Single sign-on access method and device, electronic equipment and storage medium

Abstract

The invention discloses a single sign-on access method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining the request data of a client in response to the request information of the client for a converter; transforming and packaging the request data based on a preset format through a converter to obtain a target request; sending the target request to a server, so that the server performs request verification; when the verification request result is that the verification is passed, the access control information is returned to the converter through the server side; analyzing and transforming the access control information based on a preset data template through a converter to obtain target data; and returning the target data to the client. According to the technical scheme, the converter is introduced to serve as a middle layer, the problems that in an existing technical scheme, service code transformation time is long, and invasion to native services of an Internet of Things system is large are effectively solved, standardization of unified authentication and access control is achieved, and the method can be widely applied to the technical field of data processing.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a single sign-on access method, device, electronic device and storage medium. Background Art

[0002] OAuth2.0 single sign-on protocol is the most commonly used secure and standardized authorization mechanism in the Internet of Things system.

[0003] The principle logic in the specific application scenario is as follows:

[0004] 1. In the OAuth2.0 single sign-on standard protocol, the interaction process between the user and the authorization server is fixed, usually including user login, token issuance, access service and token refresh, etc., corresponding to different interfaces, and the request path, request method and request parameters of the interface are fixed templates. In the actual application process, the unified authentication center, i.e. the server, will repackage the standard interface according to the needs of the business scenario, including but not limited to the request path, request method and request parameters.

[0005] 2. When a third-party application accesses the unified authentication center as a client, the multiple interfaces provided by different authentication servers will be significantly different from the standard interfaces, and cannot be adapted using a fixed processing flow. The source code needs to be modified according to the specific interface request method and request parameters, which has a wide impact on client business and takes a long time.

[0006] The existing technical solutions for single sign-on access have the following disadvantages:

[0007] 1. When the IoT system is connected to different business systems as a third-party application, it is necessary to modify the business code according to the interface provided by the authentication server, which is time-consuming.

[0008] 2. The unified authentication system access for different business systems has low business relevance to the IoT system itself. Directly modifying the IoT client has a significant intrusion on the native business, which is not conducive to the stability and optimization iteration of the system. Summary of the invention

[0009] The present invention proposes a single sign-on access method, device, electronic device and storage medium, aiming to solve one of the technical problems in the related art at least to a certain extent. The embodiments of the present invention can conveniently implement single sign-on access.

[0010] On the one hand, an embodiment of the present invention provides a single sign-on access method, including:

[0011] In response to the request information of the client to the converter, obtain the request data of the client;

[0012] The request data is transformed and encapsulated based on a preset format by a converter to obtain a target request;

[0013] Send the target request to the server so that the server can verify the request; when the result of the request verification is passed, the server returns the access control information to the converter;

[0014] The access control information is parsed and transformed through the converter based on the preset data template to obtain the target data; the target data is returned to the client.

[0015] Optionally, a standard interface is pre-configured in the converter; obtaining the request data of the client includes the following steps:

[0016] Obtain client request data based on standard interface through converter;

[0017] Among them, the request data includes resource authorization request, access token request and resource request; the standard interface includes an authorization interface for obtaining resource authorization request, a token interface for obtaining access token request and a user information interface for obtaining resource request.

[0018] Optionally, transforming and encapsulating the request data based on a preset format by a converter to obtain a target request includes the following steps:

[0019] Based on the format requirements of the server's http request, the request format of the request data is transformed and encapsulated through the converter to obtain the target request;

[0020] The request format includes a request path, a request method and request parameters; the preset format corresponding to the format requirement is pre-configured in the converter.

[0021] Optionally, the method further comprises the following steps:

[0022] Based on the format requirements of the http request of the server, in response to the first instruction of the management object, a corresponding parameter mapping table is configured; the parameter mapping table is arranged into a preset format and configured in the converter;

[0023] When the format requirement of the server changes, based on the changed parameter item, the corresponding configuration item in the parameter mapping table is adjusted in response to the second instruction of the management object.

[0024] Optionally, the target request includes a target resource authorization request, a target access token request, and a target resource request; request verification includes the following steps:

[0025] Performing resource authorization verification in response to a target resource authorization request;

[0026] Authenticate in response to a target access token request;

[0027] Token validation is performed in response to target resource requests.

[0028] Optionally, the target request includes a target resource authorization request, a target access token request and a target resource request; the request verification includes resource authorization verification, identity authentication and token verification; the access control information includes authorization information, token information and resource information; when the result of the request verification is passed, the access control information is returned to the converter through the server, including the following steps:

[0029] When the result of resource authorization verification is passed, the server sends authorization information;

[0030] Wherein, resource authorization verification is performed in response to a target resource authorization request;

[0031] When the result of identity authentication is verified, the token information is issued through the server;

[0032] Wherein, identity authentication is performed in response to the target access token request and authorization information;

[0033] When the token verification result is passed, the resource information is sent through the server;

[0034] Among them, token verification is performed in response to the target resource request and token information.

[0035] Optionally, parsing and transforming the access control information based on a preset data template by a converter includes the following steps:

[0036] Based on the data structure requirements of the client, the structure of the access control information is parsed and transformed through the converter;

[0037] Among them, the preset data template corresponding to the data structure requirement is pre-configured in the converter.

[0038] On the other hand, an embodiment of the present invention provides a single sign-on access device, including:

[0039] The first module is used to obtain the client's request data in response to the client's request information to the converter;

[0040] The second module is used to transform and encapsulate the request data based on a preset format through a converter to obtain a target request;

[0041] The third module is used to send the target request to the server so that the server can verify the request; when the result of the request verification is passed, the access control information is returned to the converter through the server;

[0042] The fourth module is used to parse and transform the access control information based on a preset data template through a converter to obtain target data; and return the target data to the client.

[0043] Optionally, the device further comprises:

[0044] The fifth module is used to configure a corresponding parameter mapping table in response to the first instruction of the management object based on the format requirement of the http request of the server; and to organize the parameter mapping table into a preset format and configure it in the converter;

[0045] The sixth module is used to adjust the corresponding configuration item in the parameter mapping table in response to the second instruction of the management object based on the changed parameter item when the format requirement of the server changes.

[0046] On the other hand, an embodiment of the present invention provides an electronic device, including: a processor and a memory; the memory is used to store programs; the processor executes the program to implement the above-mentioned single sign-on access method.

[0047] On the other hand, an embodiment of the present invention provides a computer storage medium, in which a program executable by a processor is stored. When the program executable by the processor is executed by the processor, it is used to implement the above-mentioned single sign-on access method.

[0048] The embodiment of the present invention obtains the request data of the client by responding to the request information of the client to the converter; the converter transforms and encapsulates the request data based on a preset format to obtain the target request; sends the target request to the server so that the server verifies the request; when the result of the request verification is passed, the server returns the access control information to the converter; the converter parses and transforms the access control information based on a preset data template to obtain the target data; and returns the target data to the client. The present invention includes the following beneficial effects: the technical solution of the present invention effectively solves the problems of long business code transformation time and high intrusion into the native business of the Internet of Things system existing in the prior art solutions by introducing the converter as an intermediate layer, improves the access efficiency, stability and optimization iteration capability of the system, and at the same time enhances the flexibility and scalability of the system, and realizes the standardization of unified authentication and access control. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] The accompanying drawings are used to provide a further understanding of the technical solution of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the technical solution of the present invention and do not constitute a limitation on the technical solution of the present invention.

[0050] Figure 1 A schematic diagram of an implementation environment for single sign-on access provided by an embodiment of the present invention;

[0051] Figure 2 A schematic diagram of a flow chart of a single sign-on access method provided by an embodiment of the present invention;

[0052] Figure 3 A schematic diagram of the interaction process between the adaptive module and the client provided in an embodiment of the present invention;

[0053] Figure 4 A schematic diagram of an extended process of a single sign-on access method provided in an embodiment of the present invention;

[0054] Figure 5 A schematic diagram of an example of an http request parameter mapping table provided in an embodiment of the present invention;

[0055] Figure 6 A schematic diagram of the interaction process between the adaptive module and the server provided in an embodiment of the present invention;

[0056] Figure 7 A schematic diagram of the interaction process between a client and a server based on an adaptive conversion module provided in an embodiment of the present invention;

[0057] Figure 8 A schematic diagram of the basic process of OAuth2.0 provided in an embodiment of the present invention;

[0058] Fig. 9 A schematic diagram of the structure of a single sign-on access device provided by an embodiment of the present invention;

[0059] Fig.10 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0060] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0061] It should be noted that, although the functional modules are divided in the system schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the system or the order in the flowchart. The terms "first / S100", "second / S200", etc. in the specification, claims and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0062] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present invention. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0063] To facilitate the understanding of the technical solution of the present invention, the proprietary technical features that may be applied to the technical solution of the present invention are first explained:

[0064] Single sign-on: It is an identity authentication method that allows users to access multiple mutually trusted application systems or websites through a single login process without having to repeatedly enter login information on each system or website.

[0065] OAuth2.0 (Open Authorization): is an open standard that allows users to authorize third-party applications to access their resources without providing their credentials.

[0066] It is understandable that the single sign-on access method provided in the embodiment of the present invention can be applied to any computer device with data processing and computing capabilities, and this computer device can be various terminals or servers. When the computer device in the embodiment is a server, the server is an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. Optionally, the terminal is a smart phone, a tablet computer, a laptop computer, a desktop computer, etc., but is not limited to this.

[0067] like Figure 1 FIG. 1 is a schematic diagram of an implementation environment provided by an embodiment of the present invention. Figure 1 The implementation environment includes at least one terminal 102 and a server 101. The terminal 102 and the server 101 can be connected to a network wirelessly or wired to complete data transmission and exchange.

[0068] Server 101 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), as well as big data and artificial intelligence platforms.

[0069] In addition, the server 101 can also be a node server in the blockchain network. Blockchain is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, and encryption algorithm.

[0070] The terminal 102 may be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, etc., but is not limited thereto. The terminal 102 and the server 101 may be directly or indirectly connected via wired or wireless communication, which is not limited in the embodiment of the present invention.

[0071] Based on the example Figure 1 In the implementation environment shown, an embodiment of the present invention provides a single sign-on access method. The following is an example of the single sign-on access method being applied in the terminal 102. It can be understood that the single sign-on access method can also be applied in the server 101.

[0072] Reference Figure 2 , Figure 2 The flowchart of the single sign-on access method applied to a terminal provided in an embodiment of the present invention, the execution subject of the single sign-on access method can be any of the aforementioned computer devices (including a server or a terminal). Figure 2 , the method comprises the following steps:

[0073] S100, in response to the request information of the client to the converter, obtaining the request data of the client;

[0074] It should be noted that a standard interface is pre-configured in the converter; in some embodiments, obtaining the request data of the client may include the following steps: obtaining the request data of the client based on the standard interface through the converter; wherein the request data includes a resource authorization request, an access token request and a resource request; the standard interface includes an authorization interface for obtaining resource authorization requests, a token interface for obtaining access token requests and a user information interface for obtaining resource requests.

[0075] For example, in some specific implementations, based on the OAuth2.0 standard protocol, three standard interfaces are constructed in the adaptive module (also called adaptive conversion module / adaptive single sign-on module, i.e., converter), where / oauth / authorize is the authorization interface, / oauth / token is the authorization verification and token issuance interface, and / oauth / userinfo is the token verification and user information return interface. The request line, request header, and request body of each interface are uniformly fixed. The interaction process between the adaptive conversion module (Adapter) and the client (Client) is as follows: Figure 3 As shown, the format of the http request initiated by the client to the converter is constructed according to the agreed standard, and the structure returned by the converter also conforms to the agreed standard and has nothing to do with the unified authentication server that needs to be connected.

[0076] S200, transforming and encapsulating the request data based on a preset format through a converter to obtain a target request;

[0077] It should be noted that, in some embodiments, the request data is transformed and packaged based on a preset format by a converter to obtain a target request, which can include the following steps: based on the format requirements of the http request of the server, the request format of the request data is transformed and packaged by a converter to obtain the target request; wherein the request format includes a request path, a request method and request parameters; the preset format corresponding to the format requirements is pre-configured in the converter.

[0078] In some optional embodiments, such as Figure 4 As shown, the method may also include the following steps: T100, based on the format requirements of the http request of the server, configure the corresponding parameter mapping table in response to the first instruction of the management object; organize the parameter mapping table into a preset format and configure it in the converter; T200, when the format requirements of the server change, based on the changed parameter items, adjust the corresponding configuration items in the parameter mapping table in response to the second instruction of the management object.

[0079] For example, in some specific implementations, a dynamically updated interface request is constructed in the adaptive module, and the http request parameter mapping table is as follows: Figure 5 As shown in the figure, the interaction process between the adaptive module and the server is as follows Figure 6As shown. According to the actual request path, request parameters, return body structure and return parameters of the server interface, configure it to the corresponding configuration items, where userAuthorizationUri is the server authorization address, accessTokenUri is the address for obtaining tokens, userInfoUri is the address for obtaining user information, paramMap is the request parameter mapping, responseMap is the response body path mapping, tokenKey is the token response field name, and openIdKey is the user unique identification field name. When the request format specified by the server changes, only the corresponding items in the adaptive module configuration file need to be modified, without involving the actual processing flow changes in the source code.

[0080] In some specific application scenarios, the client first initiates a request to the converter. After receiving the client's request, the converter transforms the request path, request method, and request parameters, and encapsulates it into an http request that meets the server's requirements.

[0081] S300, sending the target request to the server so that the server performs request verification; when the result of the request verification is passed, the server returns the access control information to the converter;

[0082] It should be noted that the target request includes a target resource authorization request, a target access token request and a target resource request; in some embodiments, request verification may include the following steps: performing resource authorization verification in response to the target resource authorization request; performing identity authentication in response to the target access token request; and performing token verification in response to the target resource request.

[0083] It should also be noted that the target request includes a target resource authorization request, a target access token request and a target resource request; the request verification includes resource authorization verification, identity authentication and token verification; the access control information includes authorization information, token information and resource information; in some embodiments, when the result of the request verification is passed, the access control information is returned to the converter through the server, which may include the following steps: when the result of the resource authorization verification is passed, the authorization information is issued through the server; wherein, the resource authorization verification is performed in response to the target resource authorization request; when the result of the identity authentication is passed, the token information is issued through the server; wherein, the identity authentication is performed in response to the target access token request and the authorization information; when the result of the token verification is passed, the resource information is issued through the server; wherein, the token verification is performed in response to the target resource request and the token information.

[0084] For example, in some specific embodiments, Figure 7As shown, the converter sends the encapsulated http request to the server. After the server passes the verification, it returns the authorization information, token information, resource information, etc. to the converter.

[0085] S400: parsing and transforming the access control information based on a preset data template through a converter to obtain target data; and returning the target data to the client.

[0086] It should be noted that, in some embodiments, parsing and transforming the access control information based on a preset data template by a converter may include the following steps: based on the data structure requirements of the client, parsing and transforming the structure of the access control information by a converter; wherein the preset data template corresponding to the data structure requirements is pre-configured in the converter.

[0087] Exemplarily, in some specific implementations, the converter sends the encapsulated http request to the server, and after verification, the server returns the authorization information, token information, resource information, etc. to the converter; after receiving the data returned by the server, the converter parses and transforms the return body, and returns the information to the client according to the agreed data template.

[0088] Specifically, in different business scenarios, when the information on the server changes, the client can adapt seamlessly by modifying the relevant configuration of the conversion module without changing the interaction process.

[0089] In order to explain the principle of the technical solution of the present invention in detail, the overall process of the present invention is described below in combination with some specific embodiments. It is easy to understand that the following is an explanation of the technical principle of the present invention and cannot be regarded as a limitation of the present invention.

[0090] First of all, it should be noted that in view of the shortcomings of the prior art, the present invention constructs an adaptive single sign-on module (also called an adaptive module, i.e., a converter), which automatically adapts the interaction process between the client and the server when the Internet of Things system is connected to the unified identity authentication center of different business terminals as a third-party application, and can automatically adapt without changing the client business logic. The principle logic of the technical solution of the present invention can be implemented as follows:

[0091] The adaptive single sign-on access system and method for multi-business systems mainly includes three parts:

[0092] 1. For the unified authentication server, rely on the yml configuration file to build dynamically updated interface request path, request method, and request parameters.

[0093] 2. For third-party applications, a standard single sign-on interface is output based on the Oauth2.0 standard protocol, which does not change with the application scenario.

[0094] 3. The adaptive single sign-on module acts as an intermediate converter to handle the interaction process between the third-party application and the unified authentication server.

[0095] 1. Build a dynamically updated interface request in the adaptive conversion module:

[0096] HTTP, or Hypertext Transfer Protocol, is a response protocol for communication between clients and servers. It is used as a request between clients and servers. A complete HTTP request includes: request line, request header and request body. The request method, request path, request header and request body in the request line usually change with the changes of the unified authentication server system.

[0097] (1) The basic process of OAuth2.0 is as follows Figure 8 As shown in the figure, the client requests resource authorization from the server, and the resource owner returns the authorization; the client presents the authorization to the server, and the authorization server authenticates the client and issues an access token if the authentication is successful; the client initiates token authentication to the server, and the resource server verifies the access token and returns the requested resource if the authentication is successful. In the application scenario of the IoT system, the requested resource is generally the user identity information.

[0098] (2) In the adaptive module, a dynamically updated interface request is constructed, and the http request parameter mapping table is as follows: Figure 5 As shown in the figure, the interaction process between the adaptive module and the server is as follows Figure 6 As shown. According to the actual request path, request parameters, return body structure and return parameters of the server interface, configure it to the corresponding configuration items, where userAuthorizationUri is the server authorization address, accessTokenUri is the address for obtaining tokens, userInfoUri is the address for obtaining user information, paramMap is the request parameter mapping, responseMap is the response body path mapping, tokenKey is the token response field name, and openIdKey is the user unique identification field name. When the request format specified by the server changes, only the corresponding items in the adaptive module configuration file need to be modified, without involving the actual processing flow changes in the source code.

[0099] 2. Output standard single sign-on interface based on OAuth2.0 standard protocol:

[0100] Based on the OAuth2.0 standard protocol, three standard interfaces are built in the adaptive module, of which / oauth / authorize is the authorization interface, / oauth / token is the authorization verification and token issuance interface, and / oauth / userinfo is the token verification and user information return interface. The request line, request header, and request body of each interface are fixed. The interaction process between the adaptive conversion module (Adapter) and the client (Client) is as follows: Figure 3 As shown, the format of the http request initiated by the client to the converter is constructed according to the agreed standard, and the structure returned by the converter also conforms to the agreed standard and has nothing to do with the unified authentication server that needs to be connected.

[0101] 3. The client-server interaction process based on the adaptive conversion module:

[0102] When the client and server interact based on the OAuth2.0 protocol, the conversion is performed through the adaptive module. The specific process is as follows: Figure 7 As shown:

[0103] (1) The client first initiates a request to the converter. After receiving the client's request, the converter transforms the request path, request method, and request parameters, and encapsulates it into an HTTP request that meets the server's requirements.

[0104] (2) The converter sends the encapsulated http request to the server. After verification, the server returns the authorization information, token information, resource information, etc. to the converter.

[0105] (3) After receiving the data returned by the server, the converter parses and transforms the returned data and returns the information to the client according to the agreed data template.

[0106] (4) In different business scenarios, when the information on the server changes, the client can adapt seamlessly by modifying the relevant configuration of the conversion module without changing the interaction process.

[0107] In summary, the present invention adapts the interaction process between the client and the server in the single sign-on scenario by constructing an adaptive converter. Moreover, in the adaptive converter, the configuration file is relied on to dynamically construct the http request without modifying the source code and the service function itself. At the same time, when the access standard of the server changes, it can be realized by updating the configuration of the converter, without changing the client system's own business, to achieve a senseless update. The advantages of the technical solution of the present invention compared with the existing solution include:

[0108] 1. Build an adaptive converter to adapt the server interfaces of different business systems. Adaptation can be achieved only by updating the configuration files, which is convenient and fast.

[0109] 2. Indirect interaction between the client and the server is carried out through the adaptive conversion module, avoiding the risk of directly modifying the IoT client and not affecting the business of the system itself.

[0110] 3. When connecting to multiple server systems at the same time, they can be uniformly adapted in the conversion module, without any intrusion or modification cost for the IoT client.

[0111] Compared with the prior art, the present invention has at least the following beneficial effects:

[0112] Reduce the time and cost of business code transformation: Based on the technical solution of the present invention, when the IoT system is connected to different business systems as a third-party application, there is no need to directly perform complex business code transformation according to the interface provided by the authentication server. By introducing a converter, the IoT system only needs to send the request information to the converter, and the converter will transform and encapsulate the request data according to the preset format. This method greatly reduces the time and cost of business code transformation and improves access efficiency.

[0113] Reduce the intrusiveness to the native services of the IoT system: The technical solution of the present invention realizes the unified authentication system access of different business systems through the converter, without directly modifying the IoT client. As an intermediate layer, the converter undertakes the task of modifying and encapsulating the request data and parsing and modifying the access control information, thereby reducing the intrusiveness to the native services of the IoT system. This helps to maintain the stability and optimization iteration capabilities of the IoT system, and avoids potential risks that may be introduced by modifying the native service code.

[0114] Improve system flexibility and scalability: Since the converter works based on preset formats and data templates, it can be easily adjusted and expanded according to business needs. When you need to connect to a new business system or modify the authentication process of an existing business system, you only need to update the preset format and data template of the converter, without having to make large-scale changes to the IoT system. This improves the flexibility and scalability of the system and reduces maintenance costs.

[0115] Achieve unified authentication and access control standardization: The converter uniformly transforms and analyzes request data and access control information, and the technical solution of the present invention achieves unified authentication and access control standardization between different business systems. This helps to improve the security and reliability of the system and reduce the security risks that may be caused by inconsistent authentication processes.

[0116] To sum up, the technical solution of the present invention effectively solves the problems existing in the prior art solutions, such as long business code transformation time and high intrusion into the native business of the Internet of Things system, by introducing the converter as the intermediate layer. It improves the access efficiency, stability and optimization iteration capability of the system, while enhancing the flexibility and scalability of the system, and realizes the standardization of unified authentication and access control.

[0117] On the other hand, Fig. 9 As shown, an embodiment of the present invention provides a single sign-on access device 900, which may include:

[0118] The first module 901 is used to obtain the client's request data in response to the client's request information to the converter;

[0119] The second module 902 is used to transform and encapsulate the request data based on a preset format through a converter to obtain a target request;

[0120] The third module 903 is used to send the target request to the server so that the server can verify the request; when the result of the request verification is that the verification is passed, the access control information is returned to the converter through the server;

[0121] The fourth module 904 is used to parse and transform the access control information based on a preset data template through a converter to obtain target data; and return the target data to the client.

[0122] Optionally, the device may further include:

[0123] The fifth module is used to configure a corresponding parameter mapping table in response to the first instruction of the management object based on the format requirement of the http request of the server; and to organize the parameter mapping table into a preset format and configure it in the converter;

[0124] The sixth module is used to adjust the corresponding configuration item in the parameter mapping table in response to the second instruction of the management object based on the changed parameter item when the format requirement of the server changes.

[0125] The contents of the method embodiments of the present invention are all applicable to the device embodiments. The functions specifically implemented by the device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0126] On the other hand, an embodiment of the present invention further provides an electronic device, the electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the above sensitive information method when executing the computer program. The electronic device can be any intelligent terminal including a tablet computer, a car computer, etc.

[0127] It can be understood that the contents of the above method embodiments are all applicable to the present device embodiments, the functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0128] like Fig.10 As shown, Fig.10 A specific example of the hardware structure of an electronic device 1000 according to an embodiment is shown. The electronic device 1000 includes:

[0129] The processor 1001 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present invention.

[0130] The memory 1002 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 1002 can store an operating system and other application programs. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 1002, and the processor 1001 calls and executes the network node population optimization method of the embodiment of the present invention;

[0131] Input / output interface 1003, used to implement information input and output;

[0132] The communication interface 1004 is used to realize the communication interaction between the device and other devices. The communication can be realized through a wired manner (such as USB, network cable, etc.) or a wireless manner (such as mobile network, WIFI, Bluetooth, etc.);

[0133] A bus 1005 , which transmits information between various components of the device (e.g., the processor 1001 , the memory 1002 , the input / output interface 1003 , and the communication interface 1004 );

[0134] The processor 1001 , the memory 1002 , the input / output interface 1003 and the communication interface 1004 are connected to each other in communication within the device via the bus 1005 .

[0135] The electronic device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0136] The contents of the method embodiments of the present invention are all applicable to the electronic device embodiments. The functions specifically implemented by the electronic device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0137] Another aspect of an embodiment of the present invention further provides a computer-readable storage medium, wherein the storage medium stores a program, and the program is executed by a processor to implement the above method.

[0138] It should be noted that the computer-readable medium shown in the embodiment of the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (Compact Disc Read to Only Memory, CD to ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer readable signal media may also be any computer readable medium other than computer readable storage media, which may send, propagate, or transmit programs for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0139] The contents of the method embodiments of the present invention are all applicable to the computer-readable storage medium embodiments. The functions specifically implemented by the computer-readable storage medium embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0140] The embodiment of the present invention also discloses a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. A processor of a computer device can read the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the above method.

[0141] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0142] It should be noted that, although several modules of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to an embodiment of the present invention, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into being embodied by multiple modules or units.

[0143] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present invention can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD to ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a touch terminal, or a network device, etc.) to execute the method according to the implementation of the present invention.

[0144] In some selectable embodiments, the function / operation mentioned in the block diagram may not occur in the order mentioned in the operation diagram. For example, depending on the function / operation involved, the two boxes shown in succession can actually be executed substantially simultaneously or the boxes can sometimes be executed in reverse order. In addition, the embodiment presented and described in the flow chart of the present invention is provided by way of example, for the purpose of providing a more comprehensive understanding of technology. The disclosed method is not limited to the operation and logic flow presented herein. Selectable embodiments are expected, wherein the order of various operations is changed and the sub-operation of a part for which is described as a larger operation is performed independently.

[0145] In addition, although the present invention is described in the context of functional modules, it should be understood that, unless otherwise specified, one or more of the functions and / or features can be integrated into a single physical device and / or software module, or one or more functions and / or features can be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the present invention. More specifically, in view of the properties, functions and internal relationships of the various functional modules in the device disclosed herein, the actual implementation of the module will be understood within the conventional skills of the engineer. Therefore, those skilled in the art can implement the present invention set forth in the claims without excessive experimentation using ordinary techniques. It is also understood that the specific concepts disclosed are merely illustrative and are not intended to limit the scope of the present invention, which is determined by the full scope of the appended claims and their equivalents.

[0146] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the present invention, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0147] The logic and / or steps represented in the flowchart or otherwise described herein, for example, may be considered as an ordered list of executable instructions for implementing logical functions, and may be embodied in any computer-readable medium for use by an instruction execution device, apparatus or device (such as a computer-based device, a device including a processor, or other device that can fetch instructions from an instruction execution device, apparatus or device and execute the instructions), or in conjunction with such instruction execution device, apparatus or device. For purposes of this specification, "computer-readable medium" may be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution device, apparatus or device, or in conjunction with such instruction execution device, apparatus or device.

[0148] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0149] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution device. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0150] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0151] Although the embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the claims and their equivalents.

[0152] The above is a specific description of the preferred implementation of the present invention, but the present invention is not limited to the embodiments. Those skilled in the art can make various equivalent modifications or substitutions without violating the spirit of the present invention. These equivalent modifications or substitutions are all included in the scope defined by the claims of the present invention.

Claims

1. A single sign-on access method, characterized in that: The following steps are involved: In response to a request from a client to a converter, obtaining request data from the client; The converter transforms and encapsulates the request data based on a preset format to obtain a target request; Sending the target request to the server so that the server performs request verification; When the result of the request verification is that the verification is passed, the access control information is returned to the converter through the server; The access control information is parsed and transformed by the converter based on a preset data template to obtain target data; and the target data is returned to the client.

2. The single sign-on access method according to claim 1, characterized in that: The converter is pre-configured with a standard interface; the step of obtaining the request data of the client comprises the following steps: Acquiring the request data of the client based on the standard interface through the converter; Among them, the request data includes resource authorization request, access token request and resource request; the standard interface includes an authorization interface for obtaining the resource authorization request, a token interface for obtaining the access token request and a user information interface for obtaining the resource request.

3. The single sign-on access method according to claim 1, characterized in that: The step of transforming and packaging the request data based on a preset format by the converter to obtain a target request includes the following steps: Based on the format requirements of the http request of the server, the request format of the request data is transformed and encapsulated by the converter to obtain the target request; The request format includes a request path, a request method and a request parameter; and the preset format corresponding to the format requirement is pre-configured in the converter.

4. The single sign-on access method according to claim 3, characterized in that: The method further comprises the following steps: Based on the format requirements of the http request of the server, in response to the first instruction of the management object, configure a corresponding parameter mapping table; organize the parameter mapping table into the preset format and configure it in the converter; When the format requirement of the server changes, based on the changed parameter item, the corresponding configuration item in the parameter mapping table is adjusted in response to the second instruction of the management object.

5. The single sign-on access method according to claim 1, characterized in that: The target request includes a target resource authorization request, a target access token request and a target resource request; the request verification includes the following steps: Performing resource authorization verification in response to the target resource authorization request; Performing identity authentication in response to the target access token request; A token verification is performed in response to the target resource request.

6. The single sign-on access method according to claim 1, characterized in that: The target request includes a target resource authorization request, a target access token request and a target resource request; the request verification includes resource authorization verification, identity authentication and token verification; The access control information includes authorization information, token information and resource information; when the result of the request verification is that the verification is passed, the access control information is returned to the converter through the server, including the following steps: When the result of the resource authorization verification is that the verification is passed, the authorization information is sent through the server; Wherein, the resource authorization verification is performed in response to the target resource authorization request; When the result of the identity authentication is verified, the token information is issued by the server; wherein the identity authentication is performed in response to the target access token request and the authorization information; When the result of the token verification is that the verification is passed, the resource information is sent through the server; The token verification is performed in response to the target resource request and the token information.

7. The single sign-on access method according to claim 1, characterized in that: The step of parsing and transforming the access control information based on a preset data template by the converter comprises the following steps: Based on the data structure requirements of the client, the structure of the access control information is parsed and transformed by the converter; Wherein, the preset data template corresponding to the data structure requirement is pre-configured in the converter.

8. A single sign-on access device, characterized in that: include: The first module is used to obtain the request data of the client in response to the request information of the client to the converter; The second module is used to transform and encapsulate the request data based on a preset format through the converter to obtain a target request; The third module is used to send the target request to the server so that the server can verify the request; When the result of the request verification is that the verification is passed, the access control information is returned to the converter through the server; The fourth module is used to parse and transform the access control information based on a preset data template through the converter to obtain target data; and return the target data to the client.

9. An electronic device, characterized in that: including a processor and a memory; The memory is used to store programs; The processor executes the program to implement the method according to any one of claims 1 to 7.

10. A computer storage medium storing a program executable by a processor, characterized in that: The program executable by the processor is used to implement the method according to any one of claims 1 to 7 when executed by the processor.

Images