Single sign-on authentication method, device, electronic device and storage medium

Abstract

The present application proposes a single sign-on authentication method, device, electronic device and storage medium, wherein the method comprises: after receiving a login authentication request of a first application to be jumped sent by a terminal device, including the security level of the first application, the first signature, the first user identifier, and the first relationship index of the first application associated with the first user identifier, in the case where the first signature is successfully verified, an authentication strategy is determined based on the security level of the first application, and the authentication strategy and the association relationship corresponding to the first application in the login registration table are used to verify the first relationship index and the first user identifier to determine the authentication result, and the authentication result is sent to the terminal device. This improves the reliability of single sign-on authentication and expands the application scenarios of the single sign-on authentication method.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a single sign-on authentication method, device, electronic device and storage medium. Background Art

[0002] Single sign-on technology supports logging into one of multiple mutually trusted applications. When logging into other applications except that application, there is no need to enter the account password and other information of other applications, and you can log in to other applications without any perception.

[0003] In the prior art, when the target user initiates a login request to the second application in the first application, the first login information of the first application is converted into the second login information of the target user in the second application according to the pre-stored account mapping relationship, so that the second application can authenticate the second login information. Only after the authentication is successful can the second application be successfully logged in. However, if the first application is attacked and successfully logged in, it will cause a chain reaction and all applications will be compromised. Therefore, a reliable single sign-on authentication method is required. Summary of the invention

[0004] The present application aims to solve one of the technical problems in the related art at least to some extent.

[0005] To this end, the present application proposes a single sign-on authentication method, device, electronic device and storage medium to improve the reliability of single sign-on authentication.

[0006] To achieve the above-mentioned purpose, the first embodiment of the present application proposes a single sign-on authentication method, which is executed by a SIM card, comprising:

[0007] Receiving a login authentication request of a first application to be redirected sent by a terminal device, wherein the login authentication request includes a first signature, a first user identifier, and a first relationship index of the first application associated with the first user identifier;

[0008] In the case where the first signature is successfully verified, determining an authentication strategy based on the security level of the first application;

[0009] Using the authentication policy and the association relationship corresponding to the first application in the login registration table, verify the first relationship index and the first user identifier to determine the authentication result;

[0010] Send the authentication result to the terminal device.

[0011] To achieve the above purpose, the second embodiment of the present application proposes a single sign-on authentication method, which is executed by a terminal device and includes:

[0012] In response to the second application triggering a jump to the first application, determining whether the first application has been logged in;

[0013] When the first application is not logged in, sending a login authentication request to the SIM card, wherein the login authentication request includes the first signature, the first user identifier, and a relationship index of the first application associated with the first user identifier;

[0014] receiving an authentication result sent by the SIM card, which verifies the first relationship index and the first user identifier according to the security level of the first application;

[0015] Determine whether to log in to the first application based on the authentication result.

[0016] To achieve the above-mentioned purpose, the third aspect of the present application proposes a single sign-on authentication device, which is applied to the SIM card side, including:

[0017] A transceiver module, configured to receive a login authentication request of a first application to be redirected sent by a terminal device, wherein the login authentication request includes a first signature, a first user identifier, and a first relationship index of the first application associated with the first user identifier;

[0018] A determination module, configured to determine an authentication strategy based on a security level of the first application when the first signature is successfully verified;

[0019] A verification module, used to verify the first relationship index and the first user identifier by using the authentication policy and the association relationship corresponding to the first application in the login registration table to determine the authentication result;

[0020] The transceiver module is used to send the authentication result to the terminal device.

[0021] To achieve the above-mentioned purpose, the fourth aspect of the present application proposes a single sign-on authentication device, which is applied to the terminal device side, including:

[0022] A confirmation module, configured to determine whether the first application has been logged in in response to the second application triggering the jump to the first application;

[0023] A transceiver module, configured to send a login authentication request to the SIM card when the first application is not logged in, wherein the login authentication request includes a first signature, a first user identifier, and a relationship index of the first application associated with the first user identifier;

[0024] A transceiver module, used to receive an authentication result sent by the SIM card, which verifies the first relationship index and the first user identifier according to the security level of the first application;

[0025] The processing module is used to determine whether to log in to the first application according to the authentication result.

[0026] To achieve the above-mentioned purpose, a fifth aspect of the present application provides an electronic device, including:

[0027] at least one processor; and

[0028] a memory communicatively connected to at least one processor; wherein,

[0029] The memory stores instructions that can be executed by at least one processor. The instructions are executed by the at least one processor so that the at least one processor can execute the method of the above embodiment.

[0030] To achieve the above objectives, the sixth aspect of the present application proposes a computer-readable storage medium storing computer instructions, wherein the computer instructions are used to enable a computer to execute the method according to the above embodiment.

[0031] The single sign-on authentication method and device provided by the present application, after receiving a login authentication request sent by a terminal device for a first application to be jumped, including a first signature, a first user identifier, and a first relationship index of the first application associated with the first user identifier, determines an authentication policy based on the security level of the first application when the first signature is successfully verified, so as to verify the first relationship index and the first user identifier by using the authentication policy and the association relationship corresponding to the first application in the login registration table to determine the authentication result, and send the authentication result to the terminal device. Thus, based on the association relationship corresponding to the first application in the login registration table stored in the SIM card, the first relationship index and the first user identifier are verified to determine the authentication result, which can effectively identify login requests based on attacks, and determine different authentication policies based on different security levels of the first application, thereby expanding the authentication capability. Thereby, the reliability of the single sign-on authentication is improved, and the application scenarios of the single sign-on authentication method are expanded.

[0032] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0034] Figure 1 A schematic diagram of a single sign-on authentication method provided in an embodiment of the present application;

[0035] Figure 2 A flowchart of another single sign-on authentication method provided in an embodiment of the present application;

[0036] Figure 3 A flowchart of another single sign-on authentication method provided in an embodiment of the present application;

[0037] Figure 4 A flowchart of another single sign-on authentication method provided in an embodiment of the present application;

[0038] Figure 5 An interactive schematic diagram of a single sign-on authentication method provided in an embodiment of the present application;

[0039] Figure 6 An interactive schematic diagram of another single sign-on authentication method provided in an embodiment of the present application;

[0040] Figure 7 A schematic diagram of the structure of a single sign-on authentication device provided in an embodiment of the present application;

[0041] Figure 8 A schematic diagram of the structure of another single sign-on authentication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0042] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application.

[0043] The following describes the single sign-on authentication method, device, electronic device and storage medium of the embodiments of the present application with reference to the accompanying drawings.

[0044] The single sign-on authentication method of the embodiment of the present application is executed by a single sign-on authentication device (hereinafter referred to as the authentication device) provided in the embodiment of the present application. The device is integrated in a subscriber identity module (Subscriber Identity Module, SIM) card or a terminal device to improve the reliability of the single sign-on authentication.

[0045] In the present application, the first application and the second application may include their corresponding client programs and server programs, and the accounts, relationship indexes, association relationships, user permissions, security levels and other information related to the first application and the second application may be stored in their corresponding client or server. Thus, the client may request to query and obtain the above information from the server. For example, when the above information related to the first application is stored in its corresponding server, the client may send an information acquisition request to the server to obtain the first relationship index of the first application associated with the first user identifier.

[0046] Figure 1 A flowchart of a single sign-on authentication method provided in an embodiment of the present application.

[0047] like Figure 1As shown, the single sign-on authentication method is executed by the SIM card and includes the following steps:

[0048] Step 101: receiving a login authentication request of a first application to be redirected sent by a terminal device, wherein the login authentication request includes a first signature, a first user identifier, and a first relationship index of the first application associated with the first user identifier.

[0049] Among them, the first user identifier is the user identifier corresponding to the login account of the second application when the second application triggers logging into the first application. The user identifier can be any information used to uniquely identify the user, such as a mobile phone number.

[0050] In this application, after a user successfully logs in to the second application in a terminal device using an account password, SIM authentication, or SMS authentication, the user can click on the link to jump to the first application to trigger the login to the first application. The terminal device can confirm whether the user has logged in to the first application based on the information recorded in the cookie. If the first application is not logged in, the terminal device can query and determine the first relationship index of the first application associated with the first user identifier. Afterwards, the first user identifier, the first relationship index of the first application associated with the first user identifier, etc. can be encrypted using the public key corresponding to the SIM card to generate a first signature. Then, a login authentication request for the first application is generated based on the first signature, the first user identifier, and the first relationship index of the first application associated with the first user identifier, and the login authentication request is sent to the SIM card. As a result, the SIM card will receive the login authentication request for the first application.

[0051] In addition, after the user successfully logs in to the second application, the second application sends the first authorization token Token obtained by the user to the terminal device. After that, the user can log in to the second application based on the Token without entering a password.

[0052] Optionally, the second application can carry the first authorization token to jump to the first application. Therefore, when the first application authenticates the login request of the second application, the terminal device can configure the first authorization token in the login authentication request. Therefore, after the SIM card receives the login authentication request, it can parse the login authentication request and obtain the first authorization token.

[0053] Optionally, the terminal device may also obtain a preset security level of the first application from the system, and configure the security level in the pending login authentication request. Thus, after receiving the login authentication request, the SIM card may parse the login authentication request to obtain the security level of the first application, thereby ensuring the accuracy of the determined security level of the first application.

[0054] Step 102: When the first signature is successfully verified, determine an authentication strategy based on the security level of the first application.

[0055] In this application, the private key stored in the SIM card can be used to decrypt and verify the first signature to ensure the security of the authentication. In addition, authentication policies corresponding to different security levels can be set in the SIM card system in advance. Afterwards, when the first signature is successfully verified, the authentication policy corresponding to the security level can be queried to implement different authentication policies for login authentication requests of applications with different security levels. Thereby meeting the needs of different application scenarios. In the case of failure to verify the first signature, it can be determined that the login authentication request has failed.

[0056] Alternatively, the security level may be the importance of the application. When the first signature is successfully verified, the security level may be compared with a preset threshold. When the security level is greater than or equal to the preset threshold, the authentication strategy is determined to be a high security authentication strategy. When the security level is less than the preset threshold, the authentication strategy is determined to be a fast authentication strategy.

[0057] In addition, when the login authentication request includes the security level of the first application, the login authentication request can be parsed to obtain the security level of the first application. Alternatively, the security level of the first application can be pre-registered in the SIM card, and then the security level of the first application can be determined by querying.

[0058] Step 103: Using the authentication policy and the association relationship corresponding to the first application in the login registration table, the first relationship index and the first user identifier are verified to determine the authentication result.

[0059] In the present application, in order to realize single sign-on, it is necessary to first register the first application and the second application for single sign-on. The specific registration process is as follows: the user can set the target user identifier, target application identifier, and / or target role identifier in the single sign-on system client deployed in the terminal device. When the user triggers the registration control in the client, the client can generate a registration request based on the user identifier, the target application identifier, and / or the target role identifier, and send the registration request to the SIM card. After the SIM card receives the registration request, when it is determined that the association relationship between the target user identifier, the target application identifier, and / or the target role identifier is not registered, a target relationship index corresponding to the association relationship between the target user identifier, the target application identifier, and / or the target role identifier is generated, and the target relationship index is sent to the terminal device. At the same time, the target relationship index, the target user identifier, the target application identifier, and / or the target role identifier are associated and stored in the login registration table. Thus, the association of users, applications, and / or roles is realized.

[0060] The target application identifier may be any information used to uniquely identify the target application, such as the name of the target application. The target application may be the first application or the second application. The target user identifier is the user identifier set by the user in the single sign-on system client during registration. The target role identifier is the role information of the user corresponding to the target user identifier in the target application, such as ordinary employee, manager, etc. The target role identifier is used to authenticate the user authority to log in to the first application.

[0061] In the present application, when the authentication policy is a high-security authentication policy, authentication reference information sent by the second application can be received, wherein the authentication reference information includes a second user identifier, a second relationship index of the first application associated with the second user identifier, a third relationship index of the second application associated with the second user identifier, a second signature, and a second authorization token of the second application, and the second application is an application that triggers login to the first application. Thereafter, if the second signature is verified successfully, the second user identifier is the same as the first user identifier, the second relationship index is the same as the first relationship index, the second authorization token is the same as the first authorization token, and the login registration table contains the first relationship index and the third relationship index, the authentication is successful; if the second signature verification fails, or the second user identifier is different from the first user identifier, or the second relationship index is different from the first relationship index, or the second authorization token is different from the first authorization token, and the login registration table does not contain the first relationship index or the third relationship index, the authentication fails.

[0062] When the authentication strategy is a quick authentication strategy, the third user identifier and application identifier associated with the first relationship index in the login registration table are queried and obtained; when the third user identifier is the same as the first user identifier and the application identifier is the application identifier of the first application, the authentication is successful; when the first application identifier is not included in the login registration table, or the third user identifier is different from the first user identifier, or the application identifier is not the application identifier of the first application, the authentication fails.

[0063] It is understandable that when the attacked user logs into the first application, the first user identifier or the first relationship index may be tampered with. The first relationship index and the first user identifier are different from the corresponding association relationship in the login registration table. Therefore, based on the association relationship in the login registration table in the SIM card, the attacked login request can be effectively identified.

[0064] Step 104: Send the authentication result to the terminal device.

[0065] In the present application, the authentication result can be sent to the terminal device to indicate whether the terminal device executes the subsequent process of logging into the first application.

[0066] Optionally, when the authentication is successful, a Personal Identification Number (PIN) code window pops up to display a prompt message for jumping to the first application. The prompt message may include the first application identifier and the second application identifier. After the user enters the PIN code and confirms it, the SIM card may receive confirmation information corresponding to the prompt message. The confirmation information includes the PIN code entered by the user. When it is confirmed that the PIN code is entered correctly, the authentication result may be sent to the terminal device. This avoids login attacks and chain attacks, and further improves the reliability and security of login authentication.

[0067] In the present application, after receiving a login authentication request for the first application to be redirected sent by a terminal device, which includes a first signature, a first user identifier, and a first relationship index of the first application associated with the first user identifier, when the first signature is successfully verified, an authentication strategy is determined based on the security level of the first application, so as to use the authentication strategy and the association relationship corresponding to the first application in the login registration table to verify the first relationship index and the first user identifier to determine the authentication result, and then send the authentication result to the terminal device. Thus, based on the association relationship corresponding to the first application in the login registration table stored in the SIM card, the first relationship index and the first user identifier are verified to determine the authentication result, which can effectively identify login requests based on attacks, and determine different authentication strategies based on different security levels of the first application, thereby expanding the authentication capability. Thereby, the reliability of single sign-on authentication is improved, and the application scenarios of the single sign-on authentication method are expanded.

[0068] Figure 2 A flowchart of a single sign-on authentication method provided in an embodiment of the present application.

[0069] like Figure 2 As shown, the single sign-on authentication method is executed by the SIM card and includes the following steps:

[0070] Step 201, receiving a login authentication request of a first application to be redirected sent by a terminal device, wherein the login authentication request includes a first signature, a first user identifier, a first relationship index of the first application associated with the first user identifier, and a first authorization token of a second application.

[0071] Step 202: When the first signature is successfully verified, determine an authentication strategy based on the security level of the first application.

[0072] In the present application, the specific implementation process of step 201-step 202 can be found in the detailed description of any embodiment of the present application, and will not be repeated here.

[0073] Step 203, when the authentication policy is a high-security authentication policy, receiving authentication reference information of the second application sent by the terminal device, wherein the authentication reference information includes a second user identifier, a second relationship index of the first application associated with the second user identifier, a third relationship index of the second application associated with the second user identifier, a second signature, and a second authorization token of the second application, wherein the second application is an application that triggers login to the first application.

[0074] In the present application, when the authentication strategy is a high-security authentication strategy, the first application can send a login confirmation message to the second application while the terminal device sends a login authentication request to the SIM card, or before receiving the authentication result sent by the SIM card that verifies the first relationship index and the first user identity according to the security level. After receiving the login confirmation message, the second application can send authentication reference information to the SIM card through the terminal device, wherein the authentication reference information includes the second user identity, the second relationship index of the first application associated with the second user identity, the third relationship index of the second application associated with the second user identity, the second signature, and the second authorization token of the second application. In this way, the SIM card can obtain the authentication reference information.

[0075] Optionally, when the security level is a preset level and the authentication policy corresponding to the preset level is a high-security authentication policy, the second application can send authentication reference information to the SIM card when triggering the jump to the first application. Thus, the SIM card can obtain the authentication reference information. In order to facilitate the SIM card to determine whether the second application triggers the login of the first application based on the authentication reference information, and verify the legitimacy of the login authentication request.

[0076] Among them, the second user identifier is the user identifier corresponding to the current login account of the second application. The second authorization token is the authorization token of the current login account of the second application. The second signature is generated by the terminal device using the public key corresponding to the SIM card to encrypt the second user identifier, the second relationship index of the first application associated with the second user identifier, the third relationship index of the second application associated with the second user identifier, the second authorization token, etc. The second relationship index of the first application associated with the second user identifier and the third relationship index of the second application associated with the second user identifier can be obtained by query.

[0077] Step 204, authentication is successful when the second signature verification is successful, the second user identifier is the same as the first user identifier, the second relationship index is the same as the first relationship index, the second authorization token is the same as the first authorization token, and the login registration table contains the first relationship index and the third relationship index.

[0078] In this application, the private key stored in the SIM card can be used to decrypt and verify the second signature to ensure the security of the authentication. The second user identifier is compared with the first user identifier to verify the user. The second relationship index is compared with the first relationship index to verify the application to be jumped. When the second user identifier is the same as the first user identifier, and the second relationship index is the same as the first relationship index, it is determined that the second application actually triggered the login of the first application. At the same time, it is determined whether the first relationship index and the third relationship index are included in the login registration table. When the first relationship index and the third relationship index are included in the login registration table, it means that the first application and the second application have registered for single sign-on in the SIM card, and it is determined that the first application and the second application are both legal logins. The second authorization token is compared with the first authorization token to ensure that the second application can jump directly to the first application.

[0079] Therefore, the authentication is successful when the second signature verification is successful, the second user identifier is the same as the first user identifier, the second relationship index is the same as the first relationship index, the second authorization token is the same as the first authorization token, and the login registration table contains the first relationship index and the third relationship index.

[0080] Optionally, the third user identifier and application identifier associated with the first relationship index in the login registration table may also be determined. Authentication is successful when the second signature verification is successful, the second user identifier is the same as the first user identifier, the second relationship index is the same as the first relationship index, the second authorization token is the same as the first authorization token, the login registration table contains the first relationship index and the third relationship index, the third user identifier is the same as the first user identifier, and the application identifier is the application identifier of the first application. This further improves the reliability and security of single sign-on authentication.

[0081] Therefore, while verifying whether the second application actually triggers the login of the first application, the legitimacy of the logins of the first and second applications is verified, achieving two-way authentication of the first and second applications, thereby improving the security and reliability of single sign-on authentication.

[0082] Step 205: If the second signature verification fails, or the second user identifier is different from the first user identifier, or the second relationship index is different from the first relationship index, or the second authorization token is different from the first authorization token, or the login registration table does not contain the first relationship index or the third relationship index, authentication fails.

[0083] Step 206: Send the authentication result to the terminal device.

[0084] In the present application, the specific implementation process of step 206 can be found in the detailed description of any embodiment of the present application, and will not be repeated here.

[0085] In the present application, after receiving a login authentication request for a first application to be jumped sent by a terminal device, which includes a first signature, a first user identifier, a first relationship index of the first application associated with the first user identifier, and a first authorization token of a second application, when the first signature is successfully verified, an authentication policy is determined based on the security level of the first application. Thereafter, when the authentication policy is a high-security authentication policy, authentication reference information including a second user identifier, a second relationship index of the first application associated with the second user identifier, a third relationship index of the second application associated with the second user identifier, a second signature, and a second authorization token of the second application can be received from the second application through the terminal device. When the second signature is successfully verified, the second user identifier is the same as the first user identifier, the second relationship index is the same as the first relationship index, the second authorization token is the same as the first authorization token, and the login registration table contains the first relationship index and the third relationship index, the authentication is successful. When the second signature verification fails, or the second user identifier is different from the first user identifier, or the second relationship index is different from the first relationship index, or the second authorization token is different from the first authorization token, and the login registration table does not contain the first relationship index or the third relationship index, the authentication fails. Thus, while verifying whether the second application actually triggers the login of the first application, the legitimacy of the login of the first application and the second application is verified, realizing two-way authentication of the first application and the second application based on the SIM card, and supporting the secure interconnection between the first application and the second application. Thus, the security, reliability and convenience of single sign-on are improved.

[0086] Figure 3 A flowchart of a single sign-on authentication method provided in an embodiment of the present application.

[0087] like Figure 3 As shown, the single sign-on authentication method is executed by the SIM card and includes the following steps:

[0088] Step 301: receiving a login authentication request of a first application to be redirected sent by a terminal device, wherein the login authentication request includes a first signature, a first user identifier, and a first relationship index of the first application associated with the first user identifier.

[0089] Step 302: When the first signature is successfully verified, determine an authentication strategy based on the security level of the first application.

[0090] In the present application, the specific implementation process of step 301-step 302 can be found in the detailed description of any embodiment of the present application, and will not be repeated here.

[0091] Step 303: When the authentication policy is a fast authentication policy, query and obtain the third user identifier and application identifier associated with the first relationship index in the login registration table.

[0092] In this application, when the authentication strategy is a fast authentication strategy, the login registration table can be queried based on the first relationship index to obtain the third user identifier and application identifier associated with the first relationship index, so as to verify the login authentication request according to the third user identifier and application identifier.

[0093] Step 304: When the third user identifier is the same as the first user identifier and the application identifier is the application identifier of the first application, the authentication is successful.

[0094] In this application, when the third user identifier is the same as the first user identifier and the application identifier is the application identifier of the first application, it means that the user corresponding to the first user identifier has logged in and registered for the second application in the SIM card, and the authentication is determined to be successful.

[0095] Step 305: If the login registration table does not contain the first relationship index, or the third user identifier is different from the first user identifier, or the application identifier is not the application identifier of the first application, the authentication fails.

[0096] In the present application, when the first relationship index is not included in the login registration table, or the third user identifier is different from the first user identifier, or the application identifier is not the application identifier of the first application, it means that the user needle corresponding to the first user identifier has not logged in and registered for the second application in the SIM card, and it is determined that the authentication has failed.

[0097] Optionally, the login authentication request may also include a first role identifier associated with the first user identifier. The second role identifier associated with the first relationship index in the login registration table may also be queried and obtained, and the first role identifier is compared with the second role identifier. When the first role identifier and the second role identifier are the same, it is determined that the user authority authentication requested for logging into the first application is passed. This prevents user authority from being tampered with. This further improves the reliability of single sign-on authentication.

[0098] Step 306: Send the authentication result to the terminal device.

[0099] In the present application, the specific implementation process of step 306 can be found in the detailed description of any embodiment of the present application, and will not be repeated here.

[0100] In this application, when the authentication strategy is a fast authentication strategy, the third user identifier and application identifier associated with the first relationship index in the login registration table are queried and obtained. When the third user identifier is the same as the first user identifier and the application identifier is the application identifier of the first application, the authentication is successful. When the login registration table does not contain the first relationship index, or the third user identifier is different from the first user identifier, or the application identifier is not the application identifier of the first application, the authentication fails. Thus, fast authentication based on the SIM card is realized, and the security, reliability and efficiency of single sign-on authentication are improved.

[0101] Figure 4 A flowchart of a single sign-on authentication method provided in an embodiment of the present application.

[0102] like Figure 4 As shown, the single sign-on authentication method is executed by a terminal device and includes the following steps:

[0103] Step 401: In response to the second application triggering a jump to the first application, determine whether the first application has been logged in.

[0104] In this application, after a user successfully logs into the second application in the terminal device using an account password, SIM authentication, or SMS authentication, he can click on the link to jump to the first application to trigger the login to the first application. The terminal device can confirm whether the user has logged into the first application based on the information recorded in the cookie.

[0105] In addition, after the user successfully logs in to the second application, the second application sends the first authorization token Token obtained by the user to the terminal device. Afterwards, the user can log in to the second application based on the Token without entering a password.

[0106] Optionally, the second application may carry the first authorization token to jump to the first application. Thus, the first application may obtain the first authorization token, so that the first application can directly jump back to the second application later, thereby realizing the interconnection and intercommunication between the second application and the first application.

[0107] In the present application, in order to realize single sign-on, it is necessary to register the first application and the second application for single sign-on in advance. The specific registration process is as follows: the user can set the target user identifier, the target application identifier, and / or the target role identifier in the single sign-on system client deployed in the terminal device. When the user triggers the registration control in the client, the client can generate a registration request based on the user identifier and the target application identifier, and send the registration request to the SIM card. After the SIM card receives the registration request, when it is determined that the association relationship between the target user identifier, the target application identifier, and / or the target role identifier is not registered, a target relationship index corresponding to the association relationship between the target user identifier, the target application identifier, and / or the target role identifier is generated, and the target relationship index is sent to the terminal device. Thus, the terminal device can obtain the target relationship index corresponding to the registration relationship between the target user identifier, the target application identifier, and / or the target user role, and store the target relationship index in association with the target user identifier, the target application identifier, and / or the target user role.

[0108] The target application identifier may be any information used to uniquely identify the target application, such as the name of the target application, and the target application may be the first application or the second application. The target user identifier is the user identifier set by the user in the single sign-on system client during registration. The target role identifier is the role information of the user corresponding to the target user identifier in the target application, such as ordinary employee, manager, etc.

[0109] Step 402: When the first application is not logged in, a login authentication request is sent to the SIM card, wherein the login authentication request includes a first signature, a first user identifier, and a relationship index of the first application associated with the first user identifier.

[0110] Among them, the first user identifier is the user identifier corresponding to the login account of the second application when the second application triggers logging into the first application. The user identifier can be any information used to uniquely identify the user, such as a mobile phone number.

[0111] In the present application, the terminal device can query and determine the first relationship index of the first application associated with the first user identifier. Afterwards, the first user identifier, the first relationship index of the first application associated with the first user identifier, etc. can be encrypted using the public key corresponding to the SIM card to generate a first signature. Then, based on the security level of the first application, the first signature, the first user identifier, and the first relationship index of the first application associated with the first user identifier, a login authentication request for the first application is generated, and the login authentication request is sent to the SIM card.

[0112] Optionally, when the first application authenticates the login request of the second application, the first authorization token may be configured in the login authentication request, so that the SIM card can verify the correctness of the first authorization token, thereby improving the reliability of single sign-on.

[0113] Optionally, the terminal device can obtain the preset security level of the first application from the system, so as to perform login authentication processing based on the authentication policy corresponding to the security level. At the same time, the security level can be configured in the login authentication request and sent to the SIM card, so that the SIM card can accurately determine the security level of the first application.

[0114] Step 403: Receive an authentication result sent by the SIM card, which verifies the first relationship index and the first user identifier according to the security level of the first application.

[0115] In this application, after receiving the login authentication request, the SIM card determines the authentication strategy based on the security level when the first signature is successfully verified. Afterwards, the authentication strategy and the association relationship corresponding to the first application in the login registration table are used to verify the first relationship index and the first user identifier to determine the authentication result, and the authentication result is sent to the terminal device. In this way, the terminal device can receive the authentication result corresponding to the login authentication request sent by the SIM card.

[0116] Optionally, when the security level of the first application is a preset level, the authentication policy corresponding to the preset level is a high-security authentication policy. While sending a login authentication request to the SIM card, or before receiving an authentication result sent by the SIM card that verifies the first relationship index and the first user identity according to the security level, the first application may send a login confirmation message to the second application. After receiving the login confirmation message, the second application may send authentication reference information to the SIM card through the terminal device, wherein the authentication reference information includes the second user identity, the second relationship index of the first application associated with the second user identity, the third relationship index of the second application associated with the second user identity, the second signature, and the second authorization token of the second application.

[0117] Optionally, when the security level of the first application is a preset level, the second application can send authentication reference information to the SIM card through the terminal device when triggering the jump to the first application, so that the SIM card can determine whether the second application triggers the login of the first application based on the authentication reference information, and verify the legitimacy of the login authentication request.

[0118] Among them, the second user identifier is the user identifier corresponding to the current login account of the second application. The second authorization token is the authorization token of the current login account of the second application. The second signature is generated by the terminal device using the public key corresponding to the SIM card to encrypt the second user identifier, the second relationship index of the first application associated with the second user identifier, the third relationship index of the second application associated with the second user identifier, the second authorization token, etc. The second relationship index of the first application associated with the second user identifier and the third relationship index of the second application associated with the second user identifier can be obtained by query.

[0119] Step 404: Determine whether to log in to the first application based on the authentication result.

[0120] In this application, if the authentication is successful, the subsequent login process of the first application is executed. If the authentication fails, it jumps to the login page.

[0121] In the present application, in response to the second application triggering the jump to the first application, it is determined whether the first application has been logged in. If the first application has been logged in, a login authentication request including a first signature, a first user identifier, and a relationship index of the first application associated with the first user identifier is sent to the SIM card. After that, the authentication result sent by the SIM card is received, which verifies the first relationship index and the first user identifier according to the security level of the first application, so as to determine whether to log in to the first application according to the authentication result. Therefore, by verifying the first relationship index and the first user identifier based on the SIM card to determine the authentication result, it is possible to effectively identify login requests based on attacks, and determine different authentication strategies based on different security levels of the first application, thereby expanding the authentication capabilities. This improves the reliability of single-point sign-on authentication and expands the application scenarios of the single-point sign-on authentication method.

[0122] Figure 5 This is a schematic diagram of an interaction of a single sign-on authentication provided in an embodiment of the present application. Figure 5 As shown, the steps are as follows:

[0123] (1) In response to the second application (system A) triggering a jump to the first application (system B), the terminal device sends a login authentication request to the SIM card carrying the first user identifier (mobile phone number), the cookie of system A or the first authorization token Atoken1.

[0124] The login authentication request message sent by system B to the SIM card is:

[0125] sendB=BSystemID1+phone1+Atoken1+Sign(BSystemID1+phone1+Atoken1)

[0126] Among them, BSystemID1 is the first relationship index of the first application associated with the first user identifier, and Sign(BSystemID1+phone1+Atoken1) is the first signature generated based on BSystemID1, phone1, and Atoken1.

[0127] (2) When the security level of the first application is a preset level and the authentication policy corresponding to the preset level is a high-security authentication policy, the terminal device simultaneously requests the system A to store authentication reference information in the super SIM card.

[0128] The login confirmation message sent by system B to system A is:

[0129] reqB=BSystemID1+phone1+Atoken1+Sign(BSystemID1+phone1+Atoken1)

[0130] (3) After receiving the login confirmation information of system B, system A sends the second user identifier phone2 corresponding to the current login account of system A, the third relationship index ASystemID1 of system A associated with the second user identifier, the current Token of system A (i.e., the second authorization token Atoken2), and BSystemID2 of the target application currently requested to be jumped by system A associated with the second user identifier to the SIM card through the terminal device, and stores them in the super SIM card;

[0131] Authentication reference information sent by system A to the SIM card:

[0132] sendA=ASystemID1+phone2+Atoken2+BSystemID2+Sign(ASystemID1+phone2+Atoken2+BSystemID2)

[0133] Among them, Sign(ASystemID1+phone2+Atoken2+BSystemID2) is the second signature.

[0134] (4) After receiving the message from system A and system B, the SIM card verifies the signature and parses it to confirm whether the login authentication request of system B is legal. If it is legal and the login of system B is triggered by system A, the authentication success result is returned to the terminal device. If it is illegal or system A does not trigger the login of system B, the authentication failure result is returned to the terminal device.

[0135] The request legitimacy judgment process is as follows: verify the signature Sign, and then confirm whether the system set (i.e., the login registry) contains BSystemID1 and ASystemID1. If the signature verification is successful, and both BSystemID1 and ASystemID1 are included in the system set, the request is determined to be legitimate. If the signature verification fails, or either BSystemID1 or ASystemID1 is not included in the system set, the request is determined to be illegitimate.

[0136] The judgment process of whether the login of system B is triggered by system A is as follows: verify whether BSystemID2 and BSystemID1, phone2 and phone1, Atoken2 and Atoken1 in sendB and sendA are consistent. If they are consistent, it is determined that the login of system B is triggered by system A. If any pair is inconsistent, it is determined that system A did not trigger the login of system B.

[0137] (5) If the parsing authentication in (4) fails, the login to system B fails and the user is redirected to the login page. If the authentication succeeds, the SIM card pops up a PIN code window to display the system A logo (such as the application name) and the system B logo, asking the user to confirm whether to log in. If the PIN code is confirmed successfully, the authentication success result is returned to the terminal device, instructing the execution of the subsequent login processing of system B, setting the session and cookie, and completing the two-way login authentication of the AB system.

[0138] Figure 6 This is another interactive diagram of single sign-on authentication provided by the embodiment of the present application. Figure 6 As shown, the steps are as follows:

[0139] (1) System A (second application) adjusts the URL for accessing System B (first application) and directs the URL to the address that System B has authorized;

[0140] (2) After the user clicks the authorized URL address on system A, he sends a login request to system B, triggering the login authentication request process of system B.

[0141] The login request contains the first user ID phone1, the first user role role1, the address to which the access rights application is redirected, and the ICCID of the SIM card. The above information can be obtained from SystemCollect in the super SIM card. If there is no relevant information about System B in SystemCollect in the SIM card, the current mobile phone number is obtained by number retrieval and sent to System B as the first user ID.

[0142] (3) After receiving the login request, system B confirms that system B is not logged in, and the security level corresponding to system B is the second level, and the authentication strategy corresponding to the second level is the fast authentication strategy, and then sends a login authentication request to the SIM card to authenticate the login request of system A. After the authentication is successful, the request authority is confirmed.

[0143] The login authentication request message sent by system B to the SIM card is:

[0144] sendB=BSystemID1+phone1+Atoken1+Sign(BSystemID1+phone1+Atoken1)

[0145] Among them, BSystemID1 is the first relationship index of the first application associated with the first user identifier, and Sign(BSystemID1+phone1+Atoken1) is the first signature generated based on BSystemID1, phone1, and Atoken1.

[0146] The SIM card queries the login registration table to determine the second user ID phone2 and the second user role role2 associated with BSystemID1. If phone2 is confirmed to be the same as phone1, and role1 is the same as role2, it means that the user corresponding to the first user ID has registered in the SIM card using the first user role for the first application, and the authentication is successful.

[0147] If the login registration form does not contain BSystemID1, the authentication fails. Alternatively, if the login registration form does not contain BSystemID1, the mobile phone number corresponding to the SIM card is obtained based on the base station number, and the mobile phone number is fed back to system B as the second user identifier.

[0148] System B queries to determine whether there is a user corresponding to the second user identifier in the system. If there is a user corresponding to the second user identifier, the second user role associated with the second user identifier is obtained, so that the second user identifier and the second role are implicitly built into the super SIM card, and system B is logged in at the same time.

[0149] When the login request to system A is successfully authenticated, system B further confirms the user's requested authority. When the requested authority of system A does not exceed the authority range corresponding to the second user role in system B, the authority authentication is passed. For example, after the login request to system A is successfully authenticated, system B can obtain the second user role role2 associated with BSystemID1 from the SIM card. After that, query to determine the authority range corresponding to role2. If the requested authority of system A is within the authority range, the authority authentication is passed. If the requested authority of system A is outside the authority range, the authority authentication is not passed.

[0150] (4) After receiving the authentication, system B issues a token to system A for accessing system B, completing the login to system B.

[0151] In order to implement the above embodiment, the present application also proposes a single sign-on authentication device.

[0152] Figure 7 A schematic diagram of the structure of a single sign-on authentication device provided in an embodiment of the present application.

[0153] like Figure 7 As shown, the single sign-on authentication device is applied to the SIM card side, and includes a transceiver module 710 , a determination module 720 , and a verification module 730 .

[0154] The transceiver module 710 is used to receive a login authentication request of a first application to be redirected sent by a terminal device, wherein the login authentication request includes a first signature, a first user identifier, and a first relationship index of the first application associated with the first user identifier;

[0155] A determination module 720, configured to determine an authentication strategy based on a security level of the first application when the first signature verification succeeds;

[0156] The verification module 730 is used to verify the first relationship index and the first user identifier by using the authentication policy and the association relationship corresponding to the first application in the login registration table to determine the authentication result;

[0157] The transceiver module 710 is used to send the authentication result to the terminal device.

[0158] Further, in a possible implementation of the embodiment of the present application, the login authentication request also includes a first authorization token of the second application. When the authentication policy is a high-security authentication policy, the verification module 730 is used to:

[0159] Receive authentication reference information of a second application sent by a terminal device, wherein the authentication reference information includes a second user identifier, a second relationship index of the first application associated with the second user identifier, a third relationship index of the second application associated with the second user identifier, a second signature, and a second authorization token of the second application, wherein the second application is an application that triggers login to the first application;

[0160] If the second signature verification is successful, the second user identifier is the same as the first user identifier, the second relationship index is the same as the first relationship index, the second authorization token is the same as the first authorization token, and the login registration table contains the first relationship index and the third relationship index, the authentication is successful;

[0161] Authentication fails if the second signature verification fails, or the second user identifier is different from the first user identifier, or the second relationship index is different from the first relationship index, or the second authorization token is different from the first authorization token, or the login registration table does not contain the first relationship index or the third relationship index.

[0162] Furthermore, in a possible implementation of the embodiment of the present application, when the authentication strategy is a fast authentication strategy, the verification module 730 is used to:

[0163] Query and obtain the third user identifier and application identifier associated with the first relationship index in the login registration table;

[0164] In the case where the third user identifier is the same as the first user identifier and the application identifier is the application identifier of the first application, the authentication is successful;

[0165] In the case that the first relationship index is not included in the login registration table, or the third user identifier is different from the first user identifier, or the application identifier is not the application identifier of the first application, the authentication fails.

[0166] Furthermore, in a possible implementation of the embodiment of the present application, the transceiver module 710 is used to:

[0167] If the authentication is successful, a personal identification password PIN code window pops up to display a prompt message to jump to the first application;

[0168] After receiving the confirmation information corresponding to the prompt information, the authentication result is sent to the terminal device.

[0169] Furthermore, in a possible implementation of the embodiment of the present application, a registration module is also included, which is used to:

[0170] Receiving a registration request of a target application sent by a terminal device, wherein the target application is a first application or a second application, and the registration request includes a target user identifier, a target application identifier, and / or a target user role;

[0171] Determining whether the target user identifier, the target application identifier, and / or the association relationship between the target user role is registered;

[0172] Generate a target relationship index without registration, send the target relationship index to the terminal device, and store the target relationship index, target user identifier, target application identifier, and / or target user role in a login registration table, wherein the target role identifier is used to authenticate the user authority to log in to the first application.

[0173] It should be noted that the above explanation of the embodiment of the single sign-on authentication method executed by the SIM card is also applicable to the single sign-on authentication device applied to the SIM card side of this embodiment, which will not be repeated here.

[0174] In the present application, after receiving a login authentication request for the first application to be redirected sent by a terminal device, which includes a first signature, a first user identifier, and a first relationship index of the first application associated with the first user identifier, when the first signature is successfully verified, an authentication strategy is determined based on the security level of the first application, so as to use the authentication strategy and the association relationship corresponding to the first application in the login registration table to verify the first relationship index and the first user identifier to determine the authentication result, and then send the authentication result to the terminal device. Thus, based on the association relationship corresponding to the first application in the login registration table stored in the SIM card, the first relationship index and the first user identifier are verified to determine the authentication result, which can effectively identify login requests based on attacks, and determine different authentication strategies based on different security levels of the first application, thereby expanding the authentication capability. Thereby, the reliability of single sign-on authentication is improved, and the application scenarios of the single sign-on authentication method are expanded.

[0175] In order to implement the above embodiment, the present application also proposes a single sign-on authentication device.

[0176] Figure 8 A schematic diagram of the structure of a single sign-on authentication device provided in an embodiment of the present application.

[0177] like Figure 8 As shown, the single sign-on authentication device is applied to the terminal device side, and includes a confirmation module 810, a transceiver module 820, and a processing module 830.

[0178] Confirmation module 810, for determining whether the first application has been logged in in response to the second application triggering the jump to the first application;

[0179] The transceiver module 820 is used to send a login authentication request to the SIM card when the first application is not logged in, wherein the login authentication request includes the first signature, the first user identifier, and the relationship index of the first application associated with the first user identifier;

[0180] The transceiver module 820 is used to receive an authentication result sent by the SIM card, which verifies the first relationship index and the first user identifier according to the security level of the first application;

[0181] The processing module 830 is used to determine whether to log in to the first application according to the authentication result.

[0182] Further, in a possible implementation of the embodiment of the present application, the login authentication request also includes a first authorization token of the second application, and the above-mentioned transceiver module 820 is further used to:

[0183] When the security level of the first application is a preset level, the second application is triggered to send authentication reference information to the SIM card, wherein the authentication reference information includes the second user identifier, the second relationship index of the first application associated with the second user identifier, the third relationship index of the second application associated with the second user identifier, the second signature, and the second authorization token of the second application.

[0184] Furthermore, in a possible implementation of the embodiment of the present application, a registration module is also included, which is used to:

[0185] In response to the target application triggering the registration of login authentication, sending a registration request of the target application to the SIM card, wherein the target application is the first application or the second application, and the registration request includes a target user identifier, a target application identifier, and / or a target user role;

[0186] Receive the target user identification, the target application identification, and / or the target relationship index corresponding to the registration relationship between the target user roles sent by the SIM card.

[0187] It should be noted that the above explanation of the embodiment of the single sign-on authentication method executed by the terminal device is also applicable to the single sign-on authentication device applied to the terminal device side of this embodiment, and will not be repeated here.

[0188] In order to implement the above embodiments, the present application also proposes an electronic device, comprising: a processor, and a memory communicatively connected to the processor; the memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory to implement the method provided by the above embodiments.

[0189] In order to implement the above embodiments, the present application also proposes a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the methods provided by the above embodiments.

[0190] The collection, storage, use, processing, transmission, provision and disclosure of user personal information involved in this application are in compliance with relevant laws and regulations and do not violate public order and good morals.

[0191] It should be noted that personal information from users should be collected for legitimate and reasonable purposes and should not be shared or sold outside of these legitimate uses. In addition, such collection / sharing should be carried out after receiving the user's informed consent, including but not limited to notifying the user to read the user agreement / user notice and sign the agreement / authorization including authorization of relevant user information before the user uses the function. In addition, any necessary steps should be taken to protect and safeguard access to such personal information data and ensure that others who have access to personal information data comply with its privacy policy and procedures.

[0192] This application is expected to provide an implementation scheme for users to selectively block the use or access of personal information data. That is, this application is expected to provide hardware and / or software to prevent or block access to such personal information data. Once the personal information data is no longer needed, risks can be minimized by limiting data collection and deleting data. In addition, when applicable, personal identifiers are removed from such personal information to protect the privacy of users.

[0193] In the description of the aforementioned embodiments, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0194] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of this application, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0195] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, fragment or portion of code comprising one or more executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present application belong.

[0196] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute the instructions), or in combination with these instruction execution systems, devices or apparatuses. For the purpose of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in combination with these instruction execution systems, devices or apparatuses. More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or processing in other suitable ways if necessary, and then stored in a computer memory.

[0197] It should be understood that the various parts of the present application can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0198] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0199] In addition, each functional unit in each embodiment of the present application may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0200] The storage medium mentioned above may be a read-only memory, a magnetic disk or an optical disk, etc. Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limiting the present application. A person of ordinary skill in the art may change, modify, replace and modify the above embodiments within the scope of the present application.

Claims

1. A single sign-on authentication method, characterized in that: Executed by a SIM card, the method comprises: Receiving a login authentication request of a first application to be redirected sent by a terminal device, wherein the login authentication request includes a first signature, a first user identifier, and a first relationship index of a first application associated with the first user identifier; In a case where the verification of the first signature is successful, determining an authentication strategy based on the security level of the first application; Using the authentication policy and the association relationship corresponding to the first application in the login registration table, verify the first relationship index and the first user identifier to determine the authentication result; Sending the authentication result to the terminal device; The login authentication request also includes a first authorization token of the second application. When the authentication policy is a high-security authentication policy, using the authentication policy and the association relationship corresponding to the first application in the login registration table to verify the first relationship index and the first user identifier to determine the authentication result includes: Receive authentication reference information of a second application sent by a terminal device, wherein the authentication reference information includes a second user identifier, a second relationship index of the first application associated with the second user identifier, a third relationship index of the second application associated with the second user identifier, a second signature, and a second authorization token of the second application, wherein the second application is an application that triggers login to the first application; The authentication is successful when the second signature is verified successfully, the second user identifier is the same as the first user identifier, the second relationship index is the same as the first relationship index, the second authorization token is the same as the first authorization token, and the login registration table contains the first relationship index and the third relationship index.

2. The method according to claim 1, characterized in that If the second signature verification fails, or the second user identifier is different from the first user identifier, or the second relationship index is different from the first relationship index, or the second authorization token is different from the first authorization token, or the login registration table does not contain the first relationship index or the third relationship index, the authentication fails.

3. The method according to claim 1, characterized in that In the case where the authentication policy is a quick authentication policy, the using of the authentication policy and the association relationship corresponding to the first application in the login registration table to verify the first relationship index and the first user identifier to determine the authentication result includes: Query and obtain the third user identifier and application identifier associated with the first relationship index in the login registration table; In a case where the third user identifier is the same as the first user identifier and the application identifier is the application identifier of the first application, the authentication is successful; If the first relationship index is not included in the login registration table, or the third user identifier is different from the first user identifier, or the application identifier is not the application identifier of the first application, authentication fails.

4. The method according to any one of claims 1 to 3, wherein sending the authentication result to the terminal device comprises: If the authentication is successful, a PIN code window pops up to display a prompt message for jumping to the first application; After receiving the confirmation information corresponding to the prompt information, the authentication result is sent to the terminal device.

5. The method according to claim 1, characterized in that Also includes: Receiving a registration request of a target application sent by a terminal device, wherein the target application is a first application or a second application, and the registration request includes a target user identifier, a target application identifier, and / or a target role identifier; Determining whether the association relationship between the target user identifier, the target application identifier, and / or the target role identifier is registered; Generate a target relationship index without registration, send the target relationship index to the terminal device, and store the target relationship index, the target user identifier, the target application identifier, and / or the target role identifier in the login registration table in an associated manner, wherein the target role identifier is used to authenticate the user authority to log in to the first application.

6. A single sign-on authentication method, characterized in that: Executed by a terminal device, the method includes: In response to the second application triggering a jump to the first application, determining whether the first application has been logged in; When the first application is not logged in, sending a login authentication request to the SIM card, wherein the login authentication request includes a first signature, a first user identifier, a first relationship index of the first application associated with the first user identifier, and the login authentication request also includes a first authorization token of the second application; Receive an authentication result sent by the SIM card that is a successful authentication, in which the first relationship index and the first user identifier are verified according to the security level of the first application when the authentication policy is a high-security authentication policy, wherein the authentication result is authentication reference information of a second application sent by the terminal device received by the SIM card, wherein the authentication reference information includes a second user identifier, a second relationship index of the first application associated with the second user identifier, a third relationship index of the second application associated with the second user identifier, a second signature, and a second authorization token of the second application; and is generated when the second signature is successfully verified, the second user identifier is the same as the first user identifier, the second relationship index is the same as the first relationship index, the second authorization token is the same as the first authorization token, and the login registration table contains the first relationship index and the third relationship index; Determine whether to log in to the first application according to the authentication result.

7. The method according to claim 6, characterized in that Before receiving the authentication result sent by the SIM card for verifying the first relationship index and the first user identifier according to the security level, the method further includes: When the security level of the first application is a preset level, the second application is triggered to send authentication reference information to the SIM card, wherein the authentication reference information includes a second user identifier, a second relationship index of the first application associated with the second user identifier, a third relationship index of the second application associated with the second user identifier, a second signature, and a second authorization token of the second application.

8. The method according to claim 6, characterized in that Also includes: In response to the target application triggering the registration of login authentication, sending a registration request of the target application to the SIM card, wherein the target application is the first application or the second application, and the registration request includes a target user identifier, a target application identifier, and / or a target user role; Receive the target user identifier, the target application identifier, and / or the target relationship index corresponding to the registration relationship between the target user roles sent by the SIM card.

9. A single sign-on authentication device, characterized in that: Applied to the SIM card side, the device includes: A transceiver module, configured to receive a login authentication request of a first application to be redirected sent by a terminal device, wherein the login authentication request includes a first signature, a first user identifier, and a first relationship index of a first application associated with the first user identifier; a determination module, configured to determine an authentication strategy based on a security level of the first application when the first signature verification is successful; A verification module, configured to verify the first relationship index and the first user identifier by using the authentication policy and the association relationship corresponding to the first application in the login registration table to determine the authentication result; The transceiver module is used to send the authentication result to the terminal device; The login authentication request also includes a first authorization token of the second application. When the authentication strategy is a high-security authentication strategy, the verification module is specifically used to: Receive authentication reference information of a second application sent by a terminal device, wherein the authentication reference information includes a second user identifier, a second relationship index of the first application associated with the second user identifier, a third relationship index of the second application associated with the second user identifier, a second signature, and a second authorization token of the second application, wherein the second application is an application that triggers login to the first application; The authentication is successful when the second signature is verified successfully, the second user identifier is the same as the first user identifier, the second relationship index is the same as the first relationship index, the second authorization token is the same as the first authorization token, and the login registration table contains the first relationship index and the third relationship index.

10. A single sign-on authentication device, characterized in that: Applied to the terminal device side, the device includes: A confirmation module, configured to determine whether the first application has been logged in in response to the second application triggering the jump to the first application; a transceiver module, configured to send a login authentication request to the SIM card when the first application is not logged in, wherein the login authentication request includes a first signature, a first user identifier, a first relationship index of the first application associated with the first user identifier, and the login authentication request also includes a first authorization token of a second application; The transceiver module is used to receive an authentication result sent by the SIM card, which is a successful authentication result of verifying the first relationship index and the first user identifier according to the security level of the first application when the authentication policy is a high-security authentication policy, wherein the authentication result is authentication reference information of a second application sent by the terminal device received by the SIM card, wherein the authentication reference information includes a second user identifier, a second relationship index of the first application associated with the second user identifier, a third relationship index of the second application associated with the second user identifier, a second signature, and a second authorization token of the second application; and is generated when the second signature is successfully verified, the second user identifier is the same as the first user identifier, the second relationship index is the same as the first relationship index, the second authorization token is the same as the first authorization token, and the login registration table contains the first relationship index and the third relationship index; A processing module is used to determine whether to log in to the first application according to the authentication result.

11. An electronic device, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 5, or implements the method according to any one of claims 6 to 8.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method according to any one of claims 1 to 5, or to implement the method according to any one of claims 6 to 8.

Images