Single sign-on method, system, electronic device and storage medium

Abstract

The present invention proposes a single sign-on method, system, electronic device and storage medium, which relate to the field of security authentication technology. The method includes: in response to identifying a first access request, authenticating the target terminal; in response to the identity authentication being passed, generating a first primary token and a first secondary token, wherein the first primary token is used to provide the target terminal with permission to access applications in the first system, and the first secondary token is used to provide terminals in a block with permission to access applications in systems other than the first system, or to provide other terminals in the block with permission to access applications in the first system except the target terminal. In this way, terminals in the block can access applications in the first system through the first primary token and the first secondary token, and access applications in other systems across zones through the first secondary token without the need for repeated login, thereby improving the user's experience in accessing system applications.

Description

Technical Field

[0001] The present invention relates to the field of security authentication technology, and in particular to a single sign-on method, system, electronic device and storage medium. Background Art

[0002] With the continuous progress of enterprise informatization and the rapid development of Internet technology, many enterprises have developed multiple application systems at different stages. Due to the differences in functional emphasis, design methods and development technologies, each application system has formed its own independent user database and user authentication system, so that users have independent accounts in each application system, and need to log in with the account of the application system before entering each application system. Therefore, many enterprises often achieve enterprise business integration through single sign-on (SSO), and single sign-on requires a unified identity authentication system. For different types of application systems using different authentication domains, since user data of different authentication domains cannot be shared and connected, users need to enter their username and password again when jumping between different authentication domains, thus failing to achieve single sign-on. Summary of the invention

[0003] The present invention aims to solve one of the technical problems in the related art at least to a certain extent.

[0004] To this end, an object of the present invention is to provide a single sign-on method.

[0005] The second objective of the present invention is to provide a single sign-on system.

[0006] A third objective of the present invention is to provide an electronic device.

[0007] A fourth object of the present invention is to provide a non-transitory computer-readable storage medium.

[0008] To achieve the above-mentioned purpose, the first aspect of the implementation method of the present invention proposes a single sign-on method, including: in response to identifying a first access request from a target terminal in a block to access an application in a first system, authenticating the target terminal, wherein the block includes at least one terminal; in response to successful identity authentication, generating a first primary token and a first secondary token, wherein the first primary token is used to provide the target terminal with permission to access applications in the first system, and the first secondary token is used to provide the terminals in the block with permission to access applications in systems other than the first system, or to provide other terminals in the block other than the target terminal with permission to access applications in the first system.

[0009] According to one embodiment of the present invention, the implementation of terminals in the block accessing applications of other systems through the first sub-token includes: for any access terminal in the block, in response to identifying a second access request for the access terminal to access an application in a second system, obtaining the load level of the access terminal; in response to the load level being the first load level, sending a sub-token inventory data request to the second system, and applying to the second system for replacing the first sub-token based on the request result of the sub-token inventory data request and the first sub-token to obtain a second sub-token; or, in response to the load level being the second load level, sending an identity authentication request to the second system through the access terminal, and in response to the access terminal receiving a broadcast message of a successful identity authentication request, applying to the second system for replacing the first sub-token based on the broadcast message and the first sub-token to obtain a second sub-token; the access terminal accesses the application in the second system through the second sub-token.

[0010] According to one embodiment of the present invention, the application to the second system for replacing the first sub-token to obtain the second sub-token based on the request result of the sub-token inventory data request and the first sub-token includes: in response to the request result that the third sub-token in the second system is not used, performing identity authentication in the second system based on the first primary token; in response to the identity authentication being passed, applying to the second system for replacing the first sub-token to obtain the second sub-token.

[0011] According to an embodiment of the present invention, the method further comprises: in response to the request result being that the third sub-token in the second system is being used, not responding to the second access request for the access terminal to access an application in the second system.

[0012] According to an embodiment of the present invention, the method further includes: in response to the load level being the first load level, the access terminal does not receive broadcasting.

[0013] According to one embodiment of the present invention, obtaining the load level of the access terminal includes: obtaining the load quantity of the access terminal; in response to the load quantity being less than a determination threshold, determining that the load level is the first load level; or, in response to the load quantity being greater than or equal to the determination threshold, determining that the load level is the second load level.

[0014] According to one embodiment of the present invention, the application to the second system to replace the first sub-token to obtain the second sub-token includes: modifying the access scope information, central node authorization information, and allowed user identity ID in the first sub-token to data adapted to the second system, and modifying the effective start time and effective duration in the first sub-token according to the time modification rules to generate the second sub-token.

[0015] According to one embodiment of the present invention, modifying the valid start time and valid duration in the first sub-token according to the time modification rule includes: obtaining a first request urgency and a first application quantity of the first system, and obtaining a second request urgency and a second application quantity of the second system; modifying the valid start time and valid duration in the first sub-token according to the time modification rule based on the first request urgency, the first application quantity, the second request urgency and the second application quantity.

[0016] According to one embodiment of the present invention, the modification rules include: using the start time corresponding to the system with higher urgency between the first request urgency and the second request urgency as the effective start time of the first sub-token after modification; and using the effective duration corresponding to the system with more applications between the first number of applications and the second number of applications as the effective duration of the first sub-token after modification.

[0017] According to one embodiment of the present invention, generating the first primary token and the first secondary token includes: obtaining first access range information, first central node authorization information, first allowed user identity ID, first starting time, first valid period, second access range information, second central node authorization information, second allowed user identity ID, second starting time and second valid period; establishing the first primary token based on the first access range information, the first central node authorization information, the first allowed user identity ID, the first starting time and the first valid period, and establishing the first secondary token based on the second access range information, the second central node authorization information, the second allowed user identity ID, the second starting time and the second valid period.

[0018] According to one embodiment of the present invention, the method also includes: for any application in the first system, determining whether the application has been accessed by the target terminal using the first primary token; in response to the application being accessed by the target terminal using the first primary token, determining that the application is capable of being accessed by other terminals in the block through the first secondary token shared by the target terminal.

[0019] To achieve the above-mentioned purpose, the second aspect of the present invention proposes a single sign-on system, including: a verification module, used to authenticate the target terminal in response to identifying a first access request from a target terminal in a block to access an application in a first system, wherein the block is also used for at least one terminal; a generation module, used to generate a first primary token and a first secondary token in response to successful identity authentication, wherein the first primary token is used to provide the target terminal with access to applications in the first system, and the first secondary token is used to provide the terminals in the block with access to applications in systems other than the first system, or to provide other terminals in the block other than the target terminal with access to applications in the first system.

[0020] According to one embodiment of the present invention, the generation module is also used to: in response to identifying a second access request from the target terminal to access an application in a second system, obtain the load level of the target terminal; in response to the load level being the first load level, send a sub-token inventory data request to the second system, and apply to the second system for replacement of the first sub-token based on the request result of the sub-token inventory data request and the first sub-token to obtain a second sub-token; or, in response to the load level being the second load level, send an identity authentication request to the second system through the target terminal, and in response to the target terminal receiving a broadcast message indicating a successful identity authentication request, apply to the second system for replacement of the first sub-token based on the broadcast message and the first sub-token to obtain a second sub-token; the target terminal accesses the application in the second system through the second sub-token.

[0021] According to one embodiment of the present invention, the generation module is also used to: in response to the request result that the third sub-token in the second system is not used, perform identity authentication in the second system based on the first primary token; in response to the identity authentication being passed, apply to the second system to replace the first sub-token to obtain a second sub-token.

[0022] According to one embodiment of the present invention, the generating module is further used for: in response to the request result being that the third sub-token in the second system is being used, not responding to the second access request of the target terminal to access the application in the second system.

[0023] According to one embodiment of the present invention, the generating module is further configured to: in response to the load level being the first load level, the target terminal does not receive the broadcast.

[0024] According to one embodiment of the present invention, the generation module is also used to: obtain the load quantity of the target terminal; in response to the load quantity being less than a determination threshold, determine that the load level is the first load level; or, in response to the load quantity being greater than or equal to the determination threshold, determine that the load level is the second load level.

[0025] According to one embodiment of the present invention, the generation module is also used to: modify the access scope information, central node authorization information, and allowed user identity ID in the first sub-token to data adapted to the second system, and at the same time modify the effective start time and effective duration in the first sub-token according to the time modification rules to generate the second sub-token.

[0026] According to one embodiment of the present invention, the generation module is also used to: obtain the first request urgency and the first application quantity of the first system, and obtain the second request urgency and the second application quantity of the second system; modify the effective start time and the effective duration in the first sub-token according to the time modification rule based on the first request urgency, the first application quantity, the second request urgency and the second application quantity.

[0027] According to one embodiment of the present invention, the modification rules include: using the start time corresponding to the system with higher urgency between the first request urgency and the second request urgency as the effective start time of the first sub-token after modification; and using the effective duration corresponding to the system with more applications between the first number of applications and the second number of applications as the effective duration of the first sub-token after modification.

[0028] According to one embodiment of the present invention, the generation module is also used to: obtain first access range information, first central node authorization information, first allowed user identity ID, first starting time, first valid period, second access range information, second central node authorization information, second allowed user identity ID, second starting time and second valid period; establish the first primary token based on the first access range information, the first central node authorization information, the first allowed user identity ID, the first starting time and the first valid period, and establish the first secondary token based on the second access range information, the second central node authorization information, the second allowed user identity ID, the second starting time and the second valid period.

[0029] According to one embodiment of the present invention, the generation module is also used to: determine, for any application in the first system, whether the application has been accessed by the target terminal using the first primary token; in response to the application being accessed by the target terminal using the first primary token, determine whether the application is accessible by other terminals in the block through the first secondary token shared by the target terminal.

[0030] To achieve the above-mentioned purpose, the third aspect embodiment of the present invention proposes an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to implement the single sign-on method as described in the first aspect embodiment of the present invention.

[0031] To achieve the above-mentioned purpose, the fourth aspect of the present invention proposes a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to implement the single sign-on method as described in the first aspect of the present invention.

[0032] When it is identified that there is a terminal in the block accessing an application in the first system, a first primary token and a first secondary token are generated at the same time. The terminal in the block can access the application in the first system through the first primary token and the first secondary token, and access the application in other systems across zones through the first secondary token without the need for repeated login, thereby improving the user experience of accessing system applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 is a schematic diagram of a single sign-on method according to an embodiment of the present invention;

[0034] Figure 2 is a schematic diagram of another single sign-on method according to an embodiment of the present invention;

[0035] Figure 3 is a schematic diagram of another single sign-on method according to an embodiment of the present invention;

[0036] Figure 4 is a schematic diagram of another single sign-on method according to an embodiment of the present invention;

[0037] Figure 5 is a schematic diagram of a single sign-on system according to an embodiment of the present invention;

[0038] Figure 6 is a schematic diagram of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0039] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present invention, and should not be construed as limiting the present invention.

[0040] The acquisition, storage, use, and processing of data in the technical solution of the present invention are in compliance with the relevant provisions of national laws and regulations.

[0041] Figure 1 Schematic diagram of a single sign-on method according to an embodiment of the present invention. Figure 1 As shown, the single sign-on method includes the following steps:

[0042] S101 , in response to identifying a first access request from a target terminal in a block to access an application in a first system, authenticate the target terminal, wherein the block includes at least one terminal.

[0043] It should be noted that the first system stores an application program, and the first system also includes a server, a central node, etc. The server is connected to the terminal to receive requests from the terminal and transmit data, and the central node is used to implement data processing, token production, data broadcasting, etc.

[0044] The single sign-on method of the embodiment of the present application can be applied to the scenario where users in the same block perform a single sign-on system. The executor of the single sign-on of the embodiment of the present application can be the single sign-on system of the embodiment of the present application, and the single sign-on system can be set on an electronic device.

[0045] It should be noted that the terminal in the embodiment of the present invention corresponds to one user, and the terminals involved are configured in the same block. Therefore, after one terminal is successfully authenticated, other terminals in the block are also considered to be successfully authenticated, thereby achieving unified authentication.

[0046] In the embodiment of the present invention, the first access request may include a variety of information, which is not limited herein. For example, the first access request may include request urgency, token creation command, and terminal identity information.

[0047] S102, in response to identity authentication being successful, generates a first primary token and a first secondary token, wherein the first primary token is used to provide the target terminal with permission to access applications in the first system, and the first secondary token is used to provide terminals in the block with permission to access applications in systems other than the first system, or to provide other terminals in the block other than the target terminal with permission to access applications in the first system.

[0048] It should be noted that the first access request may store the identity information of the target terminal, and the identity information may also be sent directly by the target terminal to the first system for verification. The first system may store the identity information of the terminal with access rights. When the identity information of the target terminal matches the identity information of the terminal with access rights stored in the first system, it can be considered that the identity authentication is passed. The identity information may include multiple types, which are not limited here. For example, it may be account information, ID card information, mobile phone number, etc.

[0049] It should be noted that the first master token provides the target terminal with access to the first system application, and the first master token cannot be transferred and can only be used by the target terminal. In this way, it can be ensured that even if the first master token is illegally obtained, the acquirer cannot use the first master token to access the system.

[0050] The first sub-token can provide the target terminal with permission to access the first system application, and can also provide other terminals in the block with permission to access the first system application.

[0051] It should be noted that the first primary token and the first secondary token are temporary tokens, which include data such as the time when the token takes effect and the time when the token is extended.

[0052] In the embodiment of the present invention, the first primary token and the first secondary token are one, which can reduce the probability of an attacker obtaining the first secondary token, thereby further improving the security of the system.

[0053] In an embodiment of the present invention, in response to identifying a first access request from a target terminal in a block to access an application in a first system, the target terminal is authenticated, wherein the block includes at least one terminal, and then in response to the identity authentication being successful, a first primary token and a first secondary token are generated, wherein the first primary token is used to provide the target terminal with permission to access applications in the first system, and the first secondary token is used to provide the terminal in the block with permission to access applications in systems other than the first system, or to provide other terminals in the block other than the target terminal with permission to access applications in the first system. In the case of identifying that there is a terminal in the block accessing an application in the first system, a first primary token and a first secondary token are generated at the same time, so that the terminal in the block can access applications in the first system through the first primary token and the first secondary token, and can access applications in other systems across zones through the first secondary token without the need for repeated logins, thereby improving the user's experience in accessing system applications.

[0054] In the embodiment of the present invention, after the first secondary token is produced, the validity period and effective period of the first secondary token may be broadcasted in the system.

[0055] In the above embodiment, the terminal in the block accesses the applications of other systems except the first system through the first secondary token, and can also access the applications of other systems through the first secondary token. Figure 2 Explaining further, the method includes:

[0056] S201 , for any access terminal in a block, in response to identifying a second access request from the access terminal to access an application in a second system, obtaining a load level of the access terminal.

[0057] In the embodiment of the present invention, the second system is a system different from the first system, and does not refer to a particular system.

[0058] It should be noted that the access terminal in the present invention is any terminal in the block, and the access terminal may also be the target terminal in the previous embodiment.

[0059] In an embodiment of the present invention, the load quantity of the access terminal can be first obtained, and in response to the load quantity being less than a determination threshold, the load level is determined to be a first load level, and in response to the load quantity being greater than or equal to the determination threshold, the load level is determined to be a second load level.

[0060] It should be noted that the determination threshold is a critical value for determining whether the access terminal is currently at the first load level or the second load level. The determination threshold is set in advance and can be changed according to actual design requirements, and is not limited here.

[0061] It should be noted that the access terminal of the first load level has better performance and stronger data processing capability and speed than the access terminal of the second load level.

[0062] S202, in response to the load level being the first load level, sending a secondary token inventory data request to the second system, and applying to the second system to replace the first secondary token based on the request result of the secondary token inventory data request and the first secondary token to obtain a second secondary token.

[0063] It should be noted that when the terminal is at the first load level, it can be considered that the data processing capability of the terminal is not strong, the terminal does not need to receive the broadcast, and does not need to do too much calculation, and can delegate the task to the central node for processing.

[0064] In the embodiment of the present invention, if the third sub-token in the second system is being used, the access terminal cannot access the application in the second system through the sub-token. Therefore, based on the request result of the sub-token inventory data request and the first sub-token, the second system is requested to replace the first sub-token to obtain the second sub-token. First, in response to the request result that the third sub-token in the second system is not used, identity authentication is performed in the second system based on the first main token, and then in response to the identity authentication being passed, an application is made to the second system to replace the first sub-token to obtain the second sub-token.

[0065] In response to the request result that the third secondary token in the second system is being used, the second access request of the access terminal to access the application in the second system is not responded to. In this way, it can be ensured that there are only one valid primary token and one secondary token in a block.

[0066] S203, in response to the load level being the second load level, sending an identity authentication request to the second system through the access terminal, and in response to the access terminal receiving the broadcast information of successful identity authentication request, applying to the second system for replacement of the first sub-token based on the broadcast information and the first sub-token to obtain the second sub-token.

[0067] It should be noted that when the terminal is at the second load level, it can be considered that the data processing capability of the terminal is relatively strong.

[0068] The access terminal sends an identity authentication request to the second system. If the authentication is successful, the second system will broadcast the successful authentication result to the access terminal. The access terminal will send the successful authentication result and the first sub-token to the second system to replace the first sub-token with the second sub-token.

[0069] S204: The access terminal accesses an application in the second system through the second secondary token.

[0070] In an embodiment of the present invention, first, in response to identifying a second access request for accessing an application in a second system by an access terminal, the load level of the access terminal is obtained, and in response to the load level being the first load level, a request for sub-token inventory data is sent to the second system, and based on the request result of the sub-token inventory data request and the first sub-token, an application is made to the second system to replace the first sub-token to obtain the second sub-token, or in response to the load level being the second load level, an identity authentication request is sent to the second system through the access terminal, and in response to the access terminal receiving a broadcast message indicating a successful identity authentication request, an application is made to the second system to replace the first sub-token based on the broadcast message and the first sub-token to obtain the second sub-token, and finally the access terminal accesses the application in the second system through the second sub-token. Therefore, by analyzing the terminal data processing capability and adopting different sub-token replacement methods, the processing efficiency can be improved, while the user experience can be improved.

[0071] It should be noted that since the first sub-token may be occupied, in this case, it is possible to first determine whether the current access terminal is the target terminal. When the access terminal is the target terminal, the first system is notified to issue a broadcast to reclaim the first sub-token within a preset time. If the first sub-token is not recovered within the preset time, the broadcast of the first sub-token is invalid.

[0072] When the access terminal is not the target terminal, it is necessary to wait until the first token is idle before acquiring it to access the second system.

[0073] It should be noted that, when applying to the second system to replace the first token to obtain the second token, the access scope information, central node authorization information, and allowed user identity ID in the first token can be modified to data adapted to the second system, and the effective start time and effective duration in the first token can be modified according to the time modification rule to generate the second token. In this way, the access terminal can access the application in the second system through the second token.

[0074] In the above embodiment, the effective start time and effective duration of the first token are modified according to the time modification rule, and the effective start time and effective duration of the first token are modified according to the time modification rule. Figure 3 Explaining further, the method includes:

[0075] S301, obtaining a first request urgency and a first application quantity of a first system, and obtaining a second request urgency and a second application quantity of a second system.

[0076] It should be noted that the first request urgency and the first application quantity of the first system and the second request urgency and the second application quantity of the second system are set in advance and can be changed according to actual design requirements, and are not limited here.

[0077] S302: modify the valid start time and valid duration in the first secondary token according to a time modification rule based on the first request urgency, the first application quantity, the second request urgency, and the second application quantity.

[0078] In an embodiment of the present invention, the modification rule is to use the start time corresponding to the system with higher urgency between the first request urgency and the second request urgency as the modified valid start time of the first sub-token, and to use the valid duration corresponding to the system with more applications between the first application number and the second application number as the modified valid duration of the first sub-token.

[0079] For example, when modifying the effective start time and effective duration, when the effective start time of the first token in the first system is 14:00 and the effective duration is 10 minutes, after the first token is transferred to the central node of the second system for modification, the effective start time of the second token is modified to 13:00 and the effective duration is 15 minutes. At this time, the request urgency of the access terminal in the first system is higher than the request access urgency of the second system, so the effective start time is determined to be 14:00. As for the effective duration, there are more applications in the second system than in the first system. Therefore, the effective duration after modification by the second central node is 15 minutes. Therefore, the final modified effective start time and effective duration of the second token are 14:00 and 15 minutes respectively.

[0080] In the above embodiment, the first primary token and the first secondary token are generated by Figure 4 Explaining further, the method includes:

[0081] S401, obtaining first access range information, first central node authorization information, first allowed user identity ID, first start time, first effective duration, second access range information, second central node authorization information, second allowed user identity ID, second start time and second effective duration.

[0082] In an embodiment of the present invention, the first access range information, the first central node authorization information, the first allowed user identity ID, the first starting time, the first effective duration, the second access range information, the second central node authorization information, the second allowed user identity ID, the second starting time and the second effective duration are set in advance and can be changed according to actual design needs, without any limitation here.

[0083] S402, establish a first primary token based on the first access range information, the first central node authorization information, the first allowed user identity ID, the first start time and the first valid period, and establish a first secondary token based on the second access range information, the second central node authorization information, the second allowed user identity ID, the second start time and the second valid period.

[0084] It should be noted that when other terminals in the block access any application in the first system through the first sub-token, it is also necessary to determine whether the application has been accessed by the target terminal using the first primary token. In response to the application being accessed by the target terminal using the first primary token, it is determined that the application is eligible to be accessed by other terminals in the block through the first sub-token shared by the target terminal.

[0085] Corresponding to the single sign-on methods provided in the above-mentioned embodiments, an embodiment of the present invention further provides a single sign-on system. Since the single sign-on system provided in the embodiment of the present invention corresponds to the single sign-on methods provided in the above-mentioned embodiments, the implementation methods of the above-mentioned single sign-on methods are also applicable to the single sign-on system provided in the embodiment of the present invention and will not be described in detail in the following embodiments.

[0086] Figure 5 is a schematic diagram of a single sign-on system according to an embodiment of the present invention. Figure 5 As shown, the single sign-on system 500 includes: a verification module 510 and a generation module 520.

[0087] wherein the verification module 510 is used to authenticate the target terminal in response to identifying a first access request from the target terminal in the block to access an application in the first system, wherein the block is also used for at least one terminal;

[0088] The generation module 520 is used to generate a first primary token and a first secondary token in response to successful identity authentication, wherein the first primary token is used to provide the target terminal with permission to access applications in the first system, and the first secondary token is used to provide the terminals in the block with permission to access applications in systems other than the first system, or to provide other terminals in the block other than the target terminal with permission to access applications in the first system.

[0089] In one embodiment of the present invention, the generation module 520 is also used to: for any access terminal in the block, in response to identifying a second access request for the access terminal to access an application in the second system, obtain the load level of the access terminal; in response to the load level being the first load level, send a sub-token inventory data request to the second system, and apply to the second system for replacement of the first sub-token based on the request result of the sub-token inventory data request and the first sub-token to obtain the second sub-token; or, in response to the load level being the second load level, send an identity authentication request to the second system through the access terminal, and in response to the access terminal receiving a broadcast message of a successful identity authentication request, apply to the second system for replacement of the first sub-token based on the broadcast message and the first sub-token to obtain the second sub-token; the access terminal accesses the application in the second system through the second sub-token.

[0090] In one embodiment of the present invention, the generation module 520 is also used to: in response to the request result that the third sub-token in the second system is not used, perform identity authentication in the second system based on the first primary token; in response to the identity authentication being successful, apply to the second system to replace the first sub-token to obtain the second sub-token.

[0091] In one embodiment of the present invention, the generating module 520 is further configured to: in response to the request result being that the third secondary token in the second system is being used, not respond to the second access request from the access terminal to access the application in the second system.

[0092] In one embodiment of the present invention, the generating module 520 is further configured to: in response to the load level being the first load level, the access terminal does not receive the broadcast.

[0093] In one embodiment of the present invention, the generation module 520 is also used to: obtain the load quantity of the access terminal; in response to the load quantity being less than a determination threshold, determine the load level to be a first load level; or, in response to the load quantity being greater than or equal to the determination threshold, determine the load level to be a second load level.

[0094] In one embodiment of the present invention, the generation module 520 is also used to: modify the access scope information, central node authorization information, and allowed user identity ID in the first sub-token to data adapted to the second system, and at the same time modify the effective start time and effective duration in the first sub-token according to the time modification rules to generate a second sub-token.

[0095] In one embodiment of the present invention, the generation module 520 is also used to: obtain a first request urgency and a first application quantity of the first system, and obtain a second request urgency and a second application quantity of the second system; modify the effective start time and effective duration in the first sub-token according to a time modification rule based on the first request urgency, the first application quantity, the second request urgency and the second application quantity.

[0096] In one embodiment of the present invention, the modification rules include: using the start time corresponding to the system with higher urgency between the first request urgency and the second request urgency as the modified valid start time of the first sub-token; and using the valid duration corresponding to the system with more applications between the first application quantity and the second application quantity as the modified valid duration of the first sub-token.

[0097] In one embodiment of the present invention, the generation module 520 is also used to: obtain first access range information, first central node authorization information, first allowed user identity ID, first starting time, first valid duration, second access range information, second central node authorization information, second allowed user identity ID, second starting time and second valid duration; establish a first primary token based on the first access range information, first central node authorization information, first allowed user identity ID, first starting time and first valid duration, and establish a first secondary token based on the second access range information, second central node authorization information, second allowed user identity ID, second starting time and second valid duration.

[0098] In one embodiment of the present invention, the generation module 520 is also used to: for any application in the first system, determine whether the application has been accessed by the target terminal using the first primary token; in response to the application being accessed by the target terminal using the first primary token, determine whether the application is eligible to be accessed by other terminals in the block through the first secondary token shared by the target terminal.

[0099] When it is identified that there is a terminal in the block accessing an application in the first system, a first primary token and a first secondary token are generated at the same time. The terminal in the block can access the application in the first system through the first primary token and the first secondary token, and access the application in other systems across zones through the first secondary token without the need for repeated login, thereby improving the user experience of accessing system applications.

[0100] In order to implement the above embodiment, the embodiment of the present invention further provides an electronic device 600, Figure 6 is a schematic diagram of an electronic device according to an embodiment of the present invention, such as Figure 6 As shown, the electronic device 600 includes: a processor 601 and a memory 602 that is communicatively connected to the processor, the memory 602 stores instructions that can be executed by at least one processor, and the instructions are executed by at least one processor 601 to implement the present invention. Figure 1-Figure 4 A single sign-on method according to an embodiment.

[0101] In order to implement the above embodiment, the embodiment of the present invention further provides a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to enable the computer to implement the present invention. Figure 1-Figure 4 A single sign-on method according to an embodiment.

[0102] In order to implement the above embodiments, the present invention also provides a computer program product, including a computer program, which implements the present invention when executed by a processor. Figure 1-Figure 4 A single sign-on method according to an embodiment.

[0103] It should be noted that personal information from users should be collected for legitimate and reasonable purposes and should not be shared or sold outside of these legitimate uses. In addition, such collection / sharing should be carried out after receiving the user's informed consent, including but not limited to notifying the user to read the user agreement / user notice and sign the agreement / authorization including authorization of relevant user information before the user uses the function. In addition, any necessary steps should be taken to protect and safeguard access to such personal information data and ensure that others who have access to personal information data comply with its privacy policy and procedures.

[0104] The present application is expected to provide an implementation scheme for users to selectively block the use or access of personal information data. That is, the present invention is expected to provide hardware and / or software to prevent or block access to such personal information data. Once the personal information data is no longer needed, the risk can be minimized by limiting data collection and deleting the data. In addition, when applicable, such personal information is de-identified to protect the privacy of the user.

[0105] In the description of the aforementioned embodiments, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0106] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of this application, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0107] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, fragment or portion of code comprising one or more executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present application belong.

[0108] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by or in conjunction with an instruction execution system, system or device (such as a computer-based system, a system including a processor, or other system that can fetch instructions from and execute instructions to an instruction execution system, system or device). For the purposes of this specification, a "computer-readable medium" can be any system that can contain, store, communicate, propagate or transport a program for use by or in conjunction with an instruction execution system, system or device. More specific examples (a non-exhaustive list) of computer-readable media include the following: an electrical connection with one or more wires (electronic systems), a portable computer disk case (magnetic systems), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic system, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or processing in other suitable ways if necessary, and then stored in a computer memory.

[0109] It should be understood that the various parts of the present application can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0110] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0111] In addition, each functional unit in each embodiment of the present application may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0112] The storage medium mentioned above may be a read-only memory, a magnetic disk or an optical disk, etc. Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limiting the present application. A person of ordinary skill in the art may change, modify, replace and modify the above embodiments within the scope of the present application.

Claims

1. A single sign-on method, characterized in that: include: In response to identifying a first access request from a target terminal in a block to access an application in a first system, authenticating the target terminal, wherein the block includes at least one terminal; In response to the identity authentication being passed, a first primary token and a first secondary token are generated, wherein the first primary token is used to provide the target terminal with permission to access applications in the first system, and the first secondary token is used to provide terminals in the block with permission to access applications in systems other than the first system, or to provide other terminals in the block with permission to access applications in the first system except the target terminal; The terminal in the block accesses applications of other systems except the first system through the first secondary token, including: For any access terminal in the block, in response to identifying a second access request of the access terminal to access an application in the second system, obtaining a load level of the access terminal; In response to the load level being the first load level, sending a secondary token inventory data request to the second system, and applying to the second system to replace the first secondary token based on the request result of the secondary token inventory data request and the first secondary token to obtain a second secondary token; or In response to the load level being a second load level, sending an identity authentication request to the second system through the access terminal, and in response to the access terminal receiving broadcast information indicating a success of the identity authentication request, applying to the second system for replacing the first secondary token based on the broadcast information and the first secondary token to obtain a second secondary token; The access terminal accesses the application in the second system through the second secondary token.

2. The method according to claim 1, characterized in that The applying to the second system for replacing the first secondary token based on the request result of the secondary token inventory data request and the first secondary token to obtain a second secondary token includes: In response to the request result being that the third secondary token in the second system is not used, performing identity authentication in the second system based on the first primary token; In response to the identity authentication being passed, an application is made to the second system to replace the first secondary token to obtain a second secondary token.

3. The method according to claim 2, characterized in that The method further comprises: In response to the request result being that the third sub-token in the second system is being used, the second access request for the access terminal to access an application in the second system is not responded to.

4. The method according to claim 1, characterized in that: The method further comprises: In response to the load level being the first load level, the access terminal does not receive the broadcast.

5. The method according to claim 1, characterized in that The obtaining of the access terminal load level includes: Obtaining the load quantity of the access terminal; In response to the load quantity being less than a determination threshold, determining the load level to be the first load level; or, In response to the load quantity being greater than or equal to the determination threshold, the load level is determined to be the second load level.

6. The method according to any one of claims 1 to 5, characterized in that The applying to the second system to replace the first secondary token to obtain the second secondary token includes: The access scope information, central node authorization information, and allowed user identity ID in the first sub-token are modified to data adapted to the second system, and at the same time, the effective start time and effective duration in the first sub-token are modified according to the time modification rules to generate the second sub-token.

7. The method according to claim 6, characterized in that The step of modifying the valid start time and valid duration of the first secondary token according to the time modification rule includes: Acquire a first request urgency and a first application quantity of the first system, and acquire a second request urgency and a second application quantity of the second system; The valid start time and valid duration in the first secondary token are modified according to the time modification rule based on the first request urgency, the first application quantity, the second request urgency and the second application quantity.

8. The method according to claim 7, characterized in that The modification rules include: Using the start time corresponding to the system with higher urgency between the first request urgency and the second request urgency as the modified valid start time of the first secondary token; and The validity period corresponding to the system with the larger number of applications between the first number of applications and the second number of applications is used as the modified validity period of the first secondary token.

9. The method according to claim 1, characterized in that: The generating of the first primary token and the first secondary token comprises: Obtaining first access range information, first central node authorization information, first allowed user identity ID, first start time, first effective duration, second access range information, second central node authorization information, second allowed user identity ID, second start time and second effective duration; The first primary token is established based on the first access range information, the first central node authorization information, the first allowed user identity ID, the first start time and the first valid period, and the first secondary token is established based on the second access range information, the second central node authorization information, the second allowed user identity ID, the second start time and the second valid period.

10. The method according to claim 1 or 9, characterized in that The method further comprises: For any application in the first system, determining whether the application has been accessed by the target terminal using the first primary token; In response to the application being accessed by the target terminal using the first primary token, it is determined that the application is accessible by other terminals in the block through the first secondary token shared by the target terminal.

11. A single sign-on system, characterized in that: include: a verification module, configured to authenticate the target terminal in response to identifying a first access request for accessing an application in the first system from a target terminal in the block, wherein the block is also used for at least one terminal; A generating module, configured to generate a first primary token and a first secondary token in response to the identity authentication being passed, wherein the first primary token is used to provide the target terminal with permission to access applications in the first system, and the first secondary token is used to provide terminals in the block with permission to access applications in systems other than the first system, or to provide other terminals in the block with permission to access applications in the first system except the target terminal; The generation module is also used for: For any access terminal in the block, in response to identifying a second access request of the access terminal to access an application in the second system, obtaining a load level of the access terminal; In response to the load level being the first load level, sending a secondary token inventory data request to the second system, and applying to the second system to replace the first secondary token based on the request result of the secondary token inventory data request and the first secondary token to obtain a second secondary token; or In response to the load level being a second load level, sending an identity authentication request to the second system through the access terminal, and in response to the access terminal receiving broadcast information indicating a success of the identity authentication request, applying to the second system for replacing the first secondary token based on the broadcast information and the first secondary token to obtain a second secondary token; The access terminal accesses the application in the second system through the second secondary token.

12. The system according to claim 11, characterized in that The generating module is further used for: In response to the request result being that the third secondary token in the second system is not used, performing identity authentication in the second system based on the first primary token; In response to the identity authentication being passed, an application is made to the second system to replace the first secondary token to obtain a second secondary token.

13. The system according to claim 12, characterized in that The generating module is further used for: In response to the request result being that the third sub-token in the second system is being used, the second access request for the access terminal to access an application in the second system is not responded to.

14. The system according to claim 11, characterized in that The generating module is further used for: In response to the load level being the first load level, the access terminal does not receive the broadcast.

15. The system according to claim 11, characterized in that The generating module is further used for: Obtaining the load quantity of the access terminal; In response to the load quantity being less than a determination threshold, determining the load level to be the first load level; or, In response to the load quantity being greater than or equal to the determination threshold, the load level is determined to be the second load level.

16. The system according to any one of claims 11 to 15, characterized in that: The generating module is further used for: The access scope information, central node authorization information, and allowed user identity ID in the first sub-token are modified to data adapted to the second system, and at the same time, the effective start time and effective duration in the first sub-token are modified according to the time modification rules to generate the second sub-token.

17. The system according to claim 16, characterized in that The generating module is further used for: Acquire a first request urgency and a first application quantity of the first system, and acquire a second request urgency and a second application quantity of the second system; The valid start time and valid duration in the first secondary token are modified according to the time modification rule based on the first request urgency, the first application quantity, the second request urgency and the second application quantity.

18. The system according to claim 17, characterized in that The modification rules include: Using the start time corresponding to the system with higher urgency between the first request urgency and the second request urgency as the modified valid start time of the first secondary token; and The validity period corresponding to the system with the larger number of applications between the first number of applications and the second number of applications is used as the modified validity period of the first secondary token.

19. The system according to claim 11, characterized in that The generating module is further used for: Obtaining first access range information, first central node authorization information, first allowed user identity ID, first start time, first effective duration, second access range information, second central node authorization information, second allowed user identity ID, second start time and second effective duration; The first primary token is established based on the first access range information, the first central node authorization information, the first allowed user identity ID, the first start time and the first valid period, and the first secondary token is established based on the second access range information, the second central node authorization information, the second allowed user identity ID, the second start time and the second valid period.

20. The system according to claim 11 or 19, characterized in that The generating module is further used for: For any application in the first system, determining whether the application has been accessed by the target terminal using the first primary token; In response to the application being accessed by the target terminal using the first primary token, it is determined that the application is accessible by other terminals in the block through the first secondary token shared by the target terminal.

21. An electronic device, characterized in that: Including memory and processor; The processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to implement the method according to any one of claims 1 to 10.

22. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 10 when executed by a processor.

Images