Single sign-on method, device, and readable storage medium

Abstract

The present application discloses a single sign-on method, device, and readable storage medium, relating to the field of communication technology, and for improving the security of single sign-on. The method comprises: receiving a first request message sent by a portal server, authenticating the portal server based on the portal server's system identifier and access key, and creating a second mapping relationship if the portal server successfully authenticates the portal server and the authentication server stores a first mapping relationship; sending authentication credentials to the portal server so that the portal server sends an access request message to an application system to be accessed; and upon receiving a second request message sent by the application system to be accessed and if the application system successfully authenticates the portal server, sending a second user identifier to the application system to be accessed based on the authentication credentials and the second mapping relationship.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of communication technology, and in particular to a single sign-on method, device, and readable storage medium. Background Art

[0002] Single sign-on (SSO) allows users to access multiple mutually trusted application systems by logging in only once. These systems typically have a primary authentication system (referred to as an authentication server, hereinafter referred to as the same) that authenticates users. Once a user is successfully authenticated, the authentication server notifies the multiple trusted application systems of the user's authentication through the mutual trust mechanism between the application systems. The application systems then establish a user session, eliminating the need for users to re-enter their username and password to access other application systems.

[0003] For example, after the authentication server authenticates the user, it will send an authentication credential (ticket) to the portal server used by the user. When the user uses the portal server to access the application system, the portal server will send the authentication credential to the application system. After receiving the user's access request, the application system will send the ticket to the authentication server for verification, and if the ticket verification passes, the user's access request will be approved.

[0004] However, if the ticket is obtained by an illegal system, the illegal system can directly use the ticket to access the application system, which is less secure. Summary of the Invention

[0005] The present application provides a single sign-on method, device, and readable storage medium for improving the security of single sign-on.

[0006] To achieve the above objectives, this application adopts the following technical solutions:

[0007] In a first aspect, a single sign-on method is provided, comprising: receiving a first request message sent by a portal server; the first request message comprises a system identifier of an application system to be accessed, a system identifier of the portal server, an access key, an IP address of a terminal, and a first user identifier, the first request message being used to request authentication credentials, the authentication credentials being used to access the application system to be accessed associated with the authentication server, the first user identifier being the user identifier of the user to be authenticated on the authentication server; authenticating the portal server according to the system identifier and the access key of the portal server, and creating a second mapping relationship when the portal server authentication is passed and the authentication server stores the first mapping relationship; the first mapping relationship comprises a first user identifier and a second user identifier, the second user identifier being the user identifier of the user to be authenticated on the application system to be accessed, and the second mapping relationship being the first user identifier The relationship includes authentication credentials, the system identifier of the application system to be accessed, the terminal IP address and the second user identifier; the authentication credentials are sent to the portal server so that the portal server sends an access request message to the application system to be accessed; the access request message includes authentication credentials, and the access request message is used to request access to the target content in the application system to be accessed; upon receiving the second request message sent by the application system to be accessed and the application system to be accessed is authenticated, the second user identifier is sent to the application system to be accessed according to the authentication credentials and the second mapping relationship, so that the application system to be accessed authenticates the user to be authenticated according to the second user identifier, and if the user to be authenticated is authenticated, the target content is displayed on the terminal interface of the user to be authenticated; the second request message includes authentication credentials, the system identifier of the application system to be accessed and the access key.

[0008] Optionally, the method also includes: when the authentication server does not store the first mapping relationship, sending a registration request message to the application system to be accessed; the registration request message includes the first user identifier and the system identifier of the portal server; the registration request message is used to request the application system to be accessed to create a second user identifier; receiving the second user identifier sent by the application system to be accessed, and creating a first mapping relationship based on the second user and the first user identifier.

[0009] Optionally, the method further includes: receiving a third request message sent by the portal server, the third request message being used to request authentication of the user to be authenticated and the portal server; and when both the user to be authenticated and the portal server are authenticated successfully, sending a first indication message to the portal server, the first indication message being used to instruct the portal server to display multiple application systems on the terminal interface, and the portal server being used to send the first request message to the portal server based on the user's click operation on the application system to be accessed.

[0010] Optionally, the authentication credentials are configured with a validity period, and the method further includes: receiving a second indication message sent by the portal server; the second indication message is used to instruct the authentication server to update the validity period of the authentication credentials and obtain the updated authentication credentials; upon receiving a third request message sent by the application system to be accessed, sending the updated authentication credentials to the application system to be accessed; the third request message is used to request to update the authentication credentials.

[0011] Based on the technical solution provided in this application, after receiving the first request message sent by the portal server, the portal server can be authenticated based on the portal server's system identifier and access key. Since the portal server's access key cannot be counterfeited, this prevents illegal systems from obtaining authentication credentials. Furthermore, if the portal server authentication is successful and the authentication server stores the first mapping relationship, a second mapping relationship is created. Since the first mapping relationship includes a first user identifier and a second user identifier, the second user identifier is the user identifier of the user to be authenticated in the application system to be accessed. In this way, it can be confirmed that the user to be authenticated is a registered user in the authentication system. Furthermore, the authentication credentials are sent to the portal server so that the portal server sends an access request message to the application system to be accessed. The access request message includes the authentication credentials and is used to request access to the target content in the application system to be accessed. In this way, the portal server can access the target content in the application system to be accessed using the authentication credentials. Finally, if the portal server receives the second request message sent by the application system to be accessed and the application system to be accessed is authenticated, the second user identifier is sent to the application system to be accessed based on the authentication credentials and the second mapping relationship. In this way, since the second request message includes the system identification and access key of the application system to be accessed, the access key of the application system to be accessed cannot be forged. Even if the access application system that has intercepted the authentication credentials is an illegal system, the illegal system cannot directly use the authentication credentials to access the application system to be accessed associated with the authentication server, thereby improving the security of single sign-on.

[0012] In a second aspect, a single sign-on device is provided, which includes: a receiving unit, an authentication unit, a processing unit, and a sending unit; the receiving unit is used to receive a first request message sent by a portal server; the first request message includes a system identifier of an application system to be accessed, a system identifier of the portal server, an access key, an IP address of a terminal, and a first user identifier, the first request message is used to request authentication credentials, the authentication credentials are used to access the application system to be accessed associated with the authentication server, and the first user identifier is the user identifier of the user to be authenticated on the authentication server; the authentication unit is used to authenticate the portal server according to the system identifier and the access key of the portal server; the processing unit is used to create a second mapping relationship when the portal server authentication is passed and the authentication server stores the first mapping relationship; the first mapping relationship includes the first user identifier and the second user identifier, the second user identifier is the user identifier of the user to be authenticated on the application system to be accessed the user identifier of the application system to be accessed, the second mapping relationship includes the authentication credentials, the system identifier of the application system to be accessed, the terminal IP address and the second user identifier; the sending unit is used to send the authentication credentials to the portal server, so that the portal server sends an access request message to the application system to be accessed; the access request message includes the authentication credentials, and the access request message is used to request access to the target content in the application system to be accessed; the receiving unit is also used to, upon receiving the second request message sent by the application system to be accessed and the application system to be accessed is authenticated, send the second user identifier to the application system to be accessed according to the authentication credentials and the second mapping relationship, so that the application system to be accessed authenticates the user to be authenticated according to the second user identifier, and displays the target content on the terminal interface of the user to be authenticated if the user to be authenticated is authenticated; the second request message includes the authentication credentials, the system identifier of the application system to be accessed and the access key.

[0013] Optionally, the sending unit is further used to send a registration request message to the application system to be accessed when the authentication server does not store the first mapping relationship; the registration request message includes the first user identifier and the system identifier of the portal server; the registration request message is used to request the application system to be accessed to create a second user identifier; the receiving unit is further used to receive the second user identifier sent by the application system to be accessed, and create a first mapping relationship based on the second user and the first user identifier.

[0014] Optionally, the receiving unit is further used to receive a third request message sent by the portal server, the third request message being used to request authentication of the user to be authenticated and the portal server; the sending unit is further used to send a first indication message to the portal server when both the user to be authenticated and the portal server are authenticated successfully, the first indication message being used to instruct the portal server to display multiple application systems on the terminal interface, and the portal server being used to send the first request message to the portal server based on the user's click operation on the application system to be accessed.

[0015] Optionally, the authentication credentials are configured with a validity period; the receiving unit is further used to receive a second indication message sent by the portal server; the second indication message is used to instruct the authentication server to update the validity period of the authentication credentials and obtain the updated authentication credentials; the sending unit is further used to send the updated authentication credentials to the application system to be accessed when receiving a third request message sent by the application system to be accessed; the third request message is used to request to update the authentication credentials.

[0016] On the third aspect, a single sign-on device is provided, which can implement the functions performed by the single sign-on device in the above-mentioned aspects or possible designs. The functions can be implemented through hardware, such as: in one possible design, the single sign-on device may include: a processor and a communication interface, and the processor can be used to support the single sign-on device to implement the functions involved in the above-mentioned first aspect or any possible design of the first aspect.

[0017] In another possible design, the single sign-on device may further include a memory for storing computer-executable instructions and data necessary for the single sign-on device. When the single sign-on device is running, the processor executes the computer-executable instructions stored in the memory to cause the single sign-on device to perform the first aspect or any possible single sign-on method of the first aspect.

[0018] In a fourth aspect, a computer-readable storage medium is provided, which may be a readable non-volatile storage medium. The computer-readable storage medium stores computer instructions or programs, which, when run on a computer, enables the computer to execute the first aspect or any possible single sign-on method of the above aspects.

[0019] In a fifth aspect, a computer program product comprising instructions is provided, which, when executed on a computer, enables the computer to execute the single sign-on method according to the first aspect or any possible design of the above aspects.

[0020] In a sixth aspect, an electronic device is provided, comprising one or more processors and one or more memories. The one or more memories are coupled to the one or more processors, and the one or more memories are configured to store computer program code. The computer program code comprises computer instructions. When the one or more processors execute the computer instructions, the electronic device performs the single sign-on method described in the first aspect or any possible design of the first aspect.

[0021] In a seventh aspect, a chip system is provided, comprising a processor and a communication interface. The chip system can be used to implement the functions performed by the single sign-on device in the first aspect or any possible design of the first aspect. In one possible design, the chip system also includes a memory for storing program instructions and / or data. The chip system can be composed of a chip alone or include a chip and other discrete components, without limitation. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 A flowchart of a single sign-on method provided in an embodiment of the present application;

[0023] Figure 2 A schematic diagram of the structure of a single sign-on system provided in an embodiment of the present application;

[0024] Figure 3 A schematic diagram of the structure of an authentication server provided in an embodiment of the present application;

[0025] Figure 4 A flowchart of another single sign-on method provided in an embodiment of the present application;

[0026] Figure 5 A flowchart of another single sign-on method provided in an embodiment of the present application;

[0027] Figure 6 A flowchart of another single sign-on method provided in an embodiment of the present application;

[0028] Figure 7 A flowchart of another single sign-on method provided in an embodiment of the present application;

[0029] Figure 8 A flowchart of another single sign-on method provided in an embodiment of the present application;

[0030] Figure 9 A flowchart of another single sign-on method provided in an embodiment of the present application;

[0031] Figure 10 A schematic diagram of the structure of a single sign-on device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0032] In order to enable ordinary people in the art to better understand the technical solutions of the present disclosure, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings.

[0033] It should be noted that the terms "first," "second," and the like in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or precedence. It should be understood that the numbers used in this manner are interchangeable where appropriate so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the embodiments of the present application as detailed in the appended claims.

[0034] It will also be understood that the term “comprising” indicates the presence of described features, integers, steps, operations, elements and / or components, but does not preclude the presence or addition of one or more other features, integers, steps, operations, elements and / or components.

[0035] Single sign-on (SSO) allows users to access multiple mutually trusted application systems by logging in only once. These systems typically have a primary authentication system (referred to as an authentication server, hereinafter referred to as the same) that authenticates users. Once a user is successfully authenticated, the authentication server notifies the multiple trusted application systems of the user's authentication through the mutual trust mechanism between the application systems. The application systems then establish a user session, eliminating the need for users to re-enter their username and password to access other application systems.

[0036] For example, Figure 1 As shown, after the authentication server determines that the user authentication is successful based on the authentication information, it will send an authentication credential (ticket) to the portal server used by the user. When the user uses the portal server to access the application system (for example, it can include application system 1, application system 2, and application system 3), the portal server will send the authentication credential to the application system. After receiving the user's access request, the application system will send the authentication credential to the authentication server for authentication, and if the authentication credential is successful, the user's access request will be approved.

[0037] However, if the ticket is obtained by an illegal system, the illegal system can directly use the ticket to access the application system, which is less secure.

[0038] Secondly, after the authentication server completes the authentication of a user logging into the application system, it no longer interacts with the application system, making it impossible to determine the user's activity status within the application system. Because different application systems have different monitoring strategies, some application systems automatically go offline after a few minutes of inactivity, while others maintain the user's login status even after extended periods of inactivity (even after all pages are closed), resulting in a lack of unified security control strategies.

[0039] In addition, after a new user registers on the authentication server, their information is not automatically synchronized with the application system. New users cannot jump to the application system through single sign-on, which reduces flexibility.

[0040] In view of this, an embodiment of the present application provides a single sign-on method, including:

[0041] Receive a first request message sent by the portal server; the first request message includes the system identifier of the application system to be accessed, the system identifier of the portal server, the access key, the terminal IP address and the first user identifier, the first request message is used to request authentication credentials, the authentication credentials are used to access the application system to be accessed associated with the authentication server, the first user identifier is the user identifier of the user to be authenticated on the authentication server; authenticate the portal server according to the system identifier and the access key of the portal server, and create a second mapping relationship when the portal server authentication is passed and the authentication server stores the first mapping relationship; the first mapping relationship includes the first user identifier and the second user identifier, the second user identifier is the user identifier of the user to be authenticated in the application system to be accessed, the second mapping relationship includes the authentication credentials, the system identifier to be authenticated The system identifier, terminal IP address and second user identifier of the access application system; sending authentication credentials to the portal server so that the portal server sends an access request message to the application system to be accessed; the access request message includes authentication credentials, and the access request message is used to request access to the target content in the application system to be accessed; upon receiving the second request message sent by the application system to be accessed and the application system to be accessed is authenticated, the second user identifier is sent to the application system to be accessed according to the authentication credentials and the second mapping relationship, so that the application system to be accessed authenticates the user to be authenticated according to the second user identifier, and if the user to be authenticated is authenticated, the target content is displayed on the terminal interface of the user to be authenticated; the second request message includes authentication credentials, the system identifier and access key of the application system to be accessed.

[0042] The method provided in the embodiments of the present application is described in detail below with reference to the accompanying drawings.

[0043] It should be noted that the network system described in the embodiment of the present application is intended to more clearly illustrate the technical solution of the embodiment of the present application, and does not constitute a limitation on the technical solution provided in the embodiment of the present application. Ordinary technicians in this field can know that with the evolution of network systems and the emergence of other network systems, the technical solution provided in the embodiment of the present application is also applicable to similar technical problems.

[0044] Figure 2 FIG. 1 is a schematic diagram of a single sign-on system 10 provided in an embodiment of the present application. Figure 2 As shown, the single sign-on system 10 may include a terminal 11, a portal server 12, an authentication server 13, and an application system to be accessed 14. The terminal 11, the portal server 12, the authentication server 13, and the application system to be accessed 14 are interconnected. For example, the terminal 11, the portal server 12, the authentication server 13, and the application system to be accessed 14 may be connected wirelessly.

[0045] Among them, the terminal 11 can be used to log in to the portal server and one or more application systems associated with the authentication server after being authenticated by the authentication server based on the first user identification and user password input by the user to be authenticated. For example, it can also be called a terminal, a mobile station (MS), a mobile terminal (MT), etc., which is a device that provides voice and / or data connectivity to the user. For example, the terminal 11 can be a handheld device with wireless connection function, a vehicle-mounted device, etc. Specifically, it can be: a smart phone (mobile phone), a pocket personal computer (PPC), a handheld computer, a personal digital assistant (PDA), a laptop computer, a tablet computer, a wearable device, or a vehicle-mounted device, etc. The embodiments of the present application do not limit the specific technology, specific number and specific device form adopted by the terminal 11.

[0046] The authentication server 13 may be used to authenticate the user to be authenticated and the portal server 12 .

[0047] There may be one or more application systems 14 to be accessed, and the application systems 14 are used to display target content on the terminal interface of the user to be authenticated.

[0048] It should be noted that Figure 2 This is just an illustrative framework diagram. Figure 2 The names of the devices included in the Figure 2 In addition to the functional nodes shown, other nodes may also be included, which is not limited in the embodiments of the present application.

[0049] It should be noted that Figure 2 This is just an illustrative framework diagram. Figure 2 The names of the modules included in the Figure 2 In addition to the functional modules shown, other modules may also be included, which is not limited in the embodiments of the present application.

[0050] When implementing it specifically, Figure 2 Each device in the Figure 3 The structure shown, or including Figure 3 Parts shown. Figure 3 The present invention provides a schematic diagram of the composition of an authentication server 200, which can be a server, or a chip or system on chip in the server. Figure 3 As shown, the authentication server 200 includes a processor 201 , a communication interface 202 and a communication line 203 .

[0051] Furthermore, the authentication server 200 may further include a memory 204 , wherein the processor 201 , the memory 204 and the communication interface 202 may be connected via a communication line 203 .

[0052] The processor 201 is a CPU, a general-purpose processor, a network processor (NP), a digital signal processor (DSP), a microprocessor, a microcontroller, a programmable logic device (PLD), or any combination thereof. The processor 201 may also be other devices with processing functions, such as circuits, devices, or software modules, without limitation.

[0053] The communication interface 202 is used to communicate with other devices or other communication networks. The communication interface 202 can be a module, a circuit, a communication interface or any device capable of achieving communication.

[0054] The communication line 203 is used to transmit information between the various components included in the authentication server 200.

[0055] The memory 204 is used to store instructions, where the instructions may be computer programs.

[0056] The memory 204 may be a read-only memory (ROM) or other type of static storage device that can store static information and / or instructions, or a random access memory (RAM) or other type of dynamic storage device that can store information and / or instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compact disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), magnetic disk storage media or other magnetic storage devices, etc., without limitation.

[0057] It should be noted that memory 204 can exist independently of processor 201 or can be integrated with processor 201. Memory 204 can be used to store instructions, program code, or data. Memory 204 can be located within or outside authentication server 200, without limitation. Processor 201 is configured to execute instructions stored in memory 204 to implement the single sign-on method provided in the following embodiments of this application.

[0058] In one example, the processor 201 may include one or more CPUs, for example, Figure 3 CPU0 and CPU1 in.

[0059] As an optional implementation, the authentication server 200 includes multiple processors, for example, Figure 3 In addition to the processor 201, a processor 205 may also be included.

[0060] It should be pointed out that Figure 3 The composition shown in the Figure 2 The limitations of each device in Figure 3 In addition to the parts shown, Figure 2 The individual devices in Figure 3 More or fewer components, or combinations of certain components, or different arrangements of components.

[0061] In the embodiment of the present application, the chip system can be composed of chips, or can include chips and other discrete devices.

[0062] In addition, the actions and terms involved in the various embodiments of this application can refer to each other without limitation. The message names or parameter names in the messages exchanged between the various devices in the embodiments of this application are only examples, and other names can also be used in specific implementations without limitation.

[0063] To facilitate the clear description of the technical solutions of the embodiments of the present application, in the embodiments of the present application, the words "first" and "second" are used to distinguish between identical or similar items with substantially the same functions and effects. Those skilled in the art will understand that the words "first" and "second" do not limit the quantity or execution order, and the words "first" and "second" do not necessarily mean different.

[0064] It should be noted that, in this application, words such as "exemplary" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described in this application as "exemplary" or "for example" should not be construed as being preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0065] In this application, "at least one" means one or more, and "more" means two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0066] The following combination Figure 2 The single sign-on system shown describes the single sign-on method provided in the embodiment of the present application.

[0067] Figure 4 The present invention provides a single sign-on method for an authentication server. Figure 2 The authentication server 13 in the embodiment of the present application can also be a device in the authentication server 13, such as a chip. Figure 4 As shown, the method includes the following S301-S304:

[0068] S301: The authentication server receives a first request message sent by a portal server.

[0069] The first request message is used to request authentication credentials, which are used to access the application system to be accessed, which is associated with the authentication server. The first request message may include the system identifier of the application system to be accessed, the system identifier of the portal server, an access key, the terminal IP address, and a first user identifier. The first user identifier is the user identifier of the user to be authenticated on the authentication server.

[0070] For example, the system ID of the application system to be accessed may be sysid1. The system ID and access key of the portal server may be sysid and secret respectively. The terminal IP address may be 10.0.0.1. The first user ID may be abc.

[0071] As a possible implementation manner, the authentication server may receive the first request message sent by the portal server through an application program interface (API).

[0072] In actual applications, the console interface of the portal server is embedded with login icons of multiple application systems. When the portal server receives a click operation from the user to access the application system, it sends a first request message to the authentication server. Correspondingly, the authentication server receives the first request message sent by the portal server.

[0073] S302: The authentication server authenticates the portal server according to the system identifier and access key of the portal server, and creates a second mapping relationship if the portal server passes the authentication and the authentication server stores the first mapping relationship.

[0074] The first mapping relationship includes a first user identifier and a second user identifier, where the second user identifier is the user identifier of the user to be authenticated in the application system to be accessed, for example, abc1.

[0075] In an example, the first mapping relationship may be as shown in Table 1 below.

[0076] Table 1 First mapping relationship table

[0077]

[0078] It should be noted that the data in Table 1 are merely exemplary. In the embodiment of the present application, the first user identifier and the second user identifier may also be other identifiers without limitation.

[0079] The second mapping relationship includes the authentication credentials, the system identifier of the application system to be accessed, the terminal IP address and the second user identifier. The system identifier of the application system to be accessed, the terminal IP address and the second user identifier can be stored in the form of a data object combination.

[0080] In one example, when the authentication credential is 123456, the system identifier of the application system to be accessed is sysid1, the second user identifier is abc1, and the terminal IP address is 10.0.0.1, the second mapping relationship may be as shown in Table 2 below:

[0081] Table 2 Second mapping relationship table

[0082]

[0083] It should be noted that the data in Table 2 is only exemplary. In the embodiment of the present application, the combination of authentication credentials and data objects can also be other mapping methods, which are not limited.

[0084] In practical applications, the second mapping relationship is further provided with a validity period, for example, 5 minutes.

[0085] As a possible implementation manner, the authentication server may compare the system identifier and access key of the portal server with the system identifier and access key of the portal server pre-stored internally, and authenticate the portal server based on the comparison result.

[0086] It should be noted that if the comparison result shows that the system identifier and access key of the portal server are the same as the system identifier and access key of the portal server stored internally, then the portal server authentication is determined to be successful. If the comparison result shows that the system identifier and access key of the portal server are different from the system identifier and access key of the portal server stored internally, then the portal server authentication is determined to be unsuccessful.

[0087] S303: The authentication server sends the authentication credentials to the portal server, so that the portal server sends an access request message to the application system to be accessed.

[0088] The access request message is used to request access to target content (eg, internal data) in the application system to be accessed. The access request message may include authentication credentials, terminal IP address, and system identification and access key of the portal server.

[0089] As a possible implementation, the authentication server can send authentication credentials to the portal server via an API interface. Furthermore, the portal server can locate the application system to be accessed via a uniform resource locator (URL), and then send an access request message to the application system to be accessed.

[0090] In actual applications, the portal server may also encrypt the access request message using a preset encryption algorithm. The preset encryption algorithm may be set as needed, for example, a symmetric encryption algorithm, an asymmetric encryption algorithm, etc.

[0091] S304. When the authentication server receives the second request message sent by the application system to be accessed and the application system to be accessed passes the authentication, the authentication server sends the second user identifier to the application system to be accessed according to the authentication credentials and the second mapping relationship, so that the application system to be accessed authenticates the user to be authenticated according to the second user identifier, and displays the target content on the terminal interface of the user to be authenticated if the user to be authenticated passes the authentication.

[0092] The second request message includes authentication credentials and may also include a system identifier, an access key, a terminal IP address, etc. of the application system to be accessed.

[0093] As one possible implementation, the authentication server may compare the system identifier and access key of the application system to be accessed with the system identifier and access key pre-stored internally, and authenticate the application system to be accessed based on the comparison result. Furthermore, if the application system to be accessed successfully authenticates the application system to be accessed, the authentication server may determine the second user identifier corresponding to the authentication credentials from the second mapping relationship and send the second user identifier to the application system to be accessed.

[0094] It should be noted that if the comparison result shows that the system identifier and access key of the application system to be accessed are the same as the system identifier and access key of the application system to be accessed pre-stored internally, the authentication server determines that authentication of the application system to be accessed is successful. If the comparison result shows that the system identifier and access key of the application system to be accessed are different from the system identifier and access key of the application system to be accessed pre-stored internally, the authentication server determines that authentication of the application system to be accessed is unsuccessful.

[0095] As another possible implementation method, the authentication server may compare the system identifier and access key of the application system to be accessed with the system identifier and access key of the application system to be accessed that are pre-stored internally to obtain a first authentication result. Furthermore, the authentication server may compare the system identifier of the application system to be accessed corresponding to the authentication credentials in the second mapping relationship with the system identifier of the application system to be accessed in the second request message to obtain a second authentication result, and compare the terminal IP address corresponding to the authentication credentials in the second mapping relationship with the terminal IP address in the second request message to obtain a third authentication result. The authentication server may determine whether the authentication of the application system to be accessed is successful based on the first authentication result, the second authentication result, and the third authentication result.

[0096] For example, the authentication server may determine that the authentication of the application system to be accessed is passed if the first authentication result, the second authentication result, and the third authentication result are all passed. The authentication server may determine that the authentication of the application system to be accessed is failed if any one of the first authentication result, the second authentication result, and the third authentication result fails.

[0097] It should be noted that if the system identifier and access key of the application system to be accessed are identical to the system identifier and access key of the application system to be accessed that are pre-stored internally, the authentication server determines the first authentication result as authentication passed. If the system identifier and access key of the application system to be accessed are different from the system identifier and access key of the application system to be accessed that are pre-stored internally, the authentication server determines the first authentication result as authentication failed.

[0098] If the system identifier of the application system to be accessed corresponding to the authentication credentials in the second mapping relationship is the same as the system identifier of the application system to be accessed in the second request message, the authentication server determines that the second authentication result is authentication passed. If the system identifier of the application system to be accessed corresponding to the authentication credentials in the second mapping relationship is different from the system identifier of the application system to be accessed in the second request message, the authentication server determines that the second authentication result is authentication failed.

[0099] If the terminal IP address corresponding to the authentication credentials in the second mapping relationship is the same as the terminal IP address in the second request message, the authentication server determines that the third authentication result is authentication passed. If the terminal IP address corresponding to the authentication credentials in the second mapping relationship is different from the terminal IP address in the second request message, the authentication server determines that the third authentication result is authentication failed.

[0100] Furthermore, after accessing the application system to obtain the second user identifier, the second user identifier can be searched in the own database. If the second user identifier exists in the own database and is not a blacklisted user identifier, it is determined that the user to be authenticated has passed the authentication.

[0101] If the second user identifier does not exist in the own database, or the second user identifier is a blacklisted user identifier, it is determined that the authentication of the user to be authenticated has failed.

[0102] Based on the technical solution provided in this application, after receiving the first request message sent by the portal server, the portal server can be authenticated based on the portal server's system identifier and access key. Since the portal server's access key cannot be counterfeited, this prevents illegal systems from obtaining authentication credentials. Furthermore, if the portal server authentication is successful and the authentication server stores the first mapping relationship, a second mapping relationship is created. Since the first mapping relationship includes a first user identifier and a second user identifier, the second user identifier is the user identifier of the user to be authenticated in the application system to be accessed. In this way, it can be confirmed that the user to be authenticated is a registered user in the authentication system. Furthermore, the authentication credentials are sent to the portal server so that the portal server sends an access request message to the application system to be accessed. The access request message includes the authentication credentials and is used to request access to the target content in the application system to be accessed. In this way, the portal server can access the target content in the application system to be accessed using the authentication credentials. Finally, if the portal server receives the second request message sent by the application system to be accessed and the application system to be accessed is authenticated, the second user identifier is sent to the application system to be accessed based on the authentication credentials and the second mapping relationship. In this way, since the second request message includes the system identification and access key of the application system to be accessed, the access key of the application system to be accessed cannot be forged. Even if the access application system that has intercepted the authentication credentials is an illegal system, the illegal system cannot directly use the authentication credentials to access the application system to be accessed associated with the authentication server, thereby improving the security of single sign-on.

[0103] A possible embodiment is as follows Figure 5 As shown, in order to create the first mapping relationship, the single sign-on method of the present application may further specifically include the following S401-S402.

[0104] S401: When the authentication server does not store a first mapping relationship, the authentication server sends a registration request message to the application system to be accessed.

[0105] The registration request message is used to request the application system to be accessed to create a second user ID. The registration request message includes the first user ID and the system ID of the portal server. For example, if the application system to be accessed determines that the system ID of the portal server is associated with the authentication server, it automatically registers the user to be authenticated. For example, if the first user ID is abc, the second user ID can be abc1.

[0106] As a possible implementation method, the authentication server may encrypt the registration request message using a preset encryption algorithm, and send the encrypted registration request message to the application system to be accessed through an API interface.

[0107] S402: The authentication server receives a second user identifier sent by the application system to be accessed, and creates a first mapping relationship according to the second user and the first user identifier.

[0108] As a possible implementation method, the authentication server can receive the second user identifier sent by the application system to be accessed through the API interface. Furthermore, the authentication server can establish a mapping relationship table in the database and store the second user and the first user identifier in the mapping relationship table to create a first mapping relationship.

[0109] In actual applications, the second user identifier may be an encrypted identifier, and the authentication server may decrypt the encrypted identifier using a decryption key to obtain the second user identifier.

[0110] In this way, by creating the first mapping relationship, the corresponding second user ID can be quickly confirmed when the first user ID is entered, which realizes automatic registration of the user on the application system to be accessed without the need for additional user information synchronization, thereby improving the flexibility of single sign-on.

[0111] A possible embodiment is as follows Figure 6 As shown, before sending the authentication credentials to the portal server, in order to authenticate the user to be authenticated and the portal server, the single sign-on method of the present application may further include the following S501-S503.

[0112] S501: The authentication server receives a third request message sent by the portal server.

[0113] The third request message is used to request authentication of the user to be authenticated and the portal server. The third request message may include the first user identifier, the user password, the system identifier of the portal server, and the access key. For example, the first user identifier may be abc, and the user password may be 123321.

[0114] As a possible implementation manner, the authentication server may receive the third request message sent by the portal server through an API interface.

[0115] In actual applications, the third request message may be a message encrypted using a preset encryption algorithm.

[0116] S502: The authentication server authenticates the user to be authenticated and the portal server.

[0117] As a possible implementation method, the authentication server can authenticate the user to be authenticated based on the first user identifier, user password, and the first user identifier and user password pre-stored on the authentication server, and authenticate the portal server based on the system identifier and access key of the portal server, as well as the system identifier and access key of the portal server pre-stored on the authentication server.

[0118] For example, if the first user identifier and user password are identical to the first user identifier and user password pre-stored by the authentication server, the authentication server determines that the user to be authenticated has passed authentication. If the first user identifier and user password are different from the first user identifier and user password pre-stored by the authentication server, the authentication server determines that the user to be authenticated has failed authentication.

[0119] If the system identifier and access key of the portal server are identical to the system identifier and access key of the portal server pre-stored by the authentication server, the authentication server determines that the portal server authentication is successful. If the system identifier and access key of the portal server are different from the system identifier and access key of the portal server pre-stored by the authentication server, the authentication server determines that the portal server authentication has failed.

[0120] S503: When both the user to be authenticated and the portal server are authenticated successfully, the authentication server sends a first indication message to the portal server.

[0121] The first instruction message is used to instruct the portal server to display multiple application systems on the terminal interface, and the portal server is used to send a first request message to the portal server based on the user's click operation on the application system to be accessed.

[0122] As a possible implementation manner, the authentication server may send the first indication message to the portal server through an API interface.

[0123] In the case that the authentication of the user to be authenticated or the portal server fails, the authentication server may send a third indication message to the portal server.

[0124] For example, if the user to be authenticated fails, the third indication message may be used to indicate that the user to be authenticated fails. If the portal server fails, the third indication message may be used to indicate that the portal server fails (for example, the third indication message may specifically indicate that the portal server system is not registered).

[0125] In this way, when a user logs in to the portal server, the authentication center authenticates the system ID and access key of the portal server, and simultaneously performs strict verification based on the user's terminal IP address and authentication credentials, thereby improving the security of single sign-on.

[0126] A possible embodiment is as follows Figure 7 As shown, the authentication credentials are configured with a validity period. In order to update the authentication credentials, the single sign-on method of the present application may further include the following S601-S602.

[0127] S601: The authentication server receives a second instruction message sent by the portal server.

[0128] The second instruction message is used to instruct the authentication server to update the validity period of the authentication credentials and obtain the updated authentication credentials. The second instruction message is sent by the portal server upon receiving a user operation. For example, the user operation may be a click operation or a swipe operation performed by the user on the portal server to access the application system.

[0129] As a possible implementation, the authentication server can receive the second indication message sent by the portal server via the API interface. Furthermore, after receiving the second indication message, the authentication server can update the validity period of the authentication credential. For example, the authentication server can update the validity period of the authentication credential to the original validity period (e.g., the original validity period may be 5 minutes).

[0130] In actual applications, if the portal server does not receive any user operation within a preset time period, the authentication server will set the status of the authentication credential to an invalid state.

[0131] It should be noted that the status of the authentication credential includes a valid state and an invalid state. In the valid state, the portal server can pass the authentication of the authentication server based on the authentication credential. In the invalid state, the portal server cannot pass the authentication of the authentication server based on the authentication credential.

[0132] S602: Upon receiving the third request message sent by the application system to be accessed, the authentication server sends the updated authentication credentials to the application system to be accessed.

[0133] The third request message is used to request updating of authentication credentials.

[0134] As a possible implementation, the application system to be accessed can send a third request message to the authentication server at a preset frequency. Accordingly, the authentication server receives the third request message according to the API interface. The preset frequency can be set as needed, for example, 5 seconds, 10 seconds, etc.

[0135] Furthermore, after the application system to be accessed receives the updated authentication credentials, if the updated authentication credentials are in an invalid state, the application system to be accessed may update the login state of the user to be authenticated to an offline state.

[0136] It should be noted that the login status of the user to be authenticated includes the login status and the offline status.

[0137] A possible embodiment is as follows Figure 8 As shown, in the case where the authentication server stores the first mapping relationship, the single sign-on method of the present application may further include the following S701-S716.

[0138] S701: The portal server receives a login request message sent by a terminal.

[0139] The login request message includes the terminal IP address, the first user identifier, and the user password.

[0140] S702: The portal server sends a third request message to the authentication server.

[0141] The specific implementation of this step can refer to the description of S501 and will not be described in detail here.

[0142] S703: The authentication server authenticates the user to be authenticated and the portal server.

[0143] The specific implementation of this step can refer to the description of S502 and will not be described in detail.

[0144] S704: When both the user to be authenticated and the portal server are authenticated successfully, the authentication server sends a first indication message to the portal server.

[0145] The specific implementation of this step can refer to the description of S503 and will not be described in detail here.

[0146] S705: When the portal server receives a click operation from the user to access the application system, the portal server sends a first request message to the authentication server. Correspondingly, the authentication server receives the first request message sent by the portal server.

[0147] The specific implementation of this step can refer to the description of S301 and will not be described in detail here.

[0148] S706: The authentication server determines that the portal server authentication is successful.

[0149] The specific implementation of this step can refer to the description of S302 and will not be described in detail here.

[0150] S707: The authentication server creates a second mapping relationship.

[0151] The specific implementation of this step can refer to the description of S302 and will not be described in detail here.

[0152] S708: The authentication server sends the authentication credentials to the portal server.

[0153] S709: The portal server sends an access request message to the application system to be accessed.

[0154] The specific implementation of this step can refer to the description of S303 and will not be described in detail here.

[0155] S710: The application system to be accessed sends a second request message to the authentication server.

[0156] As a possible implementation, the application system to be accessed can send a second request message to the authentication server when it is determined that the portal server authentication is successful. Correspondingly, the authentication server receives the second request message.

[0157] S711: When the application system to be accessed passes authentication, the authentication server sends a second user identifier to the application system to be accessed according to the authentication credential and the second mapping relationship. Correspondingly, the application system to be accessed receives the second user identifier.

[0158] The specific implementation of this step can refer to the description of S304 and will not be described in detail here.

[0159] S712: The application system to be accessed authenticates the user to be authenticated according to the second user identifier, and displays the target content on the terminal interface if the user to be authenticated passes the authentication.

[0160] As a possible implementation manner, the application system to be accessed may create a user session if the user to be authenticated passes the authentication, and display the target content to the terminal interface through the user session.

[0161] The user session may include a user session identifier (session_id), and the user to be authenticated may perform user operations through the user session identifier.

[0162] S713: The portal server sends a second instruction message to the authentication server.

[0163] The specific implementation of this step can refer to the description of S601 and will not be described in detail here.

[0164] S714: The authentication server updates the validity period of the authentication credential and obtains the updated authentication credential.

[0165] As a possible implementation manner, the authentication server may update the validity period of the authentication credential to the original validity period (for example, the original validity period may be 5 minutes) to obtain an updated authentication credential.

[0166] S715: The application system to be accessed sends a third request message to the authentication server.

[0167] As a possible implementation manner, the application system to be accessed may send a third request message to the authentication server through an API interface.

[0168] S716. The authentication server sends the updated authentication credentials to the application system to be accessed.

[0169] Further, such as Figure 9 As shown, in the case where the authentication server does not store the first mapping relationship, the single sign-on method of the present application may further include S801-S803.

[0170] S801. The authentication server sends a registration request message to the application system to be accessed.

[0171] The specific implementation of this step can refer to the description of S401 and will not be described in detail here.

[0172] S802: The application system to be accessed creates a second user identifier.

[0173] As a possible implementation manner, the application system to be accessed may authenticate the portal server, and create a second user identifier if the portal server authentication is successful.

[0174] For example, the application system to be accessed may determine that the portal server authentication is successful when the system identifier and access key of the portal server in the registration request message are the same as the system identifier and access key of the portal server pre-stored in the application system.

[0175] S803: The application system to be accessed sends a second user identifier to the authentication server.

[0176] In actual applications, on the basis of sending the second user identifier to the authentication server, the application system to be accessed may also send the first user identifier corresponding to the second user identifier to the authentication server.

[0177] The various solutions in the above embodiments of the present application can be combined under the premise that there is no contradiction.

[0178] In the embodiment of the present application, the authentication server can be divided into functional modules or functional units according to the above method example. For example, each functional module or functional unit can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or in the form of software functional modules or functional units. Among them, the division of modules or units in the embodiment of the present application is schematic and is only a logical functional division. In actual implementation, there may be other division methods.

[0179] In the case of dividing each functional module into corresponding functional modules, Figure 10 A schematic structural diagram of a single sign-on device is shown. The single sign-on device may be a server or a chip used in a server. The single sign-on device may be used to perform the server functions involved in the above embodiments. Figure 10 The single sign-on device 900 shown may include: a receiving unit 901, an authentication unit 902, a processing unit 903, and a sending unit 904; the receiving unit 901 is used to receive a first request message sent by a portal server; the first request message includes the system identifier of the application system to be accessed, the system identifier of the portal server, an access key, the terminal IP address, and the first user identifier, the first request message is used to request authentication credentials, the authentication credentials are used to access the application system to be accessed associated with the authentication server, the first user identifier is the user identifier of the user to be authenticated on the authentication server; the authentication unit 902 is used to authenticate the portal server according to the system identifier and the access key of the portal server; the processing unit 903 is used to create a second mapping relationship when the portal server authentication is passed and the authentication server stores the first mapping relationship; the first mapping relationship includes the first user identifier and the second user identifier, the second user identifier is the user identifier of the user to be authenticated In the user identification of the application system to be accessed, the second mapping relationship includes authentication credentials, the system identification of the application system to be accessed, the terminal IP address and the second user identification; the sending unit 904 is used to send the authentication credentials to the portal server, so that the portal server sends an access request message to the application system to be accessed; the access request message includes the authentication credentials, and the access request message is used to request access to the target content in the application system to be accessed; the receiving unit 901 is also used to, upon receiving the second request message sent by the application system to be accessed and the application system to be accessed is authenticated, send the second user identification to the application system to be accessed according to the authentication credentials and the second mapping relationship, so that the application system to be accessed authenticates the user to be authenticated according to the second user identification, and displays the target content on the terminal interface of the user to be authenticated if the user to be authenticated is authenticated; the second request message includes authentication credentials, the system identification of the application system to be accessed and the access key.

[0180] In one possible design, the sending unit 904 is also used to send a registration request message to the application system to be accessed when the authentication server does not store the first mapping relationship; the registration request message includes the first user identifier and the system identifier of the portal server; the registration request message is used to request the application system to be accessed to create a second user identifier; the receiving unit 901 is also used to receive the second user identifier sent by the application system to be accessed, and create a first mapping relationship based on the second user and the first user identifier.

[0181] In one possible design, the receiving unit 901 is further used to receive a third request message sent by the portal server, where the third request message is used to request authentication of the user to be authenticated and the portal server; the sending unit 904 is further used to send a first indication message to the portal server when both the user to be authenticated and the portal server are authenticated successfully, where the first indication message is used to instruct the portal server to display multiple application systems on the terminal interface, and the portal server is used to send the first request message to the portal server based on the user's click operation on the application system to be accessed.

[0182] In one possible design, the authentication credentials are configured with a validity period; the receiving unit 901 is also used to receive a second indication message sent by the portal server; the second indication message is used to instruct the authentication server to update the validity period of the authentication credentials and obtain the updated authentication credentials; the sending unit 904 is also used to send the updated authentication credentials to the application system to be accessed when a third request message is received from the application system to be accessed; the third request message is used to request to update the authentication credentials.

[0183] The embodiment of the present application also provides a computer-readable storage medium. All or part of the processes in the above-mentioned method embodiments can be completed by a computer program to instruct the relevant hardware, and the program can be stored in the above-mentioned computer-readable storage medium. When the program is executed, it may include the processes of the above-mentioned method embodiments. The computer-readable storage medium can be an internal storage unit of the authentication server (including the data sending end and / or the data receiving end) of any of the above-mentioned embodiments, such as the hard disk or memory of the authentication server. The above-mentioned computer-readable storage medium can also be an external storage device of the above-mentioned terminal device, such as a plug-in hard disk, a smart memory card (smart media card, SMC), a secure digital (secure digital, SD) card, a flash card (flash card), etc. equipped on the above-mentioned terminal device. Furthermore, the above-mentioned computer-readable storage medium can also include both the internal storage unit of the above-mentioned authentication server and an external storage device. The above-mentioned computer-readable storage medium is used to store the above-mentioned computer program and other programs and data required by the above-mentioned authentication server. The above-mentioned computer-readable storage medium can also be used to temporarily store data that has been output or is to be output.

[0184] It should be noted that the terms "first" and "second" in the specification, claims, and drawings of this application are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products, or devices.

[0185] It should be understood that in the present application, "at least one (item)" refers to one or more, "more than one" refers to two or more, "at least two (items)" refers to two or three and more than three, and "and / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0186] Through the description of the above implementation methods, technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0187] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the modules or units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0188] The units described as separate components may or may not be physically separate, and the components shown as units may be one physical unit or multiple physical units, that is, they may be located in one place or distributed in multiple places. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0189] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0190] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling a device (which can be a single-chip microcomputer, chip, etc.) or a processor to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a ROM, a RAM, a magnetic disk, or an optical disk.

[0191] The above is only a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or replacements within the technical scope disclosed in this application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A single sign-on method, characterized in that: Applied to an authentication server, the method includes: Receive a first request message sent by the portal server; the first request message includes the system identifier of the application system to be accessed, the system identifier of the portal server, an access key, the terminal IP address, and a first user identifier, the first request message is used to request authentication credentials, the authentication credentials are used to access the application system to be accessed associated with the authentication server, and the first user identifier is the user identifier of the user to be authenticated on the authentication server; Authenticating the portal server according to the system identifier and access key of the portal server, and creating a second mapping relationship if the portal server authentication is successful and the authentication server stores the first mapping relationship; the first mapping relationship includes the first user identifier and the second user identifier, the second user identifier being the user identifier of the to-be-authenticated user in the to-be-accessed application system, and the second mapping relationship including the authentication credentials, the system identifier of the to-be-accessed application system, the terminal IP address, and the second user identifier; Sending the authentication credentials to the portal server so that the portal server sends an access request message to the application system to be accessed; the access request message includes the authentication credentials, and the access request message is used to request access to target content in the application system to be accessed; Upon receiving the second request message sent by the application system to be accessed and the application system to be accessed passes the authentication, the second user identifier is sent to the application system to be accessed according to the authentication credentials and the second mapping relationship, so that the application system to be accessed authenticates the user to be authenticated according to the second user identifier, and if the user to be authenticated passes the authentication, the target content is displayed on the terminal interface of the user to be authenticated; the second request message includes the authentication credentials, the system identifier of the application system to be accessed and the access key.

2. The method according to claim 1, characterized in that The method further comprises: If the authentication server does not store the first mapping relationship, sending a registration request message to the application system to be accessed; the registration request message includes the first user identifier and the system identifier of the portal server; the registration request message is used to request the application system to be accessed to create the second user identifier; Receive the second user identifier sent by the application system to be accessed, and create the first mapping relationship according to the second user and the first user identifier.

3. The method according to claim 1, characterized in that The method further comprises: receiving a third request message sent by the portal server, wherein the third request message is used to request authentication of the user to be authenticated and the portal server; When both the user to be authenticated and the portal server are authenticated successfully, a first indication message is sent to the portal server, where the first indication message is used to instruct the portal server to display multiple application systems on the terminal interface, and the portal server is used to send the first request message to the portal server based on the user's click operation on the application system to be accessed.

4. The method according to any one of claims 1 to 3, characterized in that The authentication credentials are configured with a validity period, and the method further comprises: receiving a second instruction message sent by the portal server; the second instruction message is used to instruct the authentication server to update the validity period of the authentication credential and obtain an updated authentication credential; When a third request message is received from the application system to be accessed, the updated authentication credentials are sent to the application system to be accessed; the third request message is used to request updating of the authentication credentials.

5. A single sign-on device, characterized in that: Applied to an authentication server, the device comprises: a receiving unit, an authentication unit, a processing unit, and a sending unit; The receiving unit is configured to receive a first request message sent by the portal server; the first request message includes a system identifier of the application system to be accessed, a system identifier of the portal server, an access key, an IP address of the terminal, and a first user identifier; the first request message is used to request authentication credentials, the authentication credentials are used to access the application system to be accessed associated with the authentication server, and the first user identifier is a user identifier of the user to be authenticated on the authentication server; The authentication unit is configured to authenticate the portal server according to the system identifier and access key of the portal server; The processing unit is configured to create a second mapping relationship if the portal server authentication is successful and the authentication server stores the first mapping relationship; the first mapping relationship includes the first user identifier and the second user identifier, the second user identifier being the user identifier of the to-be-authenticated user in the to-be-accessed application system, and the second mapping relationship includes the authentication credentials, the system identifier of the to-be-accessed application system, the terminal IP address, and the second user identifier; The sending unit is configured to send the authentication credentials to the portal server, so that the portal server sends an access request message to the application system to be accessed; the access request message includes the authentication credentials, and the access request message is used to request access to target content in the application system to be accessed; The receiving unit is further used to send the second user identifier to the application system to be accessed according to the authentication credentials and the second mapping relationship when receiving the second request message sent by the application system to be accessed and the application system to be accessed is authenticated, so that the application system to be accessed authenticates the user to be authenticated according to the second user identifier, and displays the target content on the terminal interface of the user to be authenticated when the user to be authenticated is authenticated; the second request message includes the authentication credentials, the system identifier of the application system to be accessed and the access key.

6. The device according to claim 5, characterized in that The sending unit is further configured to send a registration request message to the application system to be accessed if the authentication server does not store the first mapping relationship; the registration request message includes the first user identifier and the system identifier of the portal server; the registration request message is used to request the application system to be accessed to create the second user identifier; The receiving unit is further configured to receive the second user identifier sent by the application system to be accessed, and create the first mapping relationship according to the second user and the first user identifier.

7. The device according to claim 5, characterized in that The receiving unit is further configured to receive a third request message sent by the portal server, wherein the third request message is used to request authentication of the user to be authenticated and the portal server; The sending unit is further configured to, when both the user to be authenticated and the portal server are authenticated successfully, send a first indication message to the portal server, wherein the first indication message is configured to instruct the portal server to display multiple application systems on the terminal interface, and the portal server is configured to send the first request message to the portal server based on a user click operation on the application system to be accessed.

8. The device according to any one of claims 5 to 7, characterized in that The authentication credentials are configured with a validity period; The receiving unit is further configured to receive a second instruction message sent by the portal server; the second instruction message is configured to instruct the authentication server to update the validity period of the authentication credential and obtain an updated authentication credential; The sending unit is further configured to send the updated authentication credentials to the application system to be accessed upon receiving a third request message sent by the application system to be accessed; the third request message is used to request updating of the authentication credentials.

9. A computer-readable storage medium, characterized in that The readable storage medium stores instructions, and when the instructions are executed, the method according to any one of claims 1 to 4 is implemented.

10. A single sign-on device, characterized in that: include: A processor and a memory for storing instructions executable by the processor; wherein the processor is configured to execute the instructions to implement the method according to any one of claims 1 to 4.

Images