A docking QR code login system and login method based on network isolation

Abstract

The present invention discloses a docking code-scanning login system and a login method based on network isolation. The system includes a client and a business system deployed in the intranet, a docking business system, a virtual client, and a unified code-scanning system deployed in the extranet. Data between the intranet and the extranet is transmitted through a deployed network gateway. The business system responds to the access of the client, issues an instruction through the network gateway to open the docking code-scanning service. The docking business system opens the virtual client, jumps to the address of the unified code-scanning authentication system, polls to intercept the scanned code picture and responds to the request of the intranet. After the user's intelligent device scans the two-dimensional code of the intranet client and confirms, the docking business system obtains the scanned code user information and responds it to the intranet business system. The intranet business system verifies the user and releases the login. The effect is that the deployment security of the business system is improved. The business system is deployed in an isolated intranet with better security, without being deployed in the extranet, and there is no need for the business system to communicate with the unified code-scanning system.

Description

Technical Field

[0001] The present invention relates to the technical field of network isolation security, and particularly relates to a docking code-scanning login system and a login method based on network isolation. Background Art

[0002] Currently, with the development of the network, in order to avoid the leakage of account passwords, more and more business systems are integrated and docked with a unified code-scanning authentication platform. The unified code-scanning authentication platform generally adopts the oauth (a security protocol on the Internet) authentication method and is generally deployed on the external network (such as code-scanning login of enterprise WeChat, etc.); in such cases, it is required that the unified code-scanning authentication platform, the visitor's client, and the business system can communicate with each other and access each other over the network, making the existing solutions unable to use the internal network business system for cross-network code-scanning login in the case of network isolation. Summary of the Invention

[0003] In order to overcome the deficiencies in the prior art, the purpose of the present invention is to provide a docking code-scanning login system and a login method based on network isolation.

[0004] In a first aspect, a technical solution provided by the present invention is: a docking code-scanning login system and a login method based on network isolation. The system includes a client and a business system deployed in the internal network, as well as a docking business system, a virtual client, and a unified code-scanning system deployed in the external network. Data between the internal and external networks is transmitted through a deployed network gateway.

[0005] The client is used to access the interface of the business system; wherein, the client logs in through the user's intelligent device.

[0006] The business system is used to respond to the access of the client and issue an instruction through the network gateway to open the docking code-scanning service.

[0007] The docking business system is used to open the virtual client according to the issued instruction, so that the virtual client accesses the docking business system, and the docking business system then redirects to the address of the unified code-scanning system and displays a code-scanning page on the virtual client.

[0008] Poll and intercept the QR code picture of the current code-scanning page through the docking business system.

[0009] The client obtains the QR code picture data from the external network docking business system through a request instruction issued by the business system, and then responds the obtained QR code picture data back to the client; so that the business system displays the polled QR code picture through the client.

[0010] After the smart device of the user scans the QR code picture displayed by the client and confirms it, the QR code authentication page of the virtual client is triggered to redirect to the docking business system and carry a temporary code; the business system calls the user information interface of the unified QR code system with the temporary code to obtain user information, and stores the user information waiting for a response to the business system; among them, the temporary code is generated by the unified QR code system and sent to the virtual client after confirmation.

[0011] The business system issues an instruction to the external network docking business system to obtain the stored user information, and allows the client to log in after verifying that the user information is legal.

[0012] Preferably, after the virtual client on the external network successfully accesses the QR code address, the docking business system polls and intercepts the QR code picture of the current page until the docking business system obtains the user information and then ends.

[0013] Preferably, the business system on the internal network generates a request instruction for polling based on the client to obtain the QR code picture data of the docking business system and displays it through the client on the internal network until the business system on the internal network obtains the user information and then ends.

[0014] Preferably, the operating system on the external network side uses a third-party driver and a browser matching the driver to dock the QR code scanning service, controls the access address of the browser through the driver, generates a picture of the specified QR code dom node of the browser, compares it with the previous picture, converts it to base64 data and caches it when the picture content changes, and returns the latest QR code picture data in the internal network.

[0015] Preferably, the operating system on the external network side uses a graphical operating system.

[0016] Preferably, on the external network side, a browser with an independent identity can be enabled through parameters to dock a QR code scanning login. When the concurrency is large, the concurrency can be increased by horizontally expanding the system or horizontally expanding the browser.

[0017] Preferably, multiple business systems in isolated networks can dock with an external network docking business system, and the external network docking business system is used to adapt to different QR code authentication platforms.

[0018] In a second aspect, another technical solution provided by the present invention is: a docking QR code scanning login method based on network isolation, which is applied to a docking QR code scanning login system based on network isolation described in the first aspect. The system includes a client and a business system deployed in the internal network, and a docking business system, a virtual client, and a unified QR code system deployed in the external network. Data between the internal and external networks is transmitted through a deployed network gateway; the method includes:

[0019] An interface for accessing a business system through a client; wherein, the client logs in through the user's intelligent device;

[0020] The business system responds to the access of the client and issues an instruction through the network gateway to open the docking code scanning service;

[0021] The docking business system opens a virtual client according to the issued instruction, enabling the virtual client to access the docking business system. The docking business system then redirects to the unified code scanning system address and displays a code scanning page on the virtual client;

[0022] The docking business system polls and intercepts the QR code picture of the current code scanning page;

[0023] The client sends a request instruction issued by the business system to the external network docking business system to obtain QR code picture data, and then responds the obtained QR code picture data back to the client;

[0024] After the user's intelligent device scans the QR code picture displayed on the client and confirms, it triggers the redirection of the code scanning authentication page of the virtual client to the docking business system and carries a temporary code; the business system calls the user information interface of the unified code scanning system with the temporary code to obtain user information, and stores the user information waiting to respond to the business system; wherein, the temporary code is generated by the unified code scanning system and sent to the virtual client after confirmation;

[0025] The business system issues an instruction to the external network docking business system to obtain the stored user information, and allows the client to log in after verifying that the user information is legal.

[0026] With the above technical solution, a docking code scanning login system and a login method based on network isolation proposed by the present invention perform code scanning login using the intranet business system under network isolation. The docking code scanning service is docked by the external network docking business system and the unified code scanning authentication system. The external network docking business system is used to open a virtual client, jump to the address of the unified code scanning authentication system, poll and intercept the code scanning picture, obtain the code scanning user information, etc. At the same time, the data transmission between business systems under network isolation is realized through a network gateway. The intranet business system polls to obtain and display the code scanning picture stored by the external network docking business system. After scanning the two-dimensional code of the intranet client and confirming, the external network docking business system obtains the code scanning user information and responds to the intranet business system. The intranet business system verifies the user and allows login. Thus, the deployment security of the business system is improved. The business system is deployed in an isolated intranet with better security, without being deployed in the external network, and there is no need for the business system to communicate with the unified code scanning system. All code scanning authentication entrances are unified. Business systems in multiple isolated networks can be docked to one external network docking business system, and the external network docking business system adapts to different code scanning authentication platforms. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 FIG. is a schematic block diagram of a docking code scanning login system based on network isolation provided by an embodiment of the present invention;

[0028] Figure 2 FIG. is an interaction schematic diagram of a docking code scanning provided by an embodiment of the present invention;

[0029] Figure 3 FIG. is a schematic diagram of the process of cross-network code scanning of a system provided by an embodiment of the present invention;

[0030] Figure 4 FIG. is a flowchart of a docking code scanning login method based on network isolation provided by an embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0031] The specific embodiments of the present invention will be described in detail below. It should be noted that the embodiments described here are only for illustrative purposes and are not intended to limit the present invention. In the following description, a large number of specific details are set forth in order to provide a thorough understanding of the present invention. However, it will be apparent to those of ordinary skill in the art that the present invention does not have to be practiced with these specific details.

[0032] It should be noted that the terms "first", "second", etc. in the description, claims and the above-mentioned drawings of this application are used to distinguish similar objects, and do not necessarily describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so as to implement the embodiments of the present application described herein. In addition, the terms "comprising" and "having" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device that includes a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but may include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0033] In this application, the orientation or positional relationship indicated by the terms "upper", "lower", "left", "right", "front", "rear", "top", "bottom", "inner", "outer", "middle", "vertical", "horizontal", "lateral", "longitudinal", etc. is based on the orientation or positional relationship shown in the drawings. These terms are mainly used to better describe this application and its embodiments, and are not used to limit that the indicated devices, elements or components must have a specific orientation, or be constructed and operated in a specific orientation.

[0034] Moreover, in addition to being able to represent the orientation or positional relationship, some of the above-mentioned terms may also be used to represent other meanings. For example, the term "upper" may also be used to represent a certain attachment relationship or connection relationship in some cases. For those of ordinary skill in the art, the specific meanings of these terms in this application can be understood according to specific circumstances.

[0035] Throughout the specification, the reference to "an embodiment", "embodiment", "an example" or "example" means that the specific features, structures or characteristics described in connection with that embodiment or example are included in at least one embodiment of the present invention. Therefore, the phrases "in an embodiment", "in the embodiment", "an example" or "example" that appear throughout the specification do not necessarily refer to the same embodiment or example. In addition, the specific features, structures or characteristics can be combined in any appropriate combination and / or sub-combination in one or more embodiments or examples.

[0036] It should be noted that, unless otherwise specified, the technical terms in this embodiment have the ordinary meanings understood by those skilled in the art.

[0037] As Figures 1 to 3 shown, a docking code scanning login system based on network isolation provided by an embodiment of the present invention includes a client and a business system deployed in the intranet, as well as a docking business system, a virtual client and a unified code scanning system deployed in the extranet. Data between the intranet and the extranet is transmitted through the deployed network gateway;

[0038] The client is used to access the interface of the business system; among them, the client logs in through the user's smart device;

[0039] The business system is used to respond to the access of the client and issue an instruction through the network gateway to open the docking code scanning service;

[0040] The docking business system is used to open a virtual client according to the issued instruction, so that the virtual client accesses the docking business system, and the docking business system redirects to the unified code scanning system address and displays the code scanning page on the virtual client;

[0041] Poll and intercept the QR code image of the current code scanning page through the docking business system;

[0042] The client sends a request instruction issued by the business system to the external network docking business system to obtain QR code image data, and then responds the obtained QR code image data back to the client; so that the business system displays the QR code image obtained by polling through the client;

[0043] It should be noted that the business system generates corresponding requests based on the polling of the client; the requests here include requesting QR code image data and user information of the external network from the docking business system through the business system;

[0044] After the user scans the QR code image displayed on the client with the smart device and confirms, it triggers the redirection of the code scanning authentication page of the virtual client to the docking business system and carries a temporary code; the business system calls the user information interface of the unified code scanning system with the temporary code to obtain user information, and stores the user information waiting to respond to the business system; among them, the temporary code is generated by the unified code scanning system and sent to the virtual client after confirmation;

[0045] The business system issues an instruction to the external network docking business system to obtain the stored user information, and after verifying that the user information is legal, allows the client to log in.

[0046] In this embodiment, the client uses a browser; the smart device uses a smart mobile device, such as a smart phone.

[0047] When applied, as Figure 2 shown, when the user scans the code to log in to the client through the mobile device and accesses the corresponding business application in the business system, the business system on the internal network side issues an instruction to the docking business system on the external network side to open the docking code scanning;

[0048] The external network's docking business system opens the virtual client, causing the virtual client to first open the address of the docking business system, and then the docking business system redirects to the address of the unified code scanning system; the external network's docking business system intercepts and stores the virtual client's picture; the internal network's business system generates a request instruction for distribution based on the polling of the client to obtain the two-dimensional code picture data of the docking business system and displays it through the internal network's client; after the user scans the code and confirms, the external network's docking business system docks with the unified code scanning authentication system to obtain user information. After the internal network's business system obtains the user information data and verifies that the user information is legal, it allows the user to log in and the process ends; it should be noted that the more specific process of the system is as Figure 3 shown and will not be elaborated here.

[0049] In this embodiment, after the virtual client on the external network successfully accesses the code scanning address, the docking business system polls and intercepts the two-dimensional code picture of the current page until the docking business system obtains the user information and then ends. It should be noted that the purpose of polling and intercepting is to monitor the change of the unified code scanning information in real time. For example, at the beginning, it is a picture waiting to be scanned. When the mobile device scans the code, the picture shows that it has been scanned and waiting for confirmation. After the mobile device confirms and allows, etc., the code scanning process ends.

[0050] Furthermore, the operating system on the external network side uses a third-party driver and a browser matching the driver to dock with the code scanning service. The access address of the browser is controlled by the driver, and a picture is generated for the dom node of the specified two-dimensional code in the browser and compared with the previous picture. When the picture content changes, it is converted into base64 data and cached, and the latest two-dimensional code picture data is returned in the internal network; among them, the operating system on the external network side uses a graphical operating system. It should be noted that the third-party driver and the browser matching the driver need to be deployed in the operating system. Since it involves rendering and displaying pictures, a graphical operating system needs to be used.

[0051] Correspondingly, the internal network's business system generates a request instruction for distribution based on the polling of the client to obtain the two-dimensional code picture data of the docking business system and displays it through the internal network's client until the internal network's business system obtains the user information and then ends.

[0052] Furthermore, the external network side can open a browser with an independent identity through parameters to dock a code scanning login. When the concurrency is large, the concurrency can be increased by horizontally expanding the system or horizontally expanding the browser.

[0053] During implementation, since horizontally scaling the external network operating system is relatively performance-consuming; in this embodiment, the energy consumption problem can also be avoided by horizontally expanding the browser; the browser is used to access various URLs and display pages, and the browser itself has a cookie function. The cookies of the same browser for the same scope (domain name + port or IP + port) are the same. If multiple people open the scan code docking at the same time, identity confusion will occur in the same type of browser; by providing that different identities of the browser can be opened through the parameter --user-data-dir. For example, for Google Chrome: opening Google Chrome through the command C:\Chrome\Chrome.exe --user-data-dir="C:\chrome_new" can set all the configuration data and cookies of the currently opened Google Chrome to be stored in C:\chrome_new; then through the command C:\Chrome\Chrome.exe --user-data-dir="C:\chrome_new2", a new Google Chrome is opened and all the configuration data and cookies are stored in C:\chrome_new2; in this way, the identities of the two Google Chrome browsers will be independent, achieving the effect of horizontal scaling.

[0054] In this embodiment, multiple business systems in isolated networks can be docked to a docking business system on the external network, and the docking business system on the external network is used to adapt to different scan code authentication platforms.

[0055] In the above solution, the internal network business system is used for scan code login under network isolation, and the docking of the scan code service is carried out by the docking business system on the external network with the unified scan code authentication system. The docking business system on the external network is used to open the virtual client, jump to the address of the unified scan code authentication system, poll and intercept the scan code picture, obtain the scan code user information, etc.; at the same time, the data transmission between business systems under network isolation is realized through the network gateway, and the internal network business system polls to obtain and display the scan code pictures stored by the external network docking business system; after scanning and confirming the two-dimensional code of the internal network client, the docking business system on the external network obtains the scan code user information and responds to the internal network business system, and the internal network business system verifies the user and releases the login; thus improving the deployment security of the business system. The business system is deployed in an isolated internal network with better security and does not need to be deployed on the external network without the business system communicating with the unified scan code system; all scan code authentication entrances are unified, and multiple business systems in isolated networks can be docked to an external network docking business system, and the external network docking business system is used to adapt to different scan code authentication platforms.

[0056] Based on the same inventive concept, refer to Figure 4As shown in the figure, an embodiment of the present invention further provides a docking and scanning code login method based on network isolation, which is applied to a docking and scanning code login system based on network isolation described in the first aspect. The system includes a client and a business system deployed in the intranet, as well as a docking business system, a virtual client, and a unified scanning code system deployed in the extranet. Data between the intranet and the extranet is transmitted through a deployed network gateway. The method includes:

[0057] S100, accessing the interface of the business system through the client; wherein, the client logs in through the user's intelligent device;

[0058] S101, the business system responds to the access of the client and issues an instruction through the network gateway to open the docking and scanning code service;

[0059] S102, the docking business system opens the virtual client according to the issued instruction, so that the virtual client accesses the docking business system, and the docking business system then redirects to the unified scanning code system address and displays the scanning code page on the virtual client;

[0060] S103, polling and intercepting the two-dimensional code picture of the current scanning code page through the docking business system;

[0061] S104, the client issues a request instruction through the business system to the external network docking business system to obtain the two-dimensional code picture data, and then responds the obtained two-dimensional code picture data back to the client;

[0062] S105, after the user's intelligent device scans the two-dimensional code picture displayed on the client and confirms, triggering the scanning code authentication page of the virtual client to redirect to the docking business system and carry a temporary code; the business system calls the user information interface of the unified scanning code system with the temporary code to obtain user information, and stores the user information waiting to respond to the business system; wherein, the temporary code is generated by the unified scanning code system and sent to the virtual client after confirmation;

[0063] S106, the business system issues an instruction to the external network docking business system to obtain the stored user information, and after verifying that the user information is legal, allows the client to log in.

[0064] During implementation, after the virtual client in the external network successfully accesses the scanning code address, the docking business system polls and intercepts the two-dimensional code picture of the current page until the docking business system obtains the user information and then ends;

[0065] The business system in the internal network generates a request instruction based on the polling of the client to obtain the two-dimensional code picture data of the docking business system and displays it through the client in the internal network until the business system in the internal network obtains the user information and then ends.

[0066] Furthermore, the method further includes:

[0067] On the external network side, a browser with an independent identity can be enabled through parameters to dock with a scan code login. When encountering a large concurrency volume, the concurrency volume can be increased by horizontally expanding the system or horizontally expanding the browser.

[0068] The above solution improves the deployment security of the service system. The service system is deployed in a more secure isolated internal network and does not need to be deployed on the external network, nor does the service system need to communicate with the unified scan code system; all scan code authentication entrances are unified, and service systems in multiple isolated networks can dock with an external network docking service system, and the external network docking service system is used to adapt to different scan code authentication platforms.

[0069] In several embodiments provided in the present application, it should be understood that a docking scan code login system and login method based on network isolation disclosed can be implemented in other ways. In addition, the displayed or discussed coupling or direct coupling or communication connection to each other can be an indirect coupling or communication connection through some interfaces, devices or units, or can also be an electrical, mechanical or other form of connection.

[0070] The above is only the specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art within the technical scope disclosed by the present invention can easily think of various equivalent modifications or replacements, and these modifications or replacements should all be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be subject to the protection scope of the claims.

Claims

1. A docking scan code login system based on network isolation, characterized in that The system includes a client and a business system deployed in the intranet, as well as a docking business system, a virtual client, and a unified QR code scanning system deployed in the extranet. Data between the intranet and the extranet is transmitted through the deployed network gateway. The client is used to access the interface of the business system. Among them, the client logs in through the user's intelligent device. The business system is used to respond to the access of the client and issue an instruction through the network gateway to open the docking QR code scanning service. The docking business system is used to open the virtual client according to the issued instruction, so that the virtual client accesses the docking business system, and the docking business system redirects to the unified QR code scanning system address and displays the QR code scanning page on the virtual client. Poll and intercept the QR code picture of the current QR code scanning page through the docking business system. The client sends a request instruction issued by the business system to the external network docking business system to obtain the QR code picture data, and then responds the obtained QR code picture data back to the client; so that the business system displays the QR code picture obtained by polling through the client. After the user's intelligent device scans the QR code picture displayed on the client and confirms, it triggers the redirection of the QR code scanning authentication page of the virtual client to the docking business system and carries a temporary code; the business system calls the user information interface of the unified QR code scanning system with the temporary code to obtain the user information, and stores the user information waiting to respond to the business system; among them, the temporary code is generated by the unified QR code scanning system and sent to the virtual client after confirmation. The business system issues an instruction to the external network docking business system to obtain the stored user information, and allows the client to log in after verifying that the user information is legal.

2. The docking code-scanning login system based on network isolation according to claim 1, characterized in that, After the virtual client on the external network successfully accesses the unified QR code scanning system address, the docking business system polls and intercepts the QR code picture of the current page until the docking business system obtains the user information and then ends.

3. The docking code scanning login system based on network isolation according to claim 2, wherein, The business system in the intranet generates and issues a request instruction based on the polling of the client to obtain the QR code picture data of the docking business system and displays it through the client in the intranet until the business system in the intranet obtains the user information and then ends.

4. A docking scan code login system based on network isolation according to any one of claims 1 to 3, characterized in that, The operating system on the external network side uses a third-party driver and a browser matching the driver to dock the QR code scanning service, controls the access address of the browser through the driver, generates a picture of the specified QR code dom node for the browser, and compares it with the previous picture. When the picture content changes, it is converted into base64 data and cached, and the latest QR code picture data is returned in the intranet.

5. The docking code scanning login system based on network isolation according to claim 4, characterized in that, The operating system on the external network side uses a graphical operating system.

6. The docking code scanning login system based on network isolation according to claim 4, characterized in that, On the external network side, a browser with an independent identity can be enabled through parameters to dock a QR code scanning login. When the concurrency is large, the concurrency can be increased by horizontally expanding the system or horizontally expanding the browser.

7. The docking code scanning login system based on network isolation according to claim 1, characterized in that, Business systems in multiple isolated networks can dock with a docking business system on the external network, and the docking business system on the external network is used to adapt to different QR code scanning authentication platforms.

8. A docking code scanning and login method based on network isolation, characterized in that, Applied to a docking code scanning login system based on network isolation as described in claim 1, the system includes a client and a business system deployed in the intranet, as well as a docking business system, a virtual client, and a unified code scanning system deployed in the extranet. Data between the intranet and the extranet is transmitted through a deployed network gateway; the method includes: Access the interface of the business system through the client; wherein, the client logs in through the user's intelligent device; The business system responds to the access of the client and issues an instruction through the network gateway to open the docking code scanning service; According to the issued instruction, the docking business system opens the virtual client, enabling the virtual client to access the docking business system. The docking business system then redirects to the address of the unified code scanning system and displays a code scanning page on the virtual client; Poll and intercept the QR code image of the current code scanning page through the docking business system; The client issues a request instruction through the business system to the docking business system in the extranet to obtain the QR code image data, and then responds the obtained QR code image data back to the client; After the user scans the QR code image displayed on the client with the intelligent device and confirms, it triggers the redirection of the code scanning authentication page of the virtual client to the docking business system and carries a temporary code; the business system calls the user information interface of the unified code scanning system with the temporary code to obtain user information, and stores the user information waiting to respond to the business system; wherein, the temporary code is generated by the unified code scanning system and sent to the virtual client after confirmation; The business system issues an instruction to the docking business system in the extranet to obtain the stored user information, and allows the client to log in after verifying that the user information is legal.

9. A method for docking and scanning code login based on network isolation according to claim 8, characterized in that, After the virtual client in the extranet successfully accesses the address of the unified code scanning system, the docking business system polls and intercepts the QR code image of the current page until the docking business system obtains the user information and then ends.

10. A method for docking and scanning code login based on network isolation according to claim 8, characterized in that, The method further includes: On the extranet side, a browser with an independent identity can be enabled through parameters to dock a code scanning login. When the concurrency is large, the concurrency can be increased by horizontally expanding the system or horizontally expanding the browser.

Images