and the user experience is improved.

[0048] In order to make the above-mentioned purposes, features and advantages of the present application more apparent and easy to understand, the present application will be further described in detail below with reference to the drawings and specific embodiments.

[0049] As shown in Figure 1 The cross-border multi-store operation management platform account single sign-on processing system provided by the present application comprises a login scheduling server and a scheduling service management unit, a login service management unit, a login data synchronization unit and a communication management unit connected with the login scheduling server.

[0050] The scheduling service management unit is configured to allocate a login scheduling server to the region code in the login request according to a set scheduling algorithm after receiving the login request, and the login scheduling server is further configured to allocate a single sign-on server in the region corresponding to the region field to process the login request; the scheduling service management unit is also configured to maintain all login scheduling servers, and all login scheduling servers notify this unit when they are online or offline, and provide a keep-alive mechanism. The set scheduling algorithm can adopt a RR scheduling algorithm. The allocation logic of the login scheduling server is to match the region first, and this logic is saved in the database. If there are multiple login scheduling servers in a region, the RR scheduling algorithm is used for dynamic allocation, and if there is no login scheduling server alive in a region, although there are alive servers in other regions, no allocation will be performed. All data of the request is asymmetrically encrypted, the region field after decryption is a plaintext code, and the password field in the login data is a non-plaintext code.

[0051] The login service management unit is configured to allocate a single sign-on server to the login request according to a RR scheduling algorithm or the like after receiving the login request; the single sign-on server is configured to perform single sign-on in a region where the login account data is located according to the login request; and the login service management unit is further configured to maintain all single sign-on servers, save the single sign-on servers that can be in a scheduling range in a local database according to geographical data and compliance requirements, notify the unit when all single sign-on servers are online or offline, and provide a keep-alive mechanism.

[0052] The login data synchronization unit is configured to pack, encrypt and decrypt, and distribute login information to a designated or all regional login scheduling servers when receiving a user login information update request, and write or update related data in the single sign-on server in the region through the login data synchronization unit of the receiver; and the password part in the login data is saved in an encrypted manner.

[0053] The communication management unit is configured to manage symmetric and asymmetric encryption algorithms, communication protocols, and communication message processing methods for packaging and unpackaging used in the communication process according to different compliance requirements. Corresponding technical methods are used according to different compliance requirements.

[0054] As shown in Figure 2 The single sign-on server includes a login management unit, an application management unit, and a communication packaging unit.

[0055] The login management unit is configured to parse and verify the login request after receiving the login request, return an application access token requested in the login management range if the login state of the request terminal is still within the valid period, perform a login operation according to the login request if the login state has expired, return a login token if the login is successful, and return an application access token and permission by the application management unit.

[0056] The application management unit is configured to maintain all application servers supporting unified login management, notify the unit when all application servers are online or offline, return an application access token and permission by the application management unit after the login management unit succeeds in login, and enable the request terminal to communicate with the application server.

[0057] The communication packaging unit is configured to manage symmetric and asymmetric encryption algorithms, communication protocols, and communication message processing methods for packaging and unpackaging used in the communication process according to different protocol requirements. Corresponding technical methods are used according to different protocol requirements.

[0058] As shown in Figure 4As shown, the application also provides a cross-border multi-store operation management platform account single sign-on processing method, applied to the cross-border multi-store operation management platform account single sign-on processing system, comprising the following steps:

[0059] S1, the login scheduling server transmits the login request to the single sign-on server in the corresponding region through the region information in the user login information;

[0060] S2, different resource servers in the region request processing through the single sign-on server in the region, without multiple logins;

[0061] S3, when the business in the region is completed and the business in different regions needs to be processed, log out from the single sign-on server in the region, or automatically log out after timeout;

[0062] S4, through the login scheduling server in step S1, the corresponding region single sign-on server is connected, and the state in the current region single sign-on server is automatically logged in again. The single sign-on server in the isolated region is not synchronized.

[0063] The method further comprises, after receiving the login request, assigning a login scheduling server to the region code in the login request according to a set scheduling algorithm, such as Figure 3 As shown, it specifically comprises:

[0064] Obtain the region code field in the login message;

[0065] Find the alive login scheduling server in the specified region through the region code;

[0066] Determine whether there is a live login scheduling server in the specified region, if yes, assign a login scheduling server to the region field using a set scheduling algorithm; if not, return login failure.

[0067] The method further comprises, the single sign-on server performs single sign-on of the region where the login account data is located according to the login request, comprising:

[0068] After receiving the login request, parse and verify the login request, if the login state of the request terminal is still within the valid period, return the application access token requested in the login management range; if the login state has expired, perform login operation according to the login request, if the login is successful, return the login token, and the application management unit returns the application access token and the permission, so that the request terminal communicates with the application server.

[0069] The login scheduling server distributes login requests to single sign-on servers in the region where the login account data is located, and the region where the login account data is located includes one region or multiple different regions; for example, the login scheduling server can be designed in a distributed cluster, and can be deployed on the same physical server as each single sign-on server, thereby reducing deployment costs, improving response speed, and increasing disaster recovery functions; when one scheduling server stops running, other deployed servers can provide services in a timely manner.

[0070] The single sign-on server performs single sign-on in the region where the login account data is located according to the login request. The login account data can be saved on a single sign-on server in a region or on a multi-region server according to business requirements. For example, most suppliers only serve customers in a certain region, but some suppliers need to supply goods to customers in several countries or regions. Users who require single account cross-region operation can synchronize account information to other single sign-on servers when updating account information on a certain server through account synchronization services, thereby improving user experience when updating account data.

[0071] The single sign-on server performs single sign-on in the region through a login request, and service requests in the region no longer need to be logged in twice through a standard single sign-on method. The token generated by the single sign-on is only saved in the single sign-on server in the region. When the user needs to process cross-region business after processing the business in the region, the current single sign-on server performs logout operation, and simultaneously performs automatic re-login to the single sign-on server in the target region through the login scheduling server. The token data of the current single sign-on server is not synchronized to the single sign-on server in the target region, thereby avoiding data leakage. This operation increases the calculation amount and waiting time of the login operation, but since the computing power of the current computer is sufficient, the calculation amount and time required by the repeated login algorithm can be ignored, and manual intervention is not required during scheduling, so the influence on user experience can also be ignored. This method uses additional computing power to reduce the risk of data leakage and compliance.

[0072] The login data synchronization unit sends a login information synchronization request to the single sign-on server in the destination through the login scheduling server, and the login data synchronization unit performs data writing, and does not provide a data reading interface, thereby avoiding the technical possibility of data leakage.

[0073] The principles and implementation modes of the present application are described by using specific examples in this paper, and the above examples are only used to help understand the method and core idea of the present application; meanwhile, for those skilled in the art, according to the idea of the present application, the specific implementation mode and application range can be changed. In summary, the content of the specification should not be understood as a limitation of the present application.

Claims

1. A cross-border multi-store operation management platform account single sign-on processing system, characterized in that, The application relates to a login scheduling server and a single-point server in different regions. Each login scheduling server comprises a scheduling service management unit, a login service management unit, a login data synchronization unit and a communication management unit. The login scheduling server accepts a login request in a region, and distributes a login scheduling server corresponding to a region code in the login request according to a set scheduling algorithm. The scheduling service management unit is used for distributing a login scheduling server corresponding to a region code in a login request according to a set scheduling algorithm after receiving the login request. The login service management unit is used for distributing a single-point login server in a region corresponding to a region code in a login request according to a set scheduling algorithm after receiving the login request. The single-point login server performs single-point login in a region of a login account data according to the login request, and specifically comprises the following steps: The single-point login server performs single-point login in the region through the login request, and service requests in the region no longer need secondary login through a standard single-point login method; token generated by the single-point login is saved in the single-point login server in the region; when a user needs to process cross-region business after processing business in the region, the current single-point login server performs logout operation, and automatically relogs into a single-point login server in a target region through the login scheduling server; token data in the current single-point login server is not synchronized to the single-point login server in the target region; The login data synchronization unit is used for packing, encrypting and decrypting login information, and distributing the login information to specified or all login scheduling servers in regions, and writing or updating related data in the single-point login server in the region through a login data synchronization unit of a receiving end. The communication management unit is used for managing symmetric and asymmetric encryption algorithms, communication protocols, encapsulation and de-encapsulation communication message processing methods used in a communication process according to different compliance requirements. The scheduling service management unit is also used for maintaining all login scheduling servers, and all login scheduling servers notify the unit when being online or offline. 2.The cross-border multi-store operation management platform account single sign-on processing system of claim 1, characterized in that, The scheduling service management unit is used for distributing a login scheduling server corresponding to a region code in a login request according to a set scheduling algorithm after receiving the login request, and specifically comprises the following steps: 3.The cross-border multi-store operation management platform account single sign-on processing system of claim 1, characterized in that, A region code in a login message is acquired; A living login scheduling server in a specified region is searched through the region code; It is judged whether there is a living login scheduling server in the specified region, if yes, a login scheduling server is distributed through the region code and a set scheduling algorithm, and if not, a login failure is returned. The login service management unit is also used for maintaining all single-point login servers, and according to geographical data, compliance requirements are saved to maintain one or more single-point login servers in a scheduling range in a local database, and all single-point login servers notify the unit when being online or offline.

4. The cross-border multi-store operation management platform account single sign-on processing system of claim 1, wherein, ​ 5. The cross-border multi-store operation management platform account single sign-on processing system of claim 1, wherein, The single sign-on server comprises a login management unit, an application management unit and a communication encapsulation unit; The login management unit is configured to, after receiving a login request, parse and verify the login request, and if the login state of the requesting terminal is still within a valid period, return an application access token of the requested application within the login management range; If the login state has expired, perform a login operation according to the login request, and if the login is successful, return a login token, and the application management unit returns an application access token and permissions; The application management unit is configured to maintain all application servers supporting unified login management, and all application servers notify the unit when they are online or offline, and the login management unit returns an application access token and permissions through the application management unit after a successful login, so that the requesting terminal communicates with the application server; The communication encapsulation unit is configured to manage symmetric and asymmetric encryption algorithms, communication protocols, and encapsulation and decapsulation of communication messages used in the communication process according to different protocol requirements. 6.A method for single sign-on processing of an account of a cross-border multi-store operation management platform, applied to the single sign-on processing system of the cross-border multi-store operation management platform account according to any one of claims 1-5, characterized in that, The method comprises the following steps: S1, the login dispatching server transmits the login request to the single sign-on server in the corresponding region according to the region information in the user login information; S2, different resource servers in the region request processing through the single sign-on server in the region, and do not need to log in multiple times; S3, when the business in the region is completed and the business in different regions needs to be processed, log out from the single sign-on server in the region, or automatically log out after a timeout; S4, re-log in automatically through the login dispatching server in step S1 to the single sign-on server in the corresponding region, and the state in the current region single sign-on server is not synchronized to the single sign-on server in the isolated region. 7.The cross-border multi-store operation management platform account single sign-on processing method according to claim 6, characterized in that, Before step S1, the method further comprises, after receiving a login request, assigning a login dispatching server to the region code in the login request according to a set dispatching algorithm, specifically comprising: Obtain the region code in the login message; Find the live state login dispatching server in the specified region through the region code; Determine whether there is a live login dispatching server in the specified region, if yes, assign a login dispatching server to the region code according to the set dispatching algorithm, and if no, return a login failure. 8.The method of claim 6, wherein, The method further comprises that the single sign-on server performs single sign-on of the region where the login account data is located according to the login request, specifically comprising: After receiving a login request, parse and verify the login request, and if the login state of the requesting terminal is still within a valid period, return an application access token of the requested application within the login management range; If the login state has expired, perform a login operation according to the login request, and if the login is successful, return a login token, and the application management unit returns an application access token and permissions, so that the requesting terminal communicates with the application server.

Images