A single sign-on method and system

Abstract

The application provides a single sign-on method and system, which establishes an authentication system between a user and multiple applications, and a user account only needs to log in the authentication system once, and can log in all mutually trusted multiple applications through an identity authentication field, a login request interface address and a verification request interface address agreed in advance between the authentication system and the multiple applications, so that the problem of too many passwords and the tedious and inefficient multiple logins of the user when logging in multiple applications are effectively solved, the login time of the user is greatly saved, and the efficiency of the user logging in the application is improved.

Description

Technical Field

[0001] This invention relates to the field of communications, and more specifically, to a single sign-on method and system. Background Technology

[0002] With the increasing number of applications on smart terminals, each application requires user registration and login, requiring users to enter a separate username and password to log in. This results in extremely poor security for users using a single password, while having too many passwords and having to enter them frequently for multiple logins is inefficient and cumbersome, making the login experience for users very poor. Summary of the Invention

[0003] To address the cumbersome, inefficient, and poor user experience of logging into multiple applications in existing technologies, this invention provides a single sign-on method and system.

[0004] According to one aspect of the present invention, a single sign-on method is provided, the method comprising:

[0005] The user intending to log in sends a first login request to the authentication system, wherein the first login request contains the user's identity information.

[0006] The authentication system verifies the user identity information of the user who intends to log in in the first login request;

[0007] When the verification is successful, the authentication system generates a dynamic token, obtains the application identifier of the application that the user intends to log in can access, and generates an application link based on the application that the user intends to log in can access.

[0008] When a user intending to log in selects one of the application links to access, a second login request is sent to the application corresponding to the selected application link. The second login request includes the application identifier and dynamic token of the application to be logged in.

[0009] The application to be logged in parses the second login request and sends a verification request to the authentication system, wherein the verification request includes the application identifier and dynamic token of the application to be logged in;

[0010] The authentication system generates a verification result based on the verification request;

[0011] The application to be logged in determines the login result of the user based on the verification result.

[0012] Optionally, the method further includes the following before the user intending to log in sends the first login request to the authentication system:

[0013] The authentication system and each application agree on the user's authentication field as the user's single sign-on identity identifier, and each stores the user's authentication field.

[0014] Each application stores the verification request interface address provided by the authentication system, wherein the verification request interface address is used to transmit the dynamic token dynamically generated by the authentication system and the user's authentication field;

[0015] The authentication system stores the login request interface address provided by each application. The login request interface address is used to transmit the application identifier and dynamically generated dynamic token. The identifier is a unique application identifier in a uniform format automatically generated by the authentication system for each application.

[0016] Optionally, when the user intending to log in selects one of the application links to access, a second login request is sent to the application corresponding to the selected application link, including:

[0017] When a user intending to log in selects one of the application links to access, a second login request is sent to the application intending to log in through the login request interface address of the application stored in the authentication system.

[0018] Optionally, the application intending to log in parses the second login request and sends a verification request to the authentication system, including:

[0019] The application to be logged in determines the application identifier and dynamic token of the application to be logged in based on the second login request;

[0020] After generating a verification request based on the application identifier and dynamic token of the application to be logged in, the application to be logged in sends the verification request to the authentication system through the stored verification request interface address.

[0021] Optionally, the authentication system generates a verification result based on the verification request, including:

[0022] When the authentication system determines that the dynamic token in the verification request is valid, the verification result includes a verification success identifier and the authentication field of the user to be logged in;

[0023] When the authentication system determines that the dynamic token in the verification request is invalid, the verification result only includes a verification failure identifier.

[0024] Optionally, the application to be logged in determines the login result of the user to be logged in based on the verification result, including:

[0025] When the verification result only includes a verification failure identifier, the application to be logged in will prompt the user with login failure information.

[0026] When the verification result includes a verification success identifier and the authentication field of the user to be logged in, the application to be logged in compares the authentication field of the user to be logged in stored locally with the authentication field of the user to be logged in in the verification result. When the comparison result matches, the login of the user to the application to be logged in is completed; when the comparison result does not match, the corresponding error message is displayed.

[0027] According to another aspect of the present invention, a single sign-on system is provided, the system comprising an authentication system and multiple applications, wherein:

[0028] The authentication system is used to receive a first login request sent by a user intending to log in, and to verify the user identity information of the user intending to log in in the first login request; when the verification is successful, to generate a dynamic token, and to obtain the application identifier of the application that the user intending to log in can access, and to generate an application link based on the application that the user intending to log in can access; and to generate a verification result based on the verification request sent by the application intending to log in.

[0029] The application to be logged in among multiple applications is used to receive and parse the second login request sent by the user to be logged in, send a verification request to the authentication system, and determine the login result of the user to be logged in based on the verification result. The application to be logged in is the application corresponding to the link selected by the user to be logged in from the application links. The second login request and the verification request contain the application identifier and dynamic token of the application to be logged in.

[0030] Optionally, the authentication system is also used to agree with each application on the user's authentication field as the user's single sign-on identity identifier and store the user's authentication field; and to store the login request interface address provided by each application, wherein the login request interface address is used to transmit the application identifier and dynamically generated dynamic token, the identifier being a unique application identifier in a unified format automatically generated by the authentication system for each application;

[0031] Multiple applications are also used to agree on and store user authentication fields with the authentication system, as well as to store the verification request interface address provided by the authentication system. The verification request interface address is used to transmit the dynamic token dynamically generated by the authentication system and the user's authentication fields.

[0032] Optionally, the authentication system generates a verification result based on the verification request, including:

[0033] When the authentication system determines that the dynamic token in the verification request is valid, the verification result includes a verification success identifier and the authentication field of the user to be logged in;

[0034] When the authentication system determines that the dynamic token in the verification request is invalid, the verification result only includes a verification failure identifier.

[0035] Optionally, the application to be logged in determines the login result of the user to be logged in based on the verification result, including:

[0036] When the verification result only includes a verification failure identifier, the application to be logged in will prompt the user with login failure information.

[0037] When the verification result includes a verification success identifier and the authentication field of the user to be logged in, the application to be logged in compares the authentication field of the user to be logged in stored locally with the authentication field of the user to be logged in in the verification result. When the comparison result matches, the login of the user to the application to be logged in is completed; when the comparison result does not match, the corresponding error message is displayed.

[0038] The single sign-on method and system of the present invention include the following steps: a user intending to log in sends a first login request to an authentication system, wherein the first login request contains the user's identity information; the authentication system verifies the user's identity information in the first login request; when the verification passes, the authentication system generates a dynamic token, obtains the application identifier of the applications accessible to the user intending to log in, and generates application links based on the applications accessible to the user intending to log in; when the user intends to log in selects one of the application links to access, a second login request is sent to the application corresponding to the selected application link; the application intending to log in parses the second login request and sends a verification request to the authentication system; the authentication system generates a verification result based on the verification request; and the application intending to log in determines the login result of the user intending to log in based on the verification result. The method and system establish an authentication system between the user and multiple applications. A user account only needs to log in to the authentication system once. Through the authentication fields, login request interface address and verification request interface address agreed upon in advance between the authentication system and multiple applications, access to all mutually trusted applications can be achieved. This effectively solves the problems of too many passwords and the cumbersome and inefficient process of logging into multiple applications, greatly saves the user's login time, and improves the efficiency of the user's application login. Attached Figure Description

[0039] Exemplary embodiments of the present invention can be more fully understood by referring to the following figures:

[0040] Figure 1 A flowchart of a single sign-on method according to a preferred embodiment of the present invention;

[0041] Figure 2 This is a schematic diagram of a single sign-on system according to a preferred embodiment of the present invention. Detailed Implementation

[0042] Exemplary embodiments of the invention will now be described with reference to the accompanying drawings. However, the invention may be embodied in many different forms and is not limited to the embodiments described herein. These embodiments are provided to fully and completely disclose the invention and to fully convey its scope to those skilled in the art. The terminology used in the exemplary embodiments illustrated in the drawings is not intended to limit the invention. In the drawings, the same units / elements are referred to by the same reference numerals.

[0043] Unless otherwise stated, the terms used herein (including technical terms) have their common meaning as understood by one of ordinary skill in the art. Furthermore, it is understood that terms defined in commonly used dictionaries should be understood to have a meaning consistent with the context of their relevant field, and not to be interpreted as having an idealized or overly formal meaning.

[0044] Example Method

[0045] Figure 1 This is a flowchart of a single sign-on method according to a preferred embodiment of the present invention. Figure 1 As shown, the single sign-on method described in this preferred embodiment starts from step 101.

[0046] In step 101, the user intending to log in sends a first login request to the authentication system, wherein the first login request contains the user's identity information.

[0047] Preferably, the method further includes the following steps before the user intending to log in sends the first login request to the authentication system:

[0048] The authentication system and each application agree on the user's authentication field as the user's single sign-on identity identifier, and each stores the user's authentication field.

[0049] Each application stores the verification request interface address provided by the authentication system, wherein the verification request interface address is used to transmit the dynamic token dynamically generated by the authentication system and the user's authentication field;

[0050] The authentication system stores the login request interface address provided by each application. The login request interface address is used to transmit the application identifier and dynamically generated dynamic token. The identifier is a unique application identifier in a uniform format automatically generated by the authentication system for each application.

[0051] In this preferred embodiment, a login authentication relationship based on user identity information is established between the user and the authentication system. For example, the user logs into the authentication system by entering their name, ID, or other login name, as well as a password. Simultaneously, to enable user login to the application, the authentication system and the application must agree on user authentication fields, such as name + encrypted ID number, or name + encrypted email address. Mutual authentication between the authentication system and the application protects the legitimacy and security of the user intending to log in.

[0052] In step 102, the authentication system verifies the user identity information of the user who intends to log in in the first login request.

[0053] In this preferred embodiment, the user intending to log in uses a legitimate login authentication system to ensure that they can subsequently log in to multiple applications directly via application links generated by the authentication system. If a user cannot correctly log in to the authentication system, they will not be able to obtain application links for available applications.

[0054] In step 103, when the verification is successful, the authentication system generates a dynamic token, obtains the application identifier of the application that the user intends to log in can access, and generates an application link based on the application that the user intends to log in can access.

[0055] In this preferred embodiment, after a user successfully logs into the authentication system, the authentication system performs relevant searches based on the user's identity information to obtain the application identifiers of all applications that the user can log into and access, and generates an application link for each application that can be logged into and accessed based on the obtained application identifiers.

[0056] In step 104, when the user intending to log in selects one of the application links to access, a second login request is sent to the application corresponding to the selected application link. The second login request includes the application identifier and dynamic token of the application to be logged in.

[0057] Preferably, when the user intending to log in selects one of the application links to access, a second login request is sent to the application corresponding to the selected application link, including:

[0058] When a user intending to log in selects one of the application links to access, a second login request is sent to the application intending to log in through the login request interface address of the application stored in the authentication system.

[0059] In step 105, the application to be logged in parses the second login request and sends a verification request to the authentication system, wherein the verification request includes the application identifier and dynamic token of the application to be logged in.

[0060] Preferably, the application to be logged in parses the second login request and sends a verification request to the authentication system, including:

[0061] The application to be logged in determines the application identifier and dynamic token of the application to be logged in based on the second login request;

[0062] After generating a verification request based on the application identifier and dynamic token of the application to be logged in, the application to be logged in sends the verification request to the authentication system through the stored verification request interface address.

[0063] In step 106, the authentication system generates a verification result based on the verification request.

[0064] Preferably, the authentication system generates a verification result based on the verification request, including:

[0065] When the authentication system determines that the dynamic token in the verification request is valid, the verification result includes a verification success identifier and the authentication field of the user to be logged in;

[0066] When the authentication system determines that the dynamic token in the verification request is invalid, the verification result only includes a verification failure identifier.

[0067] In step 107, the application to be logged in determines the login result of the user to be logged in based on the verification result.

[0068] Preferably, the application to be logged in determines the login result of the user to be logged in based on the verification result, including:

[0069] When the verification result only includes a verification failure identifier, the application to be logged in will prompt the user with login failure information.

[0070] When the verification result includes a verification success identifier and the authentication field of the user to be logged in, the application to be logged in compares the authentication field of the user to be logged in stored locally with the authentication field of the user to be logged in in the verification result. When the comparison result matches, the login of the user to the application to be logged in is completed; when the comparison result does not match, the corresponding error message is displayed.

[0071] In this preferred embodiment, the single sign-on method completes user authentication by establishing an authentication system between the user and multiple applications. The user logs into the authentication system and initiates a login request to the available applications. After obtaining the parameters in the login request, the available applications initiate a verification request to the authentication system to verify the user's identity and obtain the user's authentication field. The available applications then verify the user's authentication field again to complete the single sign-on function. This effectively solves the problems of too many passwords and the cumbersome and inefficient process of logging into multiple applications, greatly saving the user's login time and improving the efficiency of user application login.

[0072] Example System

[0073] Figure 2 A schematic diagram of the structure of a single sign-on system according to a preferred embodiment of the present invention. Figure 2 As shown, the single sign-on system 200 of this preferred embodiment includes an authentication system 201 and multiple applications 202, wherein:

[0074] The authentication system 201 is used to receive a first login request sent by a user intending to log in, and to verify the user identity information of the user intending to log in in the first login request; when the verification is successful, to generate a dynamic token, and to obtain the application identifier of the application that the user intending to log in can access, and to generate an application link based on the application that the user intending to log in can access; and to generate a verification result based on the verification request sent by the application intending to log in.

[0075] The application to be logged in among multiple applications 202 is used to receive and parse the second login request sent by the user to be logged in, send a verification request to the authentication system, and determine the login result of the user to be logged in based on the verification result. The application to be logged in is the application corresponding to the link selected by the user to be logged in from the application links. The second login request and the verification request contain the application identifier and dynamic token of the application to be logged in.

[0076] Preferably, the authentication system is further configured to agree with each application on the user's authentication field as the user's single sign-on identity identifier and store the user's authentication field; and to store the login request interface address provided by each application, wherein the login request interface address is used to transmit the application identifier and dynamically generated dynamic token, the identifier being a unique application identifier in a unified format automatically generated by the authentication system for each application;

[0077] Multiple applications are also used to agree on and store user authentication fields with the authentication system, as well as to store the verification request interface address provided by the authentication system. The verification request interface address is used to transmit the dynamic token dynamically generated by the authentication system and the user's authentication fields.

[0078] Preferably, the authentication system generates a verification result based on the verification request, including:

[0079] When the authentication system determines that the dynamic token in the verification request is valid, the verification result includes a verification success identifier and the authentication field of the user to be logged in;

[0080] When the authentication system determines that the dynamic token in the verification request is invalid, the verification result only includes a verification failure identifier.

[0081] Preferably, the application to be logged in determines the login result of the user to be logged in based on the verification result, including:

[0082] When the verification result only includes a verification failure identifier, the application to be logged in will prompt the user with login failure information.

[0083] When the verification result includes a verification success identifier and the authentication field of the user to be logged in, the application to be logged in compares the authentication field of the user to be logged in stored locally with the authentication field of the user to be logged in in the verification result. When the comparison result matches, the login of the user to the application to be logged in is completed; when the comparison result does not match, the corresponding error message is displayed.

[0084] The steps of the single sign-on system in this preferred embodiment to complete identity authentication by sharing an authentication system with multiple applications are the same as those in the single sign-on method of this invention, and the technical effects achieved are also the same, so they will not be repeated here.

[0085] The invention has been described with reference to a few embodiments. However, as will be known to those skilled in the art, and as defined in the appended claims, other embodiments besides those disclosed above fall equivalently within the scope of the invention.

[0086] Generally, all terms used in the claims are to be interpreted according to their ordinary meaning in the art, unless otherwise expressly defined herein. All references to “a / the / the [device, component, etc.]” ​​are openly interpreted as at least one instance of said device, component, etc., unless otherwise expressly stated. The steps of any method disclosed herein need not be performed in the exact order disclosed unless explicitly stated otherwise.

[0087] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0088] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0089] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0090] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0091] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A single sign-on method, characterized in that, The method includes: The authentication system and each application agree on the user's authentication field as the user's single sign-on identity identifier, and each stores the user's authentication field. The user intending to log in sends a first login request to the authentication system, wherein the first login request contains the user's identity information. The authentication system verifies the user identity information of the user who intends to log in in the first login request; When the verification is successful, the authentication system generates a dynamic token, obtains the application identifier of the application that the user intends to log in can access, and generates an application link based on the application that the user intends to log in can access. When a user intending to log in selects one of the application links to access, a second login request is sent to the application corresponding to the selected application link. The second login request includes the application identifier and dynamic token of the application to be logged in. The application to be logged in parses the second login request and sends a verification request to the authentication system, wherein the verification request includes the application identifier and dynamic token of the application to be logged in; The authentication system generates a verification result based on the verification request, including: when the authentication system determines that the dynamic token in the verification request is valid, the verification result includes a verification success identifier and the identity verification field of the user to be logged in; when the authentication system determines that the dynamic token in the verification request is invalid, the verification result only includes a verification failure identifier. The application intending to log in determines the login result of the intended user based on the verification result, including: when the verification result only includes a verification failure identifier, the application intending to log in prompts the intended user with login failure information; when the verification result includes a verification success identifier and the intended user's authentication field, the application intending to log in compares the locally stored authentication field of the intended user with the authentication field of the intended user in the verification result; when the comparison result matches, the application completes the login of the intended user to the application; when the comparison result does not match, the application prompts the corresponding error message.

2. The method according to claim 1, characterized in that, The method further includes the following before the user intending to log in sends the first login request to the authentication system: Each application stores the verification request interface address provided by the authentication system, wherein the verification request interface address is used to transmit the dynamic token dynamically generated by the authentication system and the user's authentication field; The authentication system stores the login request interface address provided by each application. The login request interface address is used to transmit the application identifier and dynamically generated dynamic token. The identifier is a unique application identifier in a uniform format automatically generated by the authentication system for each application.

3. The method according to claim 1, characterized in that, When the user intending to log in selects one of the application links to access, a second login request is sent to the application corresponding to the selected application link, including: When a user intending to log in selects one of the application links to access, a second login request is sent to the application intending to log in through the login request interface address of the application stored in the authentication system.

4. The method according to claim 1, characterized in that, The application to be logged in parses the second login request and sends a verification request to the authentication system, including: The application to be logged in determines the application identifier and dynamic token of the application to be logged in based on the second login request; After generating a verification request based on the application identifier and dynamic token of the application to be logged in, the application to be logged in sends the verification request to the authentication system through the stored verification request interface address.

5. A single sign-on system, characterized in that, The system includes an authentication system and multiple applications, among which: The authentication system is used to agree with each application on the user's authentication fields as the user's single sign-on identity identifier, and to store the user's authentication fields; The authentication system is also used to receive a first login request sent by a user intending to log in, and to verify the user identity information of the user intending to log in in the first login request; when the verification is successful, to generate a dynamic token and obtain the application identifier of the application accessible to the user intending to log in; to generate an application link based on the application accessible to the user intending to log in; and to generate a verification result based on the verification request sent by the application intending to log in, wherein generating the verification result based on the verification request sent by the application intending to log in includes: When the authentication system determines that the dynamic token in the verification request is valid, the verification result includes a verification success identifier and the authentication field of the user to be logged in; When the authentication system determines that the dynamic token in the verification request is invalid, the verification result only includes a verification failure identifier; Multiple applications are used to agree on and store user authentication fields with the authentication system; The application to be logged in is further configured to receive and parse a second login request sent by the user intending to log in, send a verification request to the authentication system, and determine the login result of the user intending to log in based on the verification result. The application to be logged in is the application corresponding to the link selected by the user intending to log in from the application links. The second login request and the verification request contain the application identifier and dynamic token of the application to be logged in. Determining the login result of the user intending to log in based on the verification result includes: When the verification result only includes a verification failure identifier, the application to be logged in will prompt the user with login failure information. When the verification result includes a verification success identifier and the authentication field of the user to be logged in, the application to be logged in compares the authentication field of the user to be logged in stored locally with the authentication field of the user to be logged in in the verification result. When the comparison result matches, the login of the user to the application to be logged in is completed; when the comparison result does not match, the corresponding error message is displayed.

6. The system according to claim 5, characterized in that, The authentication system is also used to store the login request interface address provided by each application. The login request interface address is used to transmit the application identifier and dynamically generated dynamic token of the application. The identifier is a unique application identifier in a uniform format automatically generated by the authentication system for each application. Multiple applications also store the verification request interface address provided by the authentication system, wherein the verification request interface address is used to transmit the dynamic token dynamically generated by the authentication system and the user's authentication field.

Images