A secure single sign-on method based on digital certificates to achieve zero interface

Abstract

The invention discloses a method for realizing zero-interface secure single-point sign-on based on digital certificates, comprising: a user accesses a page of an application system through a browser; the application system detects whether there is user information in a session; the user browser is redirected to the address indicated by a login link; the system is uniformly logged in and the parameters of the login link are verified to be legal; if there is no user information in the session, the login page is returned to the user browser; the user browser is redirected to the address indicated by a login success link; the application system uses the application system private key to decrypt and verify the parameters in the login link to obtain login user information; the application system uses the uniform login system public key to verify whether the login request in the login link is valid; the page address that the user needs to access is returned to the user browser; the user browser is redirected to the page address that the user needs to access, and the single-point sign-on is completed. The invention improves the security of user identity authentication and data transmission.

Description

Technical Field

[0001] The present invention relates to the fields of information processing and network technology, and in particular to a digital certificate-based zero-interface secure single-sign-on method. Background Art

[0002] In recent years, with the continuous development of corporate business, the collaboration between systems has become increasingly important. The single sign-on method has promoted seamless integration and collaboration between systems by breaking down the identity barriers between systems. However, in the current complex IT environment, the interaction between multiple systems is becoming increasingly frequent, which poses many challenges and requirements for single sign-on, such as high security, flexible integration capabilities, high availability and reliability, and compliance requirements.

[0003] Existing single sign-on (SSO) methods usually rely on interface calls between system backends to achieve identity information sharing and verification. However, when each system backend is in its own intranet and does not have the conditions for network interoperability, the traditional single sign-on method based on interface calls will face great challenges.

[0004] CN107294916A discloses a single sign-on method, which receives the main account information for logging in through a first platform and submits it to an authentication center for verification, and generates a root ticket after the verification is passed; when receiving an instruction to open an integrated application that is integrated into the first platform and belongs to a second platform, the root ticket and the identification of the integrated application are submitted to the authentication center; it is determined whether the main account information is bound to a slave account for logging in to the integrated application; if it is determined to be bound, the slave account is obtained and the sub-ticket is returned to the first platform; the first platform uses the received sub-ticket for single sign-on to the integrated application; the authentication center verifies that the sub-ticket is passed, and returns the slave account to the integrated application, and the single sign-on is successful; the single sign-on implemented by this method is not restricted by the platform, which is convenient for unifying the login accounts of multiple platforms, but it is difficult to communicate directly between systems in a limited network environment.

[0005] CN102377788A discloses a single sign-on system and method, which builds a single sign-on system through reverse proxy technology, uses Cookie and token authentication technology to complete authentication operations when logging into each platform, and uses timestamps to complete encryption operations on related information. It is compatible with existing user systems, and the tokens and keys of each platform are independent. The cracking of a user or a key will not affect other users and platforms; however, the network environment is limited and direct communication between systems is difficult. Summary of the invention

[0006] The purpose of this section is to summarize some aspects of the embodiments of the present invention and briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this section and the abstract of the specification and the title of the invention of this application to avoid blurring the purpose of this section, the abstract of the specification and the title of the invention, and such simplifications or omissions cannot be used to limit the scope of the present invention.

[0007] In view of the above existing problems, the present invention is proposed.

[0008] Therefore, the technical problem solved by the present invention is: the application difficulty of the traditional single sign-on (SSO) method in scenarios such as limited network environment and difficulty in direct communication between systems.

[0009] To solve the above technical problems, the present invention provides the following technical solutions: a user accesses a page of an application system through a browser;

[0010] The application system detects whether there is user information in the session;

[0011] When the detection result is yes, it indicates that the user has logged into the system, and the page that the user needs to access is returned to the user's browser;

[0012] When the detection result is no, it means that the user has not logged into the system, a login request is generated, the address of the page that the user needs to access is cached, and a login link pointing to the unified login system is returned to the user's browser;

[0013] The user's browser is redirected to the address indicated by the login link;

[0014] Unify the login system and verify whether the parameters of the login link are legal;

[0015] If the verification result is no, a login error message is returned to the user's browser and the login is terminated;

[0016] If the verification result is yes, the unified login system checks whether there is user information in the session;

[0017] If there is no user information in the session, return the login page to the user's browser;

[0018] The user logs in on the login page;

[0019] After the user logs in successfully, the unified login system saves the user information to the session;

[0020] Return the successful login link of the application system to the user's browser;

[0021] The user's browser is redirected to the address indicated by the successful login link;

[0022] The application system uses the application system private key to decrypt and verify the parameters in the login link to obtain the login user information;

[0023] The application system uses the unified login system public key to verify whether the login request in the login link is valid;

[0024] If the verification result is no, a login error message is returned to the user's browser and the login is terminated;

[0025] If the verification result is yes, the application system saves the user information into the session;

[0026] Return the address of the page that the user needs to access to the user's browser;

[0027] The user's browser is redirected to the page address that the user needs to access, and single sign-on is completed.

[0028] As a preferred solution of the method for implementing zero-interface secure single sign-on based on digital certificates described in the present invention, the login request is a string consisting of a newly generated unique identification code UUID and the current time.

[0029] As a preferred solution for the method of implementing zero-interface secure single sign-on based on digital certificates described in the present invention, a method for caching the address of the page that the user needs to access is to use a newly generated UUID as a key and the address of the page that the user needs to access as a value and save it in the cache.

[0030] As a preferred solution of the method for implementing zero-interface secure single sign-on based on digital certificates described in the present invention, the login link includes a login request encrypted with a public key of a unified login system and a login request signed with a private key of an application system;

[0031] The login request encrypted by the public key is the request parameter, and the login request signed by the private key is the signed parameter.

[0032] As a preferred solution of the method for implementing zero-interface secure single sign-on based on digital certificates described in the present invention, the verification of whether the parameters of the login link are legal includes:

[0033] Use the private key of the unified login system to decrypt the login request, obtain the UUID and request time, and use the public key of the application system to verify whether the signed login request is authentic and valid.

[0034] As a preferred solution of the method for implementing zero-interface secure single sign-on based on digital certificates described in the present invention, the successful login link at least includes the login user information encrypted by the public key of the application system and the login user information signed by the private key of the unified login system;

[0035] The login user information encrypted by the public key of the application system is the info parameter, and the login user information signed by the private key is the signed parameter.

[0036] As a preferred solution for the zero-interface secure single sign-on method based on digital certificates described in the present invention, the login user information includes but is not limited to requesting UUID, mobile phone number, account number, name, and information that can be used to identify the user's unique identity.

[0037] Beneficial effects of the present invention:

[0038] 1. By using digital certificates as the medium for identity authentication and trust transmission, single sign-on across the intranet can be achieved without directly opening interfaces between systems. This breaks the reliance of traditional SSO methods on network intercommunication, making it easy to achieve single sign-on in complex network environments;

[0039] 2. Using digital certificates to verify user identities can ensure the authenticity and credibility of user identities. At the same time, digital certificates can also be used to encrypt sensitive information during transmission to prevent information from being intercepted or tampered with during transmission, thereby further improving the security of single sign-on;

[0040] 3. Identity authentication and trust transfer are achieved through digital certificates, eliminating the need for direct communication and interface calls between systems, simplifying the implementation process of single sign-on. At the same time, since the management and update of digital certificates are relatively independent of the business system, the maintenance cost of the single sign-on system is also reduced;

[0041] 4. Single sign-on is achieved through digital certificates, which is independent of specific system architecture and communication protocols. Therefore, it has strong scalability and flexibility. When an enterprise needs to add a new system or adjust the system architecture, it only needs to update the corresponding digital certificate and authentication policy without large-scale transformation of the single sign-on system.

[0042] 5. As data protection and privacy regulations become increasingly stringent, companies must strictly abide by relevant laws and regulations when handling user personal information. This method uses digital certificates to achieve identity authentication and access control, complies with industry standards and regulatory requirements, and helps companies build a secure and compliant IT environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor. Among them:

[0044] Figure 1 This is a flow chart of a method for implementing a zero-interface secure single sign-on based on a digital certificate as shown in the present invention;

[0045] Figure 2 This is a schematic diagram of the login request parameter composition shown in the present invention;

[0046] Figure 3 This is a schematic diagram of the login user information parameter composition shown in the present invention. DETAILED DESCRIPTION

[0047] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings. It is obvious that the described embodiments are only part of the embodiments of the present invention, but not all of the embodiments.

[0048] Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without making any creative work should fall within the scope of protection of the present invention.

[0049] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0050] Exemplarily, in an embodiment of the present invention, an application system A and a unified login system X are defined, and both systems have digital certificates issued by an authoritative CA organization, wherein the public key of the digital certificate of application system A is Pub(A), and the private key is Pri(A), and the public key of the digital certificate of unified login system X is Pub(X), and the private key is Pri(X).

[0051] According to an embodiment of the present invention, Figure 1 The flowchart shown is a method for implementing a zero-interface secure single sign-on based on a digital certificate, which specifically includes the following steps:

[0052] S1. The user accesses the application system page through a browser.

[0053] S2. The application system detects whether there is user information in the session.

[0054] S2-1. When the detection result is yes, it means that the user has logged into the system, and the page that the user needs to access is returned to the user's browser.

[0055] S2-2. When the detection result is no, it means that the user has not logged into the system, a login request is generated, the address of the page that the user needs to access is cached, and a login link pointing to the unified login system X is returned to the user's browser.

[0056] The login request is a string consisting of a newly generated UUID (Universally Unique Identifier) ​​and the current time.

[0057] In an optional implementation, the above method for caching the address of the page that the user needs to access is to use the newly generated UUID as the key and the address of the page that the user needs to access as the value, and save them in the cache.

[0058] Reference Figure 2 The login link contains the login request encrypted with Pub(X) (request parameter) and the login request signed with Pri(A) (signed parameter).

[0059] As an example, suppose the request UUID is: d3d85f57-8b48-eb2a-6572-20534a71edf1, the current time is: 20240610091022, the login request (request parameter) encrypted by Pub(X) is: AVpDQmETIhmLXrReWAmo......utE, the login request (signed parameter) signed by Pri(A) is: RjM75IehwC......xY7o, and the login link pointing to the unified login system X is returned:

[0060] http: / / www.systemx.com / login?request=AVpDQmETIhmLXrReWAmo......utE&signed=RjM75IehwC......xY7o

[0061] S3. The user's browser is redirected to the address indicated by the login link.

[0062] S4. The unified login system verifies whether the parameters of the login link are legal.

[0063] Specifically, the method to verify whether the parameters of the login link are legal is: use Pri(X) to decrypt the login request, obtain the UUID and request time, and use the public key Pub(A) of the application system to verify whether the signed login request is authentic and valid.

[0064] To prevent replay attacks, the unified login system will record the UUIDs of the recent period. If the decrypted UUID already exists or the request time is not recent, the login parameters will be deemed invalid.

[0065] As an example, suppose the unified login system records UUIDs within 10 minutes, and the current time is 20240610091023. If the decrypted request time is 20240610091022, it means that the request was generated 1 second ago, and the UUID has not been recorded, then it is judged to be legal; if the decrypted request time is 20240610090000, it means that the request was generated 10 minutes ago, and it is impossible to verify whether the UUID is recorded, then it is judged to be illegal.

[0066] S4-1. If the verification result is negative, a login error message is returned to the user's browser and the login is terminated.

[0067] S4-2. If the verification result is yes, the unified login system checks whether there is user information in the session.

[0068] S5. If there is no user information in the session, return the login page to the user's browser.

[0069] S5-1. The user logs in on the login page.

[0070] S5-2. After the user logs in successfully, the unified login system saves the user information in the session.

[0071] S6. Return the login success link of the application system to the user's browser.

[0072] Reference Figure 3 The successful login link contains the login user information encrypted by Pub(A) (info parameter) and the login user information signed by Pri(X) (signed parameter).

[0073] In an optional implementation, the login user information includes, but is not limited to, requesting UUID and mobile phone number, account number, name, and other information that can be used to identify the user's unique identity.

[0074] As an example, assume that the login user information (info parameter) encrypted with Pub(A) is: Rw1IXWfJOHjDV......sZWE9, and the login user information (signed parameter) signed with Pri(X) is: l2ZL8JxER7K1Fetmlf......MNEbw, and the login success link returned to the application system is:

[0075] http: / / www.systema.com / loginSuccess?signed=l2ZL8JxER7K1Fetmlf......MNEbw&info=Rw1IXWfJOHjDV......sZWE9

[0076] S7. The user's browser is redirected to the address indicated by the successful login link.

[0077] S8. The application system uses Pri(A) to decrypt and verify the parameters in the login link to obtain the login user information.

[0078] S9. The application system uses Pub(X) to verify whether the login request in the login link is valid.

[0079] In an optional implementation, the method for verifying whether the login user information in the login link is valid is: use the UUID of the login request to read the page address in the cache that the user needs to access. If it can be read, it means that the login request is valid, otherwise it means that the login request is invalid.

[0080] S9-1. If the verification result is negative, a login error message is returned to the user's browser and the login is terminated.

[0081] S9-2. If the verification result is yes, the application system saves the user information into the session.

[0082] S10. Return the address of the page that the user needs to access to the user's browser.

[0083] S11. The user's browser is redirected to the page address that the user needs to access, and single sign-on is completed.

[0084] Preferably, an embodiment of the present invention provides a secure single sign-on method based on digital certificates to achieve zero interface, which realizes cross-system authentication of user identities through digital certificates and tokens. It can achieve secure single sign-on without calling interfaces to each other and without network intercommunication, thereby improving the security of user identity authentication and data transmission, and is an efficient, secure and convenient identity authentication mechanism.

[0085] The public key encryption and private key decryption methods of the aforementioned login information can be performed using methods and means in the prior art and will not be described in detail in this example.

[0086] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A method for implementing zero-interface secure single sign-on based on digital certificates, characterized in that: include: Users access the application system pages through browsers; The application system detects whether there is user information in the session; When the detection result is yes, it indicates that the user has logged into the system, and the page that the user needs to access is returned to the user's browser; When the detection result is no, it means that the user has not logged into the system, a login request is generated, the address of the page that the user needs to access is cached, and a login link pointing to the unified login system is returned to the user's browser; The user's browser is redirected to the address indicated by the login link; Unify the login system and verify whether the parameters of the login link are legal; If the verification result is no, a login error message is returned to the user's browser and the login is terminated; If the verification result is yes, the unified login system checks whether there is user information in the session; If there is no user information in the session, return the login page to the user's browser; The user logs in on the login page; After the user logs in successfully, the unified login system saves the user information to the session; Return the successful login link of the application system to the user's browser; The user's browser is redirected to the address indicated by the successful login link; The application system uses the application system private key to decrypt and verify the parameters in the login link to obtain the login user information; The application system uses the unified login system public key to verify whether the login request in the login link is valid; If the verification result is no, a login error message is returned to the user's browser and the login is terminated; If the verification result is yes, the application system saves the user information into the session; Return the address of the page that the user needs to access to the user's browser; The user's browser is redirected to the page address that the user needs to access, and single sign-on is completed.

2. The method for implementing zero-interface secure single sign-on based on digital certificates according to claim 1, characterized in that: The login request is a string consisting of a newly generated unique identification code UUID and the current time.

3. The method for implementing zero-interface secure single sign-on based on digital certificates according to claim 1, characterized in that: The method for caching the address of the page that the user needs to access is to use the newly generated UUID as the key and the address of the page that the user needs to access as the value, and save them in the cache.

4. The method for implementing zero-interface secure single sign-on based on digital certificates according to claim 1, characterized in that: The login link includes a login request encrypted using the public key of the unified login system and a login request signed using the private key of the application system; The login request encrypted by the public key is the request parameter, and the login request signed by the private key is the signed parameter.

5. The method for implementing zero-interface secure single sign-on based on digital certificates according to claim 1, characterized in that: The verification of whether the parameters of the login link are legal includes: Use the private key of the unified login system to decrypt the login request, obtain the UUID and request time, and use the public key of the application system to verify whether the signed login request is authentic and valid.

6. The method for implementing zero-interface secure single sign-on based on digital certificates according to claim 5, characterized in that: The successful login link at least includes the login user information encrypted with the public key of the application system and the login user information signed with the private key of the unified login system; The login user information encrypted by the public key of the application system is the info parameter, and the login user information signed by the private key is the signed parameter.

7. The method for implementing zero-interface secure single sign-on based on digital certificates according to claim 6, characterized in that: The login user information includes but is not limited to requesting UUID, mobile phone number, account number, name, and information that can be used to identify the user's unique identity.

Images