Single sign-on access method based on timestamp encryption

Abstract

The invention is suitable for the technical field of data access, and particularly relates to a single sign-on access method based on timestamp encryption, and the method comprises the steps: obtaining a timestamp and user information; generating a token, and generating a jump link based on the timestamp, the user information and the Token; accessing a financial management system through the jump link, and receiving a jump request by the financial management system; and the financial management system performs parameter verification according to the jump request, authorizes the current access user after the verification is passed, and completes single-point jump. According to the single sign-on access method based on timestamp encryption provided by the invention, during access, the timestamp is added, the timeliness of the access request is verified, the token is recorded after each request succeeds, a single token is prevented from being repeatedly used, the token and the timestamp are subjected to combined encryption, meanwhile, the ciphertext token is independently transmitted, bidirectional encryption is carried out, and the security of single sign-on is ensured.

Description

Technical Field

[0001] The invention belongs to the technical field of data access, and in particular relates to a single sign-on access method based on timestamp encryption. Background Art

[0002] Single Sign-On (SSO) is an authentication mechanism that allows users to access multiple interrelated applications or services with a single login, without having to repeatedly enter their username and password in each system. This mechanism not only improves user experience, but also simplifies security management, allowing users and administrators to manage and use multiple systems more efficiently.

[0003] However, accessing the system with a token can solve the single sign-on requirement, but there are hidden dangers in system security. Attackers can obtain the token through other means and access the system at will. Summary of the invention

[0004] The purpose of the present invention is to provide a single sign-on access method based on timestamp encryption, which aims to solve the problem that accessing the system by means of an attached token can solve the single sign-on requirement, but there are hidden dangers in system security, and attackers can obtain the token through other means and access the system at will.

[0005] The present invention is implemented as follows: a single sign-on access method based on timestamp encryption, the method comprising:

[0006] Get timestamp and user information;

[0007] Generate a token and generate a redirect link based on the timestamp, user information and token;

[0008] Access the financial management system through the jump link, and the financial management system receives the jump request;

[0009] The financial management system performs parameter verification based on the jump request. After the verification is passed, the current access user is authorized to complete the single-point jump.

[0010] Preferably, the length of the Token is 32 bits, and the Token is encrypted using an algorithm key.

[0011] Preferably, in the step of generating a token and generating a jump link based on the timestamp, user information and Token, the timestamp is 14 bits, and the timestamp and the encrypted Token are spliced ​​together, wherein the Token is the head of the spliced ​​data, the timestamp is the tail of the spliced ​​data, and the total length of the spliced ​​data is 46 bits.

[0012] Preferably, in the step of generating a token and generating a jump link based on the timestamp, user information and Token, after obtaining the spliced ​​data, the system identification information is retrieved, the system identification information and the data are combined to generate a jump link for accessing the financial management system.

[0013] Preferably, the step of performing parameter verification according to the jump request by the financial management system includes verifying whether sUser, sToken and sDateTime exist, and decrypting sUser, sToken and sDateTime after the verification is completed.

[0014] Preferably, after decryption is completed, it is determined whether sUser exists, and the user status is checked, the decrypted sDateTime is character segmented, and the Token and timestamp are checked. If the difference between the timestamps does not exceed a preset value, the verification is determined to be passed.

[0015] Preferably, if the token used for this access is the same as the historical token recorded in the system, it is determined to be abnormal and the user is not authorized.

[0016] The present invention provides a single sign-on access method based on timestamp encryption. When accessing, a timestamp is added and the timeliness of the access request is verified. A token is recorded after each successful request to prevent the reuse of a single token. The token and the timestamp are combined and encrypted, and the ciphertext token is transmitted separately at the same time. Two-way encryption is performed to ensure the security of the single sign-on. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 A schematic flow chart of a single sign-on access method based on timestamp encryption provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0018] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0019] It is understood that the terms "first", "second", etc. used in this application may be used herein to describe various elements, but unless otherwise specified, these elements are not limited by these terms. These terms are only used to distinguish a first element from another element. For example, without departing from the scope of this application, a first xx script may be referred to as a second xx script, and similarly, a second xx script may be referred to as a first xx script.

[0020] like Figure 1FIG. 1 is a flow chart of a single sign-on access method based on timestamp encryption provided by an embodiment of the present invention, wherein the method comprises:

[0021] Get timestamp and user information.

[0022] Generate a token and generate a jump link based on the timestamp, user information and Token.

[0023] The financial management system is accessed through the jump link, and the financial management system receives the jump request.

[0024] The financial management system performs parameter verification based on the jump request. After the verification is passed, the current access user is authorized to complete the single-point jump.

[0025] For ease of understanding, the embodiments of the present invention are described using specific embodiments:

[0026] The embodiment of the present invention relates to an OA system and a financial management system (financial management system), and is used to implement access operations between the two:

[0027] Preparation of National Secret 4 Algorithm:

[0028] The algorithm used in the single sign-on process between the OA system and the financial management system is National Secret 4. Both parties negotiate a common algorithm key so that both parties can perform encryption and decryption operations.

[0029] The OA system first prepares to jump to the basic link of the financial management system, which is https: / / finance management system ip: port / loginsso.jsp?.

[0030] The OA system takes the current system user code information (the user codes of the financial management system and the OA system are consistent), and the user code information is encrypted using the national secret 4 algorithm, and the sample can be obtained:

[0031] sUser=0C79C196FE9B3D575586CAB6DD08F5F1.

[0032] The OA system needs to prepare the token information for logging into the financial management system. The length of the token is 32 bits, and the token information used for each jump cannot be repeated. The token information is encrypted, and the sample can be obtained: &sToken=52A80DD8EF0227DC31835EA7A24192A09DDA5A1A82792B94A6943A284B5BE315D67FDABAB04112C89AA5302C195FCF4D

[0033] The OA system prepares the current system natural timestamp in the 14-digit YYYYMMDDHHmmss format, for example, 20240821105559. At the same time, the Token prepared in the previous step is concatenated with the current timestamp in the format of "token timestamp". The total length after concatenation is 46 bits.

[0034] The OA system then adds system identification information, system = OA. After all information is processed, all information is combined to form a jump link as follows. The OA system opens the link through a browser to access the financial management system:

[0035] https: / / finance management system ip:port / loginsso.jsp?sUser=0C79C196FE9B3D575586CAB6DD08F5F1&sToken=52A80DD8EF0227DC31835EA7A24192A09DDA5A1A82792B94A6943A284B5BE315D67FDABAB04112C89AA5302C195FCF4D&sDateTime=52A80DD8EF0227DC31835EA7A24192A09DDA5A1A82792B94A6943A284B5BE3156728F131CA32A7114C27BB73926D9C03&system=OA.

[0036] After the financial management system receives the jump request from the OA system, the processing example is as follows:

[0037] The financial management system verifies the parameters accessed by the OA system. First, it verifies whether the sUser, sToken, sDateTime and other parameters exist.

[0038] Decrypt the three parameters sUser, sToken, and sDateTime. If the decryption fails, an exception is thrown.

[0039] Verify whether the decrypted user ID sUser exists in the system, and verify whether the user status is normal and not frozen.

[0040] The decrypted sDateTime is character-segmented, and the first 32 bits of token information are compared with the decrypted sToken. If they are different, an exception is thrown. The last 14 bits of timestamp information are compared with the current system timestamp. If they exceed 60 seconds, an exception is thrown.

[0041] Check whether the token for this access is the same as the previous access token recorded in the system. If so, throw an exception.

[0042] After the verification is passed, the token for this visit will be saved in the database.

[0043] Authorize user sessions, system menu permissions, and user role permissions, initialize the system page, and complete single-point jump.

[0044] It should be understood that, although each step in the flow chart of each embodiment of the present invention is shown in sequence according to the indication of the arrow, these steps are not necessarily performed in sequence according to the order indicated by the arrow. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be performed in other orders. Moreover, at least a portion of the steps in each embodiment may include a plurality of sub-steps or a plurality of stages, and these sub-steps or stages are not necessarily performed at the same time, but can be performed at different times, and the execution order of these sub-steps or stages is not necessarily performed in sequence, but can be performed in turn or alternately with at least a portion of other steps or sub-steps or stages of other steps.

[0045] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the program can be stored in a non-volatile computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0046] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0047] The above-mentioned embodiments only express several implementation methods of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the patent of the present invention. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

[0048] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A single sign-on access method based on timestamp encryption, characterized in that: The method comprises: Get timestamp and user information; Generate a token and generate a redirect link based on the timestamp, user information, and token; Access the financial management system through the jump link, and the financial management system receives the jump request; The financial management system performs parameter verification based on the jump request. After the verification is passed, the current access user is authorized to complete the single-point jump.

2. The single sign-on access method based on timestamp encryption according to claim 1, characterized in that: The length of the Token is 32 bits, and the Token is encrypted using an algorithm key.

3. The single sign-on access method based on timestamp encryption according to claim 1, characterized in that: Generate a token. In the step of generating a jump link based on the timestamp, user information and token, the timestamp is 14 bits. The timestamp and the encrypted token are spliced ​​together, where the token is the head of the spliced ​​data and the timestamp is the tail of the spliced ​​data. The total length of the spliced ​​data is 46 bits.

4. The single sign-on access method based on timestamp encryption according to claim 3, characterized in that: Generate a token, and in the step of generating a jump link based on the timestamp, user information, and token, after obtaining the spliced ​​data, retrieve the system identification information, combine the system identification information and data, and generate a jump link for accessing the financial management system.

5. The single sign-on access method based on timestamp encryption according to claim 1, characterized in that: The financial management system performs parameter verification according to the jump request, including verifying whether sUser, sToken and sDateTime exist, and decrypting sUser, sToken and sDateTime after the verification is completed.

6. The single sign-on access method based on timestamp encryption according to claim 5, characterized in that: After decryption is completed, determine whether sUser exists and check the user status. Perform character segmentation on the decrypted sDateTime and verify the Token and timestamp. If the difference between the timestamps does not exceed the preset value, the verification is considered passed.

7. The single sign-on access method based on timestamp encryption according to claim 5, characterized in that: If the token used for this access is the same as the historical token recorded in the system, it is considered an exception and the user is not authorized.

Images