A single sign-on access method and device, electronic equipment and storage medium

Abstract

The application discloses a single sign-on access method and device, electronic equipment and storage medium, the method comprises the following steps: in response to the request information of the client to the converter, obtaining the request data of the client; the request data is reformed and packaged based on the preset format through the converter, and the target request is obtained; the target request is sent to the server, so that the server performs request verification; when the result of request verification is passed, the access control information is returned to the converter through the server; the access control information is analyzed and reformed based on the preset data template through the converter, and the target data is obtained; the target data is returned to the client. The technical scheme of the application introduces the converter as an intermediate layer, effectively solves the problems of long business code reform time and large invasiveness to the original business of the Internet of Things system in the prior art, realizes the standardization of unified authentication and access control, and can be widely applied to the technical field of data processing.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, and in particular to a single sign-on access method and device, electronic equipment and storage medium. BACKGROUND

[0002] The OAuth2.0 single sign-on protocol is the most commonly used secure and standardized authorization mechanism in the Internet of Things system.

[0003] The principle logic in the specific application scenario is as follows:

[0004] 1. In the OAuth2.0 single sign-on standard protocol, the interaction process between the user and the authorization server is fixed, and usually includes user login, token issuance, access service and token refresh processes, which correspond to different interfaces, and the request path, request method and request parameters of the interface are fixed templates. In the actual application process, the unified authentication center, i.e. the server, will repackage the standard interface according to the needs of the business scenario, including but not limited to the request path, request method and request parameters.

[0005] 2. When the third-party application accesses the unified authentication center as a client, the multiple interfaces provided by different authentication servers will have great differences from the standard interfaces, and a fixed processing flow cannot be used to adapt, and the source code needs to be modified according to the specific interface request method and request parameters, which has a large impact on the client business and takes a long time.

[0006] The existing technical solutions for single sign-on access have the following disadvantages:

[0007] 1. When the Internet of Things system accesses different business systems as a third-party application, the business code needs to be modified according to the interfaces provided by the authentication server, which takes a long time.

[0008] 2. The access of the unified authentication system of different business systems to the Internet of Things system itself has low relevance to the business, and directly modifying the Internet of Things client has a large invasion on the original business, which is not conducive to the stability and optimization iteration of the system. SUMMARY

[0009] The present application provides a single sign-on access method, device, electronic equipment and storage medium, which aims to at least solve one of the technical problems in the related art, and the embodiments of the present application can conveniently realize single sign-on access.

[0010] In one aspect, the present application provides a single sign-on access method, comprising:

[0011] In response to the request information of the client to the converter, the request data of the client is obtained;

[0012] The request data is encapsulated by the converter based on a preset format to obtain a target request;

[0013] The target request is sent to the server to enable the server to perform request verification; when the result of the request verification is that the verification is passed, the access control information is returned to the converter by the server;

[0014] The access control information is parsed and transformed by the converter based on a preset data template to obtain target data; and the target data is returned to the client.

[0015] Optionally, a standard interface is pre-configured in the converter; the request data of the client is obtained, including the following steps:

[0016] The request data of the client is obtained by the converter based on the standard interface;

[0017] The request data includes a resource authorization request, an access token request, and a resource request; the standard interface includes an authorization interface for obtaining the resource authorization request, a token interface for obtaining the access token request, and a user information interface for obtaining the resource request.

[0018] Optionally, the request data is encapsulated by the converter based on a preset format to obtain a target request, including the following steps:

[0019] The request format of the request data is encapsulated by the converter based on the format requirement of the http request of the server to obtain a target request;

[0020] The request format includes a request path, a request method, and a request parameter; the preset format corresponding to the format requirement is pre-configured in the converter.

[0021] Optionally, the method further includes the following steps:

[0022] Based on the format requirement of the http request of the server, the corresponding parameter mapping table is configured in response to the first instruction of the management object; and the parameter mapping table is arranged into a preset format and configured into the converter;

[0023] When the format requirement of the server changes, the corresponding configuration item in the parameter mapping table is adjusted in response to the second instruction of the management object based on the changed parameter item.

[0024] Optionally, the target request includes a target resource authorization request, a target access token request, and a target resource request; the request verification includes the following steps:

[0025] Resource authorization verification is performed in response to the target resource authorization request;

[0026] Identity authentication is performed in response to the target access token request;

[0027] The token verification is performed in response to the target resource request.

[0028] Optionally, the target request comprises a target resource authorization request, a target access token request and a target resource request; the request verification comprises resource authorization verification, identity authentication and token verification; the access control information comprises authorization information, token information and resource information; when the result of the request verification is passed, the access control information is returned to the converter by the server; the method comprises the following steps:

[0029] When the result of the resource authorization verification is passed, the authorization information is sent by the server;

[0030] The resource authorization verification is performed in response to the target resource authorization request.

[0031] When the result of the identity authentication is passed, the token information is sent by the server;

[0032] The identity authentication is performed in response to the target access token request and the authorization information.

[0033] When the result of the token verification is passed, the resource information is sent by the server;

[0034] The token verification is performed in response to the target resource request and the token information.

[0035] Optionally, the access control information is parsed and reformed by the converter based on a preset data template, and the method comprises the following steps:

[0036] The structure of the access control information is parsed and reformed by the converter based on the data structure requirement of the client;

[0037] The preset data template corresponding to the data structure requirement is preconfigured in the converter.

[0038] In another aspect, the embodiment of the present application provides a single sign-on access device, which comprises:

[0039] A first module is configured to obtain request data of a client in response to request information of the client to a converter;

[0040] A second module is configured to reform and encapsulate the request data based on a preset format by the converter to obtain a target request;

[0041] A third module is configured to send the target request to a server, so that the server performs request verification; when the result of the request verification is passed, access control information is returned to the converter by the server.

[0042] The fourth module is configured to parse and transform the access control information based on a preset data template by the converter to obtain target data, and return the target data to the client.

[0043] Optionally, the apparatus further comprises:

[0044] The fifth module is configured to configure a corresponding parameter mapping table in response to the first instruction of the management object based on the format requirement of the HTTP request of the server, and arrange the parameter mapping table into a preset format and configure the same into the converter.

[0045] The sixth module is configured to adjust the corresponding configuration item in the parameter mapping table in response to the second instruction of the management object based on the changed parameter item when the format requirement of the server changes.

[0046] In another aspect, an electronic device is provided, comprising a processor and a memory, the memory is configured to store a program, and the processor is configured to execute the program to implement the single sign-on access method.

[0047] In another aspect, a computer storage medium is provided, wherein the computer storage medium stores a program executable by a processor, and the program executable by the processor is configured to implement the single sign-on access method when executed by the processor.

[0048] The embodiment of the present application obtains the request data of the client in response to the request information of the client to the converter, performs transformation and packaging on the request data based on a preset format by the converter to obtain target request, sends the target request to the server to enable the server to perform request verification, returns the access control information to the converter by the server when the result of the request verification is passed, performs parsing and transformation on the access control information based on a preset data template by the converter to obtain target data, and returns the target data to the client. The present application has the following beneficial effects: the technical scheme of the present application introduces a converter as an intermediate layer, effectively solves the problems of long business code transformation time, large invasiveness to the original business of the Internet of Things system, and the like in the prior art, improves the access efficiency, stability and optimization iteration capability of the system, enhances the flexibility and scalability of the system, and realizes the standardization of unified authentication and access control. BRIEF DESCRIPTION OF DRAWINGS

[0049] The accompanying drawings are used to provide a further understanding of the technical scheme of the present application, and constitute a part of the specification, and are used to explain the technical scheme of the present application together with the embodiments of the present application, and do not constitute a limitation on the technical scheme of the present application.

[0050] Figure 1 An implementation environment schematic diagram for performing single sign-on access is provided for the embodiment of the present application.

[0051] Figure 2 A flowchart of a single sign-on access method provided by an embodiment of the present application is shown in FIG. 1.

[0052] Figure 3 An interaction flowchart of an adaptive module and a client provided by an embodiment of the present application is shown in FIG. 2.

[0053] Figure 4 An extended flowchart of a single sign-on access method provided by an embodiment of the present application is shown in FIG. 3.

[0054] Figure 5 An example of a mapping of an HTTP request parameter provided by an embodiment of the present application is shown in FIG. 4.

[0055] Figure 6 An interaction flowchart of an adaptive module and a server provided by an embodiment of the present application is shown in FIG. 5.

[0056] Figure 7 An interaction flowchart of a client and a server based on an adaptive conversion module provided by an embodiment of the present application is shown in FIG. 6.

[0057] Figure 8 A basic flowchart of OAuth2.0 provided by an embodiment of the present application is shown in FIG. 7.

[0058] Figure 9 A structural diagram of a single sign-on access device provided by an embodiment of the present application is shown in FIG. 8.

[0059] Figure 10 A structural diagram of an electronic device provided by an embodiment of the present application is shown in FIG. 9. DETAILED DESCRIPTION

[0060] In order to make the objectives, technical solutions and advantages of the present application clearer, the present application is further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and should not be used to limit the present application.

[0061] It should be noted that although the functional modules are divided in the system diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in a different order from the module division in the system or the order in the flowchart. The terms "first / S100", "second / S200", etc. in the description, claims and above-mentioned drawings are used to distinguish similar objects and do not necessarily describe a specific order or sequence.

[0062] Reference to“an embodiment” herein means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the application. The appearances of the phrase“in one embodiment” in various places in the specification are not necessarily all referring to the same embodiment, nor are they necessarily all referring to a common set of embodiments, of the application, differing embodiments can be described.

[0063] For the purpose of understanding the technical scheme of the present application, the technical features of the present application are first explained:

[0064] Single sign-on: an identity authentication method that allows users to access multiple mutually trusted application systems or websites through a single login process without having to repeatedly enter login information on each system or website.

[0065] OAuth2.0 (Open Authorization, Open Authorization Protocol): an open standard that allows users to authorize third-party applications to access their resources without providing their credentials.

[0066] It can be understood that the single sign-on access method provided by the embodiments of the present application can be applied to any computer device with data processing and computing capabilities, and such computer device can be various terminals or servers. When the computer device in the embodiments is a server, the server is an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and basic cloud computing services such as big data and artificial intelligence platforms. Alternatively, the terminal is a smartphone, tablet computer, notebook computer, desktop computer, etc., but is not limited thereto.

[0067] As shown in Figure 1 , it is an implementation environment schematic diagram provided by the embodiments of the present application. Referring to Figure 1 , the implementation environment includes at least one terminal 102 and a server 101. The terminal 102 and the server 101 can be connected through wireless or wired means for network connection to complete data transmission and exchange.

[0068] Server 101 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), as well as big data and artificial intelligence platforms.

[0069] In addition, server 101 can also be a node server in a blockchain network. Blockchain is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, and encryption algorithm.

[0070] The terminal 102 may be a smart phone, tablet computer, laptop computer, desktop computer, smart speaker, smart watch, etc., but is not limited thereto. The terminal 102 and the server 101 may be connected directly or indirectly via wired or wireless communication, which is not limited in this embodiment of the present invention.

[0071] Based on the example Figure 1 In the implementation environment shown, an embodiment of the present invention provides a single sign-on access method. The following is an example of the single sign-on access method being applied to the terminal 102. It can be understood that the single sign-on access method can also be applied to the server 101.

[0072] Reference Figure 2 , Figure 2 This is a flowchart of a single sign-on access method for a terminal provided in an embodiment of the present invention. The execution subject of the single sign-on access method can be any of the aforementioned computer devices (including servers or terminals). Figure 2 , the method comprises the following steps:

[0073] S100, in response to a request from a client to a converter, obtaining request data from the client;

[0074] It should be noted that a standard interface is pre-configured in the converter; in some embodiments, obtaining the client's request data may include the following steps: obtaining the client's request data based on the standard interface through the converter; wherein the request data includes resource authorization requests, access token requests and resource requests; the standard interface includes an authorization interface for obtaining resource authorization requests, a token interface for obtaining access token requests and a user information interface for obtaining resource requests.

[0075] Exemplarily, in some specific embodiments, based on the OAuth2.0 standard protocol, three standard interfaces are constructed in the adaptive module (also called adaptive conversion module / adaptive single sign-on module, i.e., the converter), wherein / oauth / authorize is an authorization interface, / oauth / token is an authentication authorization and token issuance interface, and / oauth / userinfo is an authentication token and user information return interface. The request line, request header and request body of each interface are uniformly fixed. The interaction process of the adaptive conversion module (Adapter) and the client (Client) is as shown in Figure 3 The http request format initiated by the client to the converter is constructed according to the agreed standard, and the structure returned by the converter also conforms to the agreed standard, and is independent of the unified authentication server to be connected.

[0076] S200, the request data is reformed and packaged based on the preset format through the converter to obtain a target request;

[0077] It should be noted that in some embodiments, the request data is reformed and packaged based on the preset format through the converter to obtain a target request, which can include the following steps: based on the format requirement of the http request of the server, the request format of the request data is reformed and packaged through the converter to obtain a target request; wherein the request format includes request path, request method and request parameter; the preset format corresponding to the format requirement is pre-configured in the converter.

[0078] In some optional embodiments, as shown in Figure 4 The method can further include the following steps: T100, based on the format requirement of the http request of the server, the corresponding parameter mapping table is configured in response to the first instruction of the management object; the parameter mapping table is arranged into a preset format and configured into the converter; T200, when the format requirement of the server changes, the corresponding configuration item in the parameter mapping table is adjusted in response to the second instruction of the management object based on the changed parameter item.

[0079] Exemplarily, in some specific embodiments, a dynamically updated interface request is constructed in the adaptive module, and the http request parameter mapping table is as shown in Figure 5 The interaction process of the adaptive module and the server is as shown in Figure 6According to the actual request path, request parameter, return body structure and return parameter of the service end interface, it is configured into the corresponding configuration item, wherein the userAuthorizationUri is the service end authorization address, the accessTokenUri is the token acquisition address, the userInfoUri is the user information acquisition address, the paramMap is the request parameter mapping, the responseMap is the response body path mapping, the tokenKey is the token response field name, and the openIdKey is the user unique identifier field name. When the request format specified by the service end changes, only the corresponding item in the adaptive module configuration file needs to be modified, and the actual processing flow change in the source code is not involved.

[0080] In some specific application scenarios, the client first initiates a request to the converter, and the converter reforms the request path, request method and request parameter after receiving the request of the client, and encapsulates it into an http request conforming to the requirements of the service end.

[0081] S300, sending a target request to the service end to make the service end perform request verification; when the result of the request verification is passed, returning access control information to the converter through the service end;

[0082] It should be noted that the target request includes a target resource authorization request, a target access token request and a target resource request; in some embodiments, the request verification can include the following steps: performing resource authorization verification in response to the target resource authorization request; performing identity authentication in response to the target access token request; and performing token verification in response to the target resource request.

[0083] It should be further noted that the target request includes a target resource authorization request, a target access token request and a target resource request; the request verification includes resource authorization verification, identity authentication and token verification; the access control information includes authorization information, token information and resource information; in some embodiments, when the result of the request verification is passed, returning access control information to the converter through the service end can include the following steps: when the result of the resource authorization verification is passed, issuing authorization information through the service end; wherein the resource authorization verification is performed in response to the target resource authorization request; when the result of the identity authentication is passed, issuing token information through the service end; wherein the identity authentication is performed in response to the target access token request and the authorization information; when the result of the token verification is passed, issuing resource information through the service end; wherein the token verification is performed in response to the target resource request and the token information.

[0084] Exemplarily, in some specific embodiments, as Figure 7As shown, the converter sends the packaged http request to the service end, and the service end returns authorization information, token information and resource information to the converter after verification.

[0085] S400, the target data is obtained by parsing and transforming the access control information based on the preset data template through the converter, and the target data is returned to the client.

[0086] It should be noted that in some embodiments, the parsing and transformation of the access control information based on the preset data template through the converter can include the following steps: based on the data structure requirement of the client, the structure of the access control information is parsed and transformed through the converter; wherein the preset data template corresponding to the data structure requirement is pre-configured in the converter.

[0087] Exemplarily, in some specific embodiments, the converter sends the packaged http request to the service end, and the service end returns authorization information, token information and resource information to the converter after verification; the converter parses and transforms the return body after receiving the data returned by the service end, and returns the information to the client according to the agreed data template.

[0088] Specifically, in different business scenarios, when the information of the service end changes, the client can be adapted without changing the interaction process by modifying the related configuration of the conversion module.

[0089] To explain the principle of the technical scheme of the present application, the overall process of the present application will be described in conjunction with some specific embodiments. It should be understood that the following is an explanation of the technical principle of the present application and cannot be regarded as a limitation of the present application.

[0090] First of all, it should be noted that in view of the shortcomings of the prior art, the present application constructs an adaptive single sign-on module (also called adaptive module, i.e. converter), which automatically adapts the interaction process between the client and the service end when the Internet of Things system accesses different business ends as a third-party application to the unified identity authentication center, without changing the business logic of the client. The principle of the technical scheme of the present application can be realized as follows:

[0091] The adaptive single sign-on access system and method for multiple business systems mainly include three parts of work:

[0092] 1. For the unified authentication service end, the dynamic update interface request path, request method and request parameter are constructed depending on the yml configuration file.

[0093] 2. For the third-party application end, the standard single sign-on interface is output based on the Oauth2.0 standard protocol, which does not change with the application scene.

[0094] 3. The adaptive single sign-on module acts as an intermediate converter, processing the interaction process between the third-party application end and the unified authentication server end.

[0095] 1. Build a dynamically updated interface request in the adaptive conversion module:

[0096] HTTP, Hypertext Transfer Protocol, is a response protocol that realizes communication between the client and the server, and is used as a request between the client and the server. A complete HTTP request includes: request line, request header and request body, wherein the request method, request path, request header and request body in the request line will change with the change of the unified authentication server system.

[0097] (1) The basic process of OAuth2.0 is shown in Figure 8 , the client requests resource authorization from the server, the resource owner returns the authorization; the client presents the authorization to the server, the authorization server authenticates the client, and issues an access token if the authentication is passed; the client initiates token verification to the server, and the resource server verifies the access token and returns the requested resource if the verification is passed. In the application scenario of the Internet of Things system, the requested resource is generally user identity information.

[0098] (2) Build a dynamically updated interface request in the adaptive module, and the http request parameter mapping table is shown in Figure 5 , the adaptive module and the server interaction process is shown in Figure 6 . According to the actual request path, request parameter, response body structure and return parameter of the server interface, it is configured into the corresponding configuration item, wherein userAuthorizationUri is the server authorization address, accessTokenUri is the token address, userInfoUri is the user information address, paramMap is the request parameter mapping, responseMap is the response body path mapping, tokenKey is the token response field name, and openIdKey is the user unique identifier field name. When the request format specified by the server changes, only the corresponding item in the adaptive module configuration file needs to be modified, without changing the actual processing flow in the source code.

[0099] 2. Output a standard single sign-on interface based on the OAuth2.0 standard protocol:

[0100] Based on the OAuth2.0 standard protocol, three standard interfaces are constructed in the adaptive module, wherein / oauth / authorize is an authorization interface, / oauth / token is a token interface for verifying authorization and issuing tokens, and / oauth / userinfo is an interface for verifying tokens and returning user information. The request line, request header and request body of each interface are uniformly fixed, and the interaction process between the adaptive conversion module (Adapter) and the client (Client) is as shown in Figure 3 The structure returned by the converter also conforms to the agreed standard and is independent of the unified authentication server to be connected.

[0101] 3. The interaction process between the client and the server based on the adaptive conversion module:

[0102] When the client and the server interact based on the OAuth2.0 protocol, conversion is performed through the adaptive module, and the specific process is as shown in Figure 7

[0103] (1) The client first initiates a request to the converter, and the converter reforms the request path, request method and request parameters after receiving the request of the client, and encapsulates the http request into a request that meets the requirements of the server.

[0104] (2) The converter sends the encapsulated http request to the server, and the server returns authorization information, token information and resource information to the converter after verification.

[0105] (3) The converter parses and reforms the return body after receiving the data returned by the server, and returns the information to the client according to the agreed data template.

[0106] (4) When the information of the server changes in different business scenarios, the client can be adapted without changing the interaction process by modifying the related configurations of the conversion module.

[0107] In summary, the adaptive converter is constructed to adapt the interaction process between the client and the server in the single sign-on scenario. In the adaptive converter, the http request is dynamically constructed by relying on the configuration file, and the source code and the function of the service do not need to be modified. At the same time, when the standard of the server side is changed, the configuration of the converter can be updated without changing the business of the client system itself. The advantages of the technical scheme of the present application compared with the existing scheme include:

[0108] 1. The adaptive converter is constructed to adapt the server interface of different business systems, and the adaptive conversion is realized only by updating the configuration file, which is convenient and fast.​

[0109] 2. Through the adaptive conversion module, indirect interaction is carried out between the client and the server, avoiding the risk of directly modifying the IoT client and not affecting the business of the system itself.

[0110] 3. When connecting to multiple server systems at the same time, unified adaptation can be performed in the conversion module, without intrusion or modification costs for the IoT client.

[0111] Compared with the prior art, the present invention has at least the following beneficial effects:

[0112] Reducing the time and cost of business code modification: Based on the technical solution of this invention, when an IoT system, acting as a third-party application, accesses different business systems, it no longer needs to perform complex business code modification directly according to the interface provided by the authentication server. By introducing a converter, the IoT system only needs to send the request information to the converter, which then transforms and encapsulates the request data according to a preset format. This approach significantly reduces the time and cost of business code modification and improves access efficiency.

[0113] Reduced intrusion into native IoT system services: The present invention's technical solution enables unified authentication system access for diverse business systems through a converter, eliminating the need for direct IoT client modifications. Acting as an intermediary, the converter handles the transformation and encapsulation of request data and the parsing and modification of access control information, thereby reducing intrusion into native IoT system services. This helps maintain IoT system stability and optimization and iteration capabilities, avoiding potential risks introduced by modifying native service code.

[0114] Improved system flexibility and scalability: Because the converter operates based on preset formats and data templates, it can be easily adjusted and expanded according to business needs. When integrating new business systems or modifying the authentication process of existing ones, simply update the converter's preset formats and data templates, eliminating the need for large-scale modifications to the IoT system. This improves system flexibility and scalability while reducing maintenance costs.

[0115] Standardized authentication and access control: By using a converter to uniformly transform and parse request data and access control information, the present invention achieves standardized authentication and access control across different business systems. This helps improve system security and reliability, and reduces security risks that may arise from inconsistent authentication processes.

[0116] In summary, the technical scheme of the present application introduces a converter as an intermediate layer, effectively solving the problems of long service code reconstruction time, large invasiveness to the original service of the Internet of Things system, and improving the access efficiency, stability and optimization iteration capability of the system, while enhancing the flexibility and scalability of the system, and realizing the standardization of unified authentication and access control.

[0117] In another aspect, as Figure 9 shown, the embodiment of the present application provides a single sign-on access device 900, which can include:

[0118] The first module 901 is configured to obtain the request data of the client in response to the request information of the client to the converter.

[0119] The second module 902 is configured to perform reconstruction and packaging on the request data based on a preset format through the converter to obtain a target request.

[0120] The third module 903 is configured to send the target request to the server to enable the server to perform request verification, and return the access control information to the converter through the server when the result of the request verification is passed.

[0121] The fourth module 904 is configured to perform analysis and reconstruction on the access control information based on a preset data template through the converter to obtain target data, and return the target data to the client.

[0122] Optionally, the device can further include:

[0123] The fifth module is configured to configure a parameter mapping table in response to a first instruction of the management object based on the format requirement of the HTTP request of the server, and arrange the parameter mapping table into a preset format and configure the converter.

[0124] The sixth module is configured to adjust the corresponding configuration item in the parameter mapping table in response to a second instruction of the management object based on the changed parameter item when the format requirement of the server changes.

[0125] The contents of the method embodiments of the present application are applicable to the device embodiments of the present application, the device embodiments of the present application specifically realize the same functions as the above-mentioned method embodiments, and achieve the same beneficial effects as the above-mentioned method.

[0126] In another aspect, the embodiment of the present application further provides an electronic device, which includes a memory and a processor, the memory stores a computer program, and the processor realizes the above-mentioned sensitive information method when executing the computer program. The electronic device can be any intelligent terminal including a tablet computer, a vehicle-mounted computer, etc.

[0127] It can be understood that the contents in the above method embodiments are all applicable to the present device embodiments, the present device embodiments specifically implement the functions same as those of the above method embodiments, and achieve the same beneficial effects as those of the above method embodiments.

[0128] As shown in Figure 10 , Figure 10 a hardware structure specific example of an electronic device 1000 of an embodiment is shown, the electronic device 1000 includes:

[0129] The processor 1001 can be implemented in a general-purpose CPU (Central Processing Unit), a microprocessor, an ASIC (Application Specific Integrated Circuit), or one or more integrated circuits, etc., for executing related programs to implement the technical solutions provided by the present embodiment;

[0130] The memory 1002 can be implemented in the form of a ROM (Read Only Memory), a static storage device, a dynamic storage device, or a RAM (Random Access Memory), etc. The memory 1002 can store an operating system and other application programs, and when the technical solutions provided by the present embodiment are implemented by software or firmware, the related program codes are stored in the memory 1002 and called and executed by the processor 1001 to implement the network node population optimization method of the present embodiment;

[0131] The input / output interface 1003 is used to realize information input and output;

[0132] The communication interface 1004 is used to realize the communication interaction between the present device and other devices, which can realize communication through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.);

[0133] The bus 1005 transmits information between various components (such as the processor 1001, the memory 1002, the input / output interface 1003, and the communication interface 1004) of the device.

[0134] Among them, the processor 1001, the memory 1002, the input / output interface 1003, and the communication interface 1004 realize the communication connection between each other inside the device through the bus 1005.

[0135] The electronic device embodiments described above are merely illustrative, wherein the units described as separate components can or can not be physically separate, i.e., can be located in one place, or can be distributed to multiple network units. Part or all of the modules can be selected according to actual needs to achieve the purposes of the embodiments.

[0136] The contents of the method embodiments of the present application are applicable to the electronic device embodiments, the electronic device embodiments specifically implement the functions of the above method embodiments, and achieve the same beneficial effects as the above method embodiments.

[0137] Another aspect of the embodiments of the present application further provides a computer readable storage medium, the storage medium stores a program, and the program is executed by a processor to implement the above method.

[0138] It should be noted that the computer readable medium shown in the embodiments of the present application can be a computer readable signal medium or a computer readable storage medium or any combination of the two. The computer readable storage medium may, for example, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or component, or any combination of the above. More specific examples of computer readable storage media can include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (Compact Disc Read-Only Memory, CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, the computer readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, device or component. In the present application, the computer readable signal medium can include a data signal carried in a baseband or as a part of a carrier wave, which carries computer readable program code. Such a propagated data signal can take many forms, including but not limited to an electromagnetic signal, an optical signal or any suitable combination of the above. The computer readable signal medium can also be any computer readable medium other than the computer readable storage medium, which can send, propagate or transmit a program for use by or in conjunction with an instruction execution system, device or component. The program code contained on the computer readable medium can be transmitted by any suitable medium, including but not limited to wireless, wired, etc., or any suitable combination of the above.

[0139] The contents of the method embodiments of the present application are applicable to the computer readable storage medium embodiments, the computer readable storage medium embodiments specifically implement the same functions as the method embodiments, and achieve the same beneficial effects as the method embodiments.

[0140] The embodiments of the present application also disclose a computer program product or computer program, which comprises computer instructions stored in a computer readable storage medium. A processor of a computer device can read the computer instructions from the computer readable storage medium, and the processor executes the computer instructions to enable the computer device to perform the foregoing method.

[0141] The flowcharts and block diagrams in the drawings illustrate the possible implementation architectures, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each block in the flowcharts or block diagrams can represent a module, a program segment or a part of code, which comprises one or more executable instructions for implementing a specified logic function. It should also be noted that, in some alternative implementations, the functions noted in the blocks can occur in different orders from those noted in the drawings. For example, two blocks represented in succession can actually be executed in parallel, and they can also be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams or flowcharts, and the combination of blocks in the block diagrams or flowcharts, can be implemented by a dedicated hardware-based system that performs the specified functions or operations, or can be implemented by a combination of dedicated hardware and computer instructions.

[0142] It should be noted that, although several modules of the device for action execution are mentioned in the foregoing detailed description, such a division is not mandatory. Indeed, according to embodiments of the application, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided into modules or units.

[0143] From the above description of the embodiments, those skilled in the art can easily understand that the example embodiments described herein can be implemented by software, or by a combination of software and necessary hardware. Therefore, the technical solutions according to the embodiments of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash disk, a mobile hard disk, etc.) or a network, and includes a number of instructions to enable a computing device (which can be a personal computer, a server, a touch terminal, or a network device, etc.) to perform the methods according to the embodiments of the present application.

[0144] In some alternative embodiments, the function / operations described in the block diagrams can not occur in the order described in the operational illustrations. For example, two blocks shown in succession can in fact be executed substantially concurrently or the blocks can sometimes be executed in reverse order, depending on the functionality / operations involved. Also, although the embodiments presented in the flow diagrams are shown as a sequence of operations, it is to be understood that the logical flow is merely illustrative of alternative embodiments. The disclosed methods can be utilized in any combination of hardware and / or software. Embodiments of the present application are not limited to the order of operations presented in the flow diagrams.

[0145] Furthermore, although the present application has been described in the context of functional modules, it is to be understood that one or more of the functions and / or features of the present application can be implemented in a single physical device and / or software module, or one or more functions and / or features can be implemented in separate physical devices or software modules. It is also to be understood that detailed discussion of the actual implementation of each module is unnecessary to an understanding of the present application. Rather, the actual implementation is within the routine skill of engineers familiar with the property, function and internal relationships of the various functional modules disclosed herein. Accordingly, the present application is not limited to the specific embodiments illustrated herein, but is amenable to any number of possible embodiments within the scope of the claims. It is therefore to be understood that any alterations and / or modifications to the specific embodiments disclosed herein are fully intended to be encompassed by the present application. Within the scope of the appended claims, many variations in the details of the structure can be made. Therefore, the application is not to be restricted or limited except in accordance with the rights granted by the appended claims.

[0146] If the functions are implemented in the form of software function units and sold or used as independent products, they can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application or the part of the present application that essentially contributes to the prior art or the part of the present application can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the embodiments of the method of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0147] The logic and / or steps represented in the flowcharts and / or described herein, for example, can be embodied in non-transitory computer-readable media, executed by an instruction execution device, apparatus or device, such as a computer-based device, a processor-based device or other device that can fetch the instructions from the instruction execution device, apparatus or device and execute the instructions, or in conjunction with the instruction execution device, apparatus or device. For purposes of this specification, a "computer-readable medium" can be any apparatus that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution device, apparatus or device.

[0148] More specific examples (a non-exhaustive list) of the computer-readable medium include the following: an electrical connection (electronic) having one or more wires, a portable computer diskette (magnetic), a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, and a portable compact disc read-only memory (CDROM). Additionally, the computer-readable medium can also be paper or another suitable medium upon which the program is printed, as the program can be electronically captured, for example, via optical scanning of the paper or other medium, then compiled, interpreted, or otherwise processed in a suitable manner, if necessary, and then stored in a computer memory.

[0149] It should be understood that aspects of the application can be implemented in hardware, software, firmware or combinations thereof. In the above embodiments, the various steps or methods can be implemented in software or firmware that is stored in memory and executed by a suitable instruction execution device. For example, if implemented in hardware, as in another embodiment, any of the following technologies, or combinations thereof, can be used with the necessary hardware: a discrete logic circuit(s) having logic gates for implementing logic functions upon an application of data signals, an application specific integrated circuit having appropriate combinational logic gates, a programmable gate array(s) (PGA), a field programmable gate array (FPGA), and / or the like.

[0150] In the description of the specification, reference to "one embodiment", "some embodiments", "an example", "a specific example", or "some examples" means that a particular feature, structure, material, or characteristic being described in connection with the embodiment or example is included in at least one embodiment or example of the application. The illustrative appearances of the above- described terms in various places in the specification are not necessarily intended to refer to the same embodiment or example. Furthermore, the particular features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0151] While the embodiments of the application have been shown and described, it is to be understood that the embodiments described are merely exemplary and are not to be construed as limiting the scope of the application. The scope of the application is defined by the appended claims and their equivalents.

[0152] The above is a specific description of the preferred embodiment of the present application, but the present application is not limited to the embodiment, and those skilled in the art can make various equivalent modifications or replacements without departing from the spirit of the present application, and these equivalent modifications or replacements are all included in the scope defined by the claims of the present application.

Claims

1. A single sign-on access method, characterized in that: The following steps are involved: In response to a request from a client to a converter, obtaining request data from the client; The converter is pre-configured with a standard interface; obtaining the request data from the client comprises the following steps: Obtaining the request data of the client based on the standard interface through the converter; The request data includes a resource authorization request, an access token request, and a resource request; the standard interface includes an authorization interface for obtaining the resource authorization request, a token interface for obtaining the access token request, and a user information interface for obtaining the resource request; The converter transforms and encapsulates the request data based on a preset format to obtain a target request; Sending the target request to the server so that the server performs request verification; when the result of the request verification is passed, returning access control information to the converter through the server; The converter parses and transforms the access control information based on a preset data template to obtain target data; and returns the target data to the client; The method further comprises the following steps: Based on the format requirements of the http request of the server, responding to the first instruction of the management object, configuring a corresponding parameter mapping table; arranging the parameter mapping table into the preset format and configuring it in the converter; When the format requirement of the server changes, the corresponding configuration item in the parameter mapping table is adjusted based on the changed parameter item in response to the second instruction of the management object.

2. The single sign-on access method according to claim 1, characterized in that: The step of transforming and encapsulating the request data based on a preset format by the converter to obtain a target request includes the following steps: Based on the format requirements of the http request of the server, the request format of the request data is transformed and encapsulated by the converter to obtain the target request; The request format includes a request path, a request method, and request parameters; and the preset format corresponding to the format requirement is pre-configured in the converter.

3. The single sign-on access method according to claim 1, wherein: The target request includes a target resource authorization request, a target access token request, and a target resource request; the request verification includes the following steps: Performing resource authorization verification in response to the target resource authorization request; Performing identity authentication in response to the target access token request; Token verification is performed in response to the target resource request.

4. The single sign-on access method according to claim 1, wherein: The target request includes a target resource authorization request, a target access token request and a target resource request; the request verification includes resource authorization verification, identity authentication and token verification; The access control information includes authorization information, token information, and resource information; when the result of the request verification is that the verification is passed, the access control information is returned to the converter through the server, including the following steps: When the result of the resource authorization verification is that the verification is passed, the authorization information is sent through the server; wherein the resource authorization verification is performed in response to the target resource authorization request; When the result of the identity authentication is verified, the token information is issued by the server; wherein the identity authentication is performed in response to the target access token request and the authorization information; When the token verification result is passed, the resource information is sent through the server; The token verification is performed in response to the target resource request and the token information.

5. The single sign-on access method according to claim 1, wherein: The step of parsing and transforming the access control information based on a preset data template by the converter includes the following steps: Based on the data structure requirements of the client, the structure of the access control information is parsed and transformed by the converter; The preset data template corresponding to the data structure requirement is pre-configured in the converter.

6. A single sign-on access device, characterized in that: include: The first module is configured to obtain request data of the client in response to request information of the client to the converter; The converter is pre-configured with a standard interface; obtaining the request data from the client comprises the following steps: Obtaining the request data of the client based on the standard interface through the converter; The request data includes a resource authorization request, an access token request, and a resource request; the standard interface includes an authorization interface for obtaining the resource authorization request, a token interface for obtaining the access token request, and a user information interface for obtaining the resource request; The second module is configured to transform and encapsulate the request data based on a preset format through the converter to obtain a target request; The third module is configured to send the target request to the server so that the server performs request verification; when the result of the request verification is that the verification is passed, the server returns access control information to the converter; A fourth module is configured to parse and transform the access control information based on a preset data template through the converter to obtain target data; and return the target data to the client; The device further comprises: A fifth module is configured to configure a corresponding parameter mapping table in response to the first instruction of the management object based on the format requirement of the http request of the server; and to organize the parameter mapping table into the preset format and configure it into the converter; The sixth module is configured to adjust the corresponding configuration item in the parameter mapping table in response to the second instruction of the management object based on the changed parameter item when the format requirement of the server changes.

7. An electronic device, characterized in that: including a processor and a memory; The memory is used to store programs; The processor executes the program to implement the method according to any one of claims 1 to 5.

8. A computer storage medium storing a program executable by a processor, characterized in that: The program executable by the processor is used to implement the method according to any one of claims 1 to 5 when executed by the processor.

Images