Multi-system login-free jump method based on signature adding and verification

Abstract

The invention discloses a multi-system login-free jump method based on signing and verification, which comprises the following steps: a first system front end sends a signing request to a first system rear end, and the first system rear end acquires user information from a second system to generate signing information; the first system front end opens the new blank tab in a POST request form, and the new blank tab sends an HTTP request in the POST form to the second system rear end; the second system rear end receives the HTTP request and performs signature verification; when the signature verification is passed, the back end of the second system simulates user login; the back end of the second system responds to the HTTP request, 302 redirection is set, the new blank tab is redirected to a login page of the second system, and skipping and opening are carried out; when the login page of the second system retrieves that the user completes login, the page is automatically redirected to a front-end page of the second system; according to the multi-system login-free skipping method and device, the multi-system login-free skipping is realized through the combination of the signing request and the login-free request and the signing and verification mechanism.

Description

Technical Field

[0001] The present invention relates to the technical field of electronic digital data processing, and in particular to the technical field of protecting data access through a platform, such as using keys or access control rules, and specifically to a multi-system login-free jump method based on signature addition and verification. Background Art

[0002] At present, enterprise operations are highly dependent on various information systems, such as customer relationship management (CRM), enterprise resource planning (ERP) and content management system (CMS). These systems each carry different aspects of enterprise operations, and users often need to switch between multiple systems when using these systems. The traditional login method requires users to log in again every time they switch systems, which not only affects work efficiency, but also reduces user experience.

[0003] To solve this problem, the login-free jump technology came into being. This technology allows users to seamlessly switch to other systems after completing identity authentication in one system without having to log in again. This greatly simplifies user operations, improves work efficiency, and optimizes user experience. In order to ensure the security of user identity and the integrity of data when calling interfaces between different systems, the signature verification mechanism plays a vital role. Signature verification is the process of encrypting the user's identity information and session information and attaching it to the request, while signature verification is the process of decrypting and verifying this information by the receiving system.

[0004] Although the login-free jump technology has significant advantages in theory, in practical applications, the existing technology still has some defects: 1. The existing login-free jump method requires the backend of the first system to interact with the backend of the second system for multiple requests to complete the identity authentication process; when implementing the login-free process from the front end of the first system to the front end of the second system, it takes a lot of time, increases costs, and may also delay progress; 2. In the login-free jump process, it is crucial to ensure the security of user identity and the integrity of data. However, some existing technologies may have deficiencies in the signature verification mechanism, resulting in the risk of data being tampered with or forged during transmission.

[0005] Therefore, it is necessary to improve the multi-system login-free jump method based on signature addition and verification in the prior art to solve the above problems. Summary of the invention

[0006] The present invention overcomes the shortcomings of the prior art and provides a multi-system login-free jump method based on signature addition and verification, aiming to solve the problems in the prior art of complex and time-consuming login-free jump process and insufficient data security.

[0007] To achieve the above purpose, the technical solution adopted by the present invention is: a multi-system login-free jump method based on signature addition and verification, comprising:

[0008] S1. The first system front end sends a signature request to the first system back end. The first system back end obtains user information from the second system, generates signature information and sends it to the first system front end.

[0009] S2. The first system front end opens a new blank tab in the form of a POST request, and the new blank tab sends a POST HTTP request to the second system back end, and stores the signature information in the request body of the HTTP request;

[0010] In step S2, a table form is temporarily created in the first system, and the action attribute is specified as POST, the target attribute is _blank, and the address points to the login interface of the second system. The signature information is added as a hidden field in the form, the submission operation of the form is triggered, a new blank tab is opened in the browser, and a POST request is sent in the tab;

[0011] S3. The backend of the second system receives the HTTP request in the form of POST, reads the signature information transmitted by the first system from the request body, and verifies the signature to confirm the user's identity;

[0012] S4. When the signature verification is passed, the second system backend sends a login request to the corresponding server, simulates the user login, and returns the corresponding login authentication information;

[0013] S5. The backend of the second system responds to the HTTP request of the new blank page, sets a 302 redirect, redirects the new blank page to the login page of the second system, jumps to and opens the login page of the second system;

[0014] S6. The login page of the second system retrieves that the user has completed the login, and after the identity authentication process, the page is automatically redirected to the front-end page of the second system;

[0015] S7. The new blank tab opened in the first system eventually jumps to the designated second system front-end page, completing the login-free jump process.

[0016] In a preferred embodiment of the present invention, in step S1, the step of obtaining the signature information includes:

[0017] S11. When the first system backend receives the signature request, it retrieves the user information required for logging into the second system;

[0018] S12, the first system backend creates a temporary request ID in a universally unique identifier format, a timestamp, and a random number;

[0019] S13, the first system backend concatenates the five variables of application ID, key, request ID, timestamp, and random number into strings in a fixed order;

[0020] S14. The concatenated string is encrypted with SHA256 to obtain the final signature information.

[0021] In a preferred embodiment of the present invention, in step S1, the user information includes: application ID, key; application ID, key, request ID, timestamp and random number are signature parameters.

[0022] In a preferred embodiment of the present invention, in step S2, in a new blank tab newly opened in the browser, an HTTP request in the form of POST is automatically sent to the second system backend to execute the login-free request. The current new blank tab completes the execution process of the login-free request without HTML and JavaScript code.

[0023] In a preferred embodiment of the present invention, in step S3, after receiving the signature parameters and signature information uploaded by the first system, the second system reads the corresponding key from its own system according to the application ID, generates signature verification information according to the SHA256 encryption processing rules of S1, and compares it with the signature information uploaded by the first system. If they are completely consistent, the signature verification passes.

[0024] In a preferred embodiment of the present invention, step S5 comprises:

[0025] S51. After the signature verification is passed, the second system backend constructs an HTTP response, and the status code of the HTTP response is set to 302 Found, indicating a temporary redirection;

[0026] S52. In the HTTP response, the second system backend sets a location field, and the value of the location field points to the URL address of the second system login page;

[0027] S53, the second system backend sends the HTTP response to the new blank page. When the new blank page is signed, it automatically jumps to the login page of the second system.

[0028] In a preferred embodiment of the present invention, in step S6, after the login page detects the login authentication information, the identity authentication step includes:

[0029] S61, verifying the format, signature and validity period of the login authentication information. If the login authentication information is invalid or expired, the identity authentication process fails;

[0030] S62: When the login authentication information is valid, the login page uses the login authentication information to query the corresponding user information in the system of the second system backend, and creates a session for the user;

[0031] S63. The login page sets a cookie containing session information in the user's browser and stores authentication information on the user's end.

[0032] In a preferred embodiment of the present invention, in step S3, during the signature verification process, the time range of the timestamp is checked to be less than 5 minutes.

[0033] The present invention provides a multi-system login-free jump system based on signature addition and verification, comprising:

[0034] User interaction module: used to process the user's interactive operations at the front end of the first system;

[0035] A signature information generation module, used to generate signature information in the back end of the first system according to the user information and other dynamic parameters obtained from the second system;

[0036] A login-free request sending module, used to send a login-free request to a second system backend through a newly opened blank tab in the first system frontend;

[0037] The request signature verification module is used to perform signature verification operations on the received free login request in the back end of the second system;

[0038] The login processing module is used to process the login request, simulate the user login, and generate login authentication information in the second system backend after the signature verification is passed;

[0039] The redirection processing module is used to construct an HTTP response in the second system backend, set a 302 redirection, and redirect the new blank page to the login page of the server;

[0040] The identity authentication module is used to verify the login authentication information in the server's login page, create a session for the user, and set Cookie to store the authentication information;

[0041] The page jump and content display module is used to jump to the second system front-end page in a new blank tab according to the redirection response of the login page, and display the corresponding page content or provide services according to the user's login status and permissions.

[0042] The present invention provides a multi-system login-free jump system device based on signature addition and verification, including: an electronic device, the electronic device including a memory, a processor, and a computer program stored in the memory and running on the processor.

[0043] The present invention solves the defects existing in the background technology and has the following beneficial effects:

[0044] (1) The present invention combines the signature request with the login-free request, and the specific implementation steps of the signature verification mechanism, generates signature information in the first system, sends the login-free request to the second system through a new blank page, and the second system verifies the signature and simulates the user login after passing, and finally realizes the login-free jump. This process combines the signature verification mechanism to ensure the security of the user's identity and the integrity of the data. Compared with the prior art, the present invention further achieves the effects of simplifying user operations, improving work efficiency, optimizing user experience, and enhancing data security.

[0045] (2) The present invention combines the generation of signature information in step S1 with the signature verification process in step S3 to ensure the security and effectiveness of the login-free request. The signature information is generated by the backend of the first system and is obtained through SHA256 encryption based on multiple variables such as application ID, key, request ID, timestamp and random number. This complex and random signature mechanism, combined with the timestamp check in the signature verification process, effectively prevents replay attacks and forged requests, and ensures the security of data transmission. Compared with the prior art, the robustness of the signature verification mechanism is further enhanced.

[0046] (3) The present invention realizes a seamless and efficient user experience by using a new blank tab in step S2 in combination with the 302 redirection in step S5. The new blank tab acts as an intermediate bridge, responsible for sending a login-free request and receiving a response. Traditional login-free jump technology often requires multiple interactions between users or systems to complete identity authentication. In the present invention, once the second system receives the login-free request of the first system and successfully passes the signature verification, the login process will be automatically performed at the back end of the second system, without the need for secondary confirmation with the user or additional interaction with the first system. This automated processing significantly reduces the number of unnecessary interactions between users and systems, and improves the user experience. Combined with the 302 redirection technology, users can quickly jump from the first system to the login page of the second system, and finally automatically log in to the front end of the second system. This process greatly simplifies user operations and improves work efficiency.

[0047] (4) The present invention realizes efficient and secure user identity authentication and status tracking by combining the server login request processing in step S4 with the identity authentication and session management in step S6. After receiving the login request, the server can quickly verify the validity of the request and generate login authentication information. The login page uses this information to complete the user's identity authentication and creates a session to track the user's login status. This mechanism ensures the consistency of the user's identity across multiple systems and improves the overall security of the system. Compared with the prior art, the efficiency of identity authentication and session management is further optimized.

[0048] (5) The present invention enhances data security through the synergistic effect of random numbers and SHA256 encryption processing, and increases the difficulty for attackers to predict or forge legal signature information. The random number of each signature request is different, and attackers cannot predict or generate new valid signature information only based on previously intercepted signature information.

[0049] (6) In the process of realizing the login-free jump, the first system directly opens a blank tab and sends a POST request to the second system by means of form submission. This process does not require the development of a specific HTML web page for automatic login. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art are briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative work.

[0051] Figure 1 It is a three-dimensional structural diagram of a preferred embodiment of the present invention. DETAILED DESCRIPTION

[0052] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0053] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein. Therefore, the protection scope of the present invention is not limited to the specific embodiments disclosed below.

[0054] A multi-system login-free jump method based on signature addition and verification includes the following steps:

[0055] S1. The first system front end sends a signature request to the first system back end. The first system back end obtains user information from the second system, generates signature information and sends it to the first system front end.

[0056] S2. The first system front end opens a new blank tab in the form of a POST request, and the new blank tab sends a POST HTTP request to the second system back end, and stores the signature information in the request body of the HTTP request;

[0057] S3. The backend of the second system receives the HTTP request in the form of POST, reads the signature information transmitted by the first system from the request body, and verifies the signature to confirm the user's identity;

[0058] S4. When the signature verification is passed, the second system backend sends a login request to the corresponding server, simulates the user login, and returns the corresponding login authentication information;

[0059] S5. The backend of the second system responds to the HTTP request of the new blank page, sets a 302 redirect, redirects the new blank page to the login page of the second system, jumps to and opens the login page of the second system;

[0060] S6. The login page of the second system retrieves that the user has completed the login, and after the identity authentication process, the page is automatically redirected to the front-end page of the second system;

[0061] S7. The new blank tab opened in the first system eventually jumps to the designated second system front-end page, completing the login-free jump process.

[0062] In the above-mentioned multi-system login-free jump method based on signature addition and verification, the first system and the second system refer to two different software systems or applications. In a multi-system environment, different systems or services need to interact with each other to complete complex business processes.

[0063] The first system is the system with which the user initially interacts. The user initiates an operation at the front end of the first system to access the resources or services of the second system. The first system is responsible for processing the user's request and communicating with the second system to obtain the necessary signature information, so that the user can access the second system without logging in.

[0064] The second system is the target system whose resources or services the user wants to access. The second system receives the login-free request from the first system and performs necessary verification steps to ensure that the request is legal and safe. When the verification is successful, the second system processes the login request, enabling the user to access its resources without entering credentials.

[0065] The signature request is a request initiated by the first system front end to the first system back end, with the purpose of obtaining the signature information required to access the second system. The signature request is an HTTP request.

[0066] Specifically, in step S1, the user information includes: application ID, key;

[0067] Specifically, in step S1, the step of obtaining the signature information includes:

[0068] S11. When the first system backend receives the signature request, it retrieves the user information required for logging into the second system;

[0069] S12, the first system backend creates a temporary request ID in a universally unique identifier format, a timestamp, and a random number;

[0070] S13, the first system backend concatenates the five variables, application ID, key, request ID, timestamp and random number, into strings in a fixed order;

[0071] S14, the concatenated string is encrypted with SHA256 to obtain the final signature information;

[0072] The random number ensures that each signature request is unique. Since the random number is different in each request, even if other signature parameters such as application ID, key, request ID and timestamp remain unchanged in multiple requests, the introduction of random numbers also makes each generated signature information unique;

[0073] SHA256 encryption is an encryption technology based on the secure hash algorithm. It can convert data of any length into a hash value of fixed length. Its core features are: the same input data will always produce the same hash value; the original data cannot be restored from the hash value, that is, the encryption process is irreversible;

[0074] The random number and SHA256 encryption processing work together to enhance data security and increase the difficulty for attackers to predict or forge legitimate signature information. The random number for each signature request is different, and attackers cannot predict or generate new valid signature information based solely on previously intercepted signature information.

[0075] When the first system front end receives the signature information, it will store it in the local storage of the browser.

[0076] In step S2, the new blank tab refers to a blank page newly opened in the browser, which does not load any content except the POST request content triggered by the first system front end through form submission. In this login-free process, the new blank tab is used to send a login-free request to the second system back end and receive a response from the second system.

[0077] Specifically, in step S2, in a new blank tab opened in the browser, an HTTP request in the form of POST is automatically sent to the second system backend to execute the login-free request. No HTML or JavaScript code is required in the current tab to complete the execution process of the login-free request. The new blank tab serves as an independent context, which can help isolate the interactions between different systems and prevent potential script conflicts.

[0078] At the same time, the signature information and data parameters in the request are stored in the request body of the HTTP request, which effectively ensures the security of the data and avoids possible data leakage when the parameters are stored in the URL address of the web page.

[0079] Specifically, in step S2, a table form is temporarily created in the first system, and the action attribute is specified as POST, the target attribute is _blank, the address points to the login-free interface of the second system, the signature parameters and signature information are added to the form as hidden fields, the form submission operation is triggered, a new blank tab is opened in the browser, and a POST request is sent in the new blank tab;

[0080] The action attribute is used to specify the URL address for submitting form data to the server. The target attribute is used to specify the location where the page is loaded after the form is submitted. The POST request is a request method in the HTTP protocol, which is used to submit data to the server and request the server to process it.

[0081] In step S2, the signature parameters and other necessary information are included in the request body of the POST request, thereby realizing the sending of the login-free request. After the second system backend receives the HTTP request for the new blank tab, it reads the corresponding parameters from the request body and proceeds to the next signature verification step.

[0082] Specifically, in step S3, after receiving the signature parameters and signature information uploaded by the first system, the second system reads the corresponding key from its own system according to the application ID, generates the signature verification information according to the SHA256 encryption processing rules of S1, and compares it with the signature information uploaded by the first system. If they are completely consistent, it means that the signature verification is passed.

[0083] In step S3, during the signature verification process, check whether the timestamp is within a reasonable time range, such as within 5 minutes, to prevent replay attacks.

[0084] Specifically, in step S4, after receiving the login request, the server verifies the validity of the request according to its internal user information and authentication mechanism. After successful verification, the server generates a login authentication information with a validity period, and the login authentication information represents the user's login status;

[0085] Specifically, step S5 includes:

[0086] S51. After the signature verification is passed, the second system backend constructs an HTTP response, and the status code of the HTTP response is set to 302Found, indicating a temporary redirection, that is, 302 redirection;

[0087] S52. In the HTTP response, the second system backend sets a location field, the value of which points to the URL address of the second system login page; the URL address includes: login authentication information and the address of the second system front-end page to be redirected;

[0088] S53, the second system backend sends the HTTP response to the new blank page. When the new blank page is signed, it automatically jumps to the login page of the second system.

[0089] Specifically, in step S6, after the login page detects the login authentication information, the identity authentication step includes:

[0090] S61, verifying the format, signature and validity period of the login authentication information. If the login authentication information is invalid or expired, the identity authentication process fails;

[0091] S62, when the login authentication information is valid, the login page uses the login authentication information to query the corresponding user information in the system of its second system backend, and creates a session for the user; the session is used to track the user's login status;

[0092] S63. The login page sets a cookie containing session information in the user's browser and stores authentication information on the user's end.

[0093] After completing the identity authentication step, the login page constructs a redirect response to redirect the user to the second system front-end page address that S52 needs to redirect to. The status code of the redirect response is set to 302Found, instructing the browser to jump to the second system front-end page address.

[0094] Specifically, in step S7, after the new blank page receives the redirect response of the login page, the browser automatically jumps to the second system front-end page address, and the second system front-end displays the corresponding page content or provides corresponding services according to the user's login status and his or her permissions.

[0095] A system for a multi-system login-free jump method based on signature addition and verification, comprising the following modules:

[0096] User interaction module: used to process the user's interactive operations at the front end of the first system;

[0097] A signature information generation module, used to generate signature information in the back end of the first system according to the user information and other dynamic parameters obtained from the second system;

[0098] A login-free request sending module, used to send a login-free request to a second system backend through a newly opened blank tab in the first system frontend;

[0099] The request signature verification module is used to perform signature verification operations on the received free login request in the back end of the second system;

[0100] The login processing module is used to process the login request, simulate the user login, and generate login authentication information in the second system backend after the signature verification is passed;

[0101] The redirection processing module is used to construct an HTTP response in the second system backend, set a 302 redirection, and redirect the new blank page to the login page of the server;

[0102] The identity authentication module is used to verify the login authentication information in the server's login page, create a session for the user, and set Cookie to store the authentication information;

[0103] The page jump and content display module is used to jump to the second system front-end page in a new blank tab according to the redirection response of the login page, and display the corresponding page content or provide services according to the user's login status and permissions.

[0104] The above is based on the ideal embodiment of the present invention. Through the above description, relevant personnel can make various changes and modifications without departing from the technical concept of the present invention. The technical scope of the present invention is not limited to the content in the specification, and the technical scope must be determined according to the scope of the claims.

Claims

1. A multi-system login-free jump method based on signature verification, characterized in that: Includes steps: S1. The first system front end sends a signature request to the first system back end. The first system back end obtains user information from the second system, generates signature information and sends it to the first system front end. S2. The first system front end opens a new blank tab in the form of a POST request, and the new blank tab sends a POST HTTP request to the second system back end, and stores the signature information in the request body of the HTTP request; In step S2, a table form is temporarily created in the first system, and the action attribute is specified as POST, the target attribute is _blank, and the address points to the login interface of the second system. The signature information is added as a hidden field in the form, the submission operation of the form is triggered, a new blank tab is opened in the browser, and a POST request is sent in the tab; S3. The backend of the second system receives the HTTP request in the form of POST, reads the signature information transmitted by the first system from the request body, and verifies the signature to confirm the user's identity; S4. When the signature verification is passed, the second system backend sends a login request to the corresponding server, simulates the user login, and returns the corresponding login authentication information; S5. The backend of the second system responds to the HTTP request of the new blank page, sets a 302 redirect, redirects the new blank page to the login page of the second system, jumps to and opens the login page of the second system; S6. The login page of the second system retrieves that the user has completed the login, and after the identity authentication process, the page is automatically redirected to the front-end page of the second system; S7. The new blank tab opened in the first system eventually jumps to the designated second system front-end page, completing the login-free jump process.

2. According to claim 1, a multi-system login-free jump method based on signature verification is characterized in that: In step S1, the step of obtaining the signature information includes: S11. When the first system backend receives the signature request, it retrieves the user information required for logging into the second system; S12, the first system backend creates a temporary request ID in a universally unique identifier format, a timestamp, and a random number; S13, the first system backend concatenates the five variables of application ID, key, request ID, timestamp, and random number into strings in a fixed order; S14. The concatenated string is encrypted with SHA256 to obtain the final signature information.

3. According to claim 2, a multi-system login-free jump method based on signature verification is characterized in that: In step S1, the user information includes: application ID, key; application ID, key, request ID, timestamp and random number are signature parameters.

4. According to claim 3, a multi-system login-free jump method based on signature verification is characterized in that: In step S2, in a new blank tab opened in the browser, an HTTP request in the form of POST is automatically sent to the second system backend to execute the login-free request.

5. According to claim 4, a multi-system login-free jump method based on signature verification is characterized in that: In step S3, after receiving the signature parameters and signature information uploaded by the first system, the second system reads the corresponding key from its own system according to the application ID, generates the signature verification information according to the SHA256 encryption processing rules of S1, and compares it with the signature information uploaded by the first system. If they are completely consistent, the signature verification passes.

6. According to claim 1, a multi-system login-free jump method based on signature verification is characterized in that: Step S5 includes: S51. After the signature verification is passed, the second system backend constructs an HTTP response, and the status code of the HTTP response is set to 302 Found, indicating a temporary redirection; S52. In the HTTP response, the second system backend sets a location field, and the value of the location field points to the URL address of the second system login page; S53, the second system backend sends the HTTP response to the new blank page. When the new blank page is signed, it automatically jumps to the login page of the second system.

7. According to claim 1, a multi-system login-free jump method based on signature verification is characterized in that: In step S6, after the login page detects the login authentication information, the identity authentication steps include: S61, verifying the format, signature and validity period of the login authentication information. If the login authentication information is invalid or expired, the identity authentication process fails; S62: When the login authentication information is valid, the login page uses the login authentication information to query the corresponding user information in the system of the second system backend, and creates a session for the user; S63. The login page sets a cookie containing session information in the user's browser and stores authentication information on the user's end.

8. According to claim 1, a multi-system login-free jump method based on signature verification is characterized in that: In step S3, during the signature verification process, the time range of the timestamp is checked to be less than 5 minutes.

9. A multi-system login-free jump system based on signature verification, based on a multi-system login-free jump method based on signature verification according to any one of claims 1 to 8, comprising: User interaction module: used to process the user's interactive operations at the front end of the first system; A signature information generation module, used to generate signature information in the back end of the first system according to the user information and other dynamic parameters obtained from the second system; A login-free request sending module, used to send a login-free request to a second system backend through a newly opened blank tab in the first system frontend; The request signature verification module is used to perform signature verification operations on the received free login request in the back end of the second system; The login processing module is used to process the login request, simulate the user login, and generate login authentication information in the second system backend after the signature verification is passed; The redirection processing module is used to construct an HTTP response in the second system backend, set a 302 redirection, and redirect the new blank page to the login page of the server; The identity authentication module is used to verify the login authentication information in the server's login page, create a session for the user, and set Cookie to store the authentication information; The page jump and content display module is used to jump to the second system front-end page in a new blank tab according to the redirection response of the login page, and display the corresponding page content or provide services according to the user's login status and permissions.

10. A multi-system login-free jump system device based on signature verification, the multi-system login-free jump system device based on signature verification includes an electronic device, the electronic device includes a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, a multi-system login-free jump method based on signature addition and verification as described in any one of claims 1-8 is implemented.

Images