Industrial internet platform single sign-on system

Abstract

The invention discloses a single sign-on system of an industrial internet platform, and relates to the technical field of industrial internet, the single sign-on system comprises a three-party application, an identity recognition and access management module and an MITM tool module, the MITM tool module is respectively in communication connection with the three-party application and the identity recognition and access management module, and the MITM tool module is in communication connection with the three-party application and the identity recognition and access management module. The authentication module is used for receiving an identity authentication request of a three-party application user, sending the identity authentication request to the identity recognition and access management module for industrial internet platform authentication, and dynamically generating access, operation and data permissions of the three-party application according to an authentication result and configuration; and as a relay of an authentication request, mapping of an industrial internet platform user permission system and a three-party application user permission system and single sign-on of the user are carried out. According to the method and the system, the user login information can be stored through Cookie / Session Storage / Local Storage, three-party application access in a user login state can be kept, and the compatibility is high.

Description

Technical Field

[0001] The present invention relates to the fields of industrial Internet, single sign-on, and application integration technology, and more specifically to a single sign-on system for an industrial Internet platform. Background Art

[0002] In the process of digital transformation, enterprises often develop point-based application systems for different fields and business needs. Usually, there are problems such as decentralized and repeated construction of systems, inconsistent design / manufacturing / operation and maintenance / business data, and difficulty in data sharing and value release among various application systems. With the development of the industrial Internet platform, the above problems have been solved to a certain extent. At present, the ability of the industrial Internet platform in application access is already very powerful, which makes it possible to access and uniformly manage point-based application systems one by one. In the prior art, the patent with publication number CN115086433A discloses an industrial Internet APP and circulation method for different application scenarios, including platform convergence scenarios, which integrate various types of industrial Internet terminals to build a comprehensive service supply system and a unified service scenario. In similar smelting processes, in order to supplement the integrity of its own industrial Internet terminals, the complementary terminals are integrated into the terminal system developed by itself, and the transformation and output of the industrial Internet terminals developed by this project are realized to form a unified solution, data intercommunication scenarios, in which part of the output data of the equipment online monitoring and operation and maintenance terminals is used as the input data of the intelligent optimization decision-making and control terminals. It integrates various types of industrial Internet terminals to build a comprehensive service supply system, and integrates different industrial Internet terminals to form a unified service environment to provide services to the outside world.

[0003] The patent with publication number CN114329423A discloses a third-party application integration method and system suitable for single sign-on, which is applied to the third-party application development module of the operation management platform, including: selecting the corresponding registration mode according to the application of the third-party application, and uploading the registration information corresponding to the registration mode to the administrator module; receiving the audit results of the third-party application registration information by the administrator module of the operation management platform, and receiving the secret key parameters; modifying the third-party application based on the secret key parameters; publishing the modified third-party application to enable the administrator module to install and use the third-party application. According to different situations of third-party applications, three single sign-on integration solutions are provided: standard mode access, active mode access, and simple mode access, to ensure that each third-party application can have a suitable single sign-on transformation and integration solution.

[0004] The patent with publication number CN117763530A discloses a single sign-on method, device and electronic device based on module federation. The method includes starting the target application in response to a startup operation. Based on the reference login field pre-configured in the target application, and the dependency relationship between the pre-stored reference login field and the exposed login field, the referenced exposed login field is determined in other applications other than the target application of multiple mutually trusted applications. The state stored in the exposed login field is obtained. The state is a login state or a non-login state. If the state of the exposed login field is a login state, the target application is logged in. The present invention automatically logs in by referencing the exposed login field when the target application is started. Multiple applications can achieve automatic login based on the state of the same exposed login field. The reference field and the exposed field pre-configured based on the module federation are both codes inside the application, avoiding the separate storage of tokens outside the application, thereby improving security.

[0005] The patent with publication number CN117150470A discloses a single sign-on system that can achieve no docking and no intrusion, and relates to the field of system integration technology, including: a portal layer, which is used to provide users with a unified portal for one-time login, integrate the login data of all application systems, and establish the association between the unified portal user and the users of each application system; an RPA layer, which is used to request the RPA dispatch center service deployed locally through the unified portal of the B / S architecture, and the RPA dispatch center makes a judgment after parsing the request and calls the corresponding SSO-RPA; an application layer, which is used to automatically jump to the corresponding application system according to the called SSO-RPA to complete the automatic login process; a data layer, which is used to realize the encrypted storage of the single-point mapping relationship. The present invention is intended to adapt to and solve the problems of repeated login, cumbersome recording of login information, difficult coordination of integrated single sign-on, and large changes, and realize single sign-on without docking or transformation and development of any system.

[0006] The patent with publication number CN117407195A discloses an interface system, integration method and device between an application system and a third-party system. The method includes: receiving an access request from an internal function of the application system to the third-party system through a preset protocol, obtaining the request parameters of the access request, and generating a configuration instance for the internal interface module to process the request parameters based on preset specifications; establishing a mapping relationship between the configuration in the configuration instance and the input and output parameters of the interface function in a visual form through an interactive interface and performing data format conversion of the corresponding parameters to establish a route for the internal function to access the third-party system; generating a thread for the access request and a thread for the third-party system to respond to the access request, and performing authentication, flow control, concurrency control and retry control on the thread. It can significantly reduce the customization cost of integrating standardized product systems with customer local systems.

[0007] In view of the description of the application single sign-on integration process in the above patent, the application access process can be combined and organized into the following key steps: Requirements analysis: Determine the single sign-on integration requirements between external systems and the Industrial Internet platform, including user authentication methods, permission management, and other aspects.

[0008] Authentication method selection: Determine the authentication method between the external system and the Industrial Internet platform. Common authentication methods include token-based authentication (such as OAuth), identity provider-based authentication (such as LDAP, Active Directory), etc.

[0009] Integration configuration: Perform relevant configuration in the Industrial Internet Platform and configure the parameters required for single sign-on integration, including authentication information of the external system, callback URL, etc.

[0010] Develop / Configure External Systems: Develop or configure external systems to enable single sign-on integration with the Industrial Internet Platform. This may involve writing code, configuring authentication plug-ins, etc.

[0011] Test: Test the single sign-on integration to ensure that the single sign-on function between the external system and the Industrial Internet Platform works properly, including whether users can log in to the Industrial Internet Platform through the external system, and whether functions such as permission management are normal.

[0012] Deployment and launch: Deploy the integrated external system to the production environment and launch it for use. Some additional testing and verification work may be required before launching to ensure the stability and security of the system.

[0013] Monitoring and maintenance: Regularly monitor the operating status of the single sign-on integration, promptly handle possible failures or security vulnerabilities, and ensure the normal operation of the system and data security.

[0014] Based on the above patent results, incremental industrial applications can be efficiently accessed.

[0015] However, the digital transformation of enterprises is not achieved overnight. The digital transformation of enterprises often lasts for several years or even decades. In this process, various application systems will inevitably be developed for the specific needs of various business domains and business units, such as enterprise resource planning systems (ERP), customer relationship management systems (CRM), supply chain management systems (SCM), and production customization systems (MES). When the industrial Internet platform is online, the above business systems have been running normally in the production environment for many years, the correctness of the business systems has been fully verified, and the potential risks have been reduced to a low level. System users and enterprise managers often have no intention to offline, modify and re-launch business systems that have been running normally in the production environment for many years for the non-functional requirement of single sign-on. In addition, for some external application systems that share the same (or limited) account of some enterprises, it is difficult for enterprises to require external application providers to complete single sign-on integration in a one-to-many (or one-to-one) manner. In summary, it is difficult for existing industrial application systems to be integrated with the industrial Internet platform efficiently and with low intrusion through the above general methods. Summary of the invention

[0016] In order to overcome the defects in the above-mentioned prior art, the present invention discloses a single sign-on system for an industrial Internet platform. The present invention decouples the "single sign-on authentication trust relationship between the business system and the industrial Internet platform" into two parts: "single sign-on between the application access tool and the industrial Internet platform" and "mutual trust between the access tool and the business application system". Through the authentication relay function of the access tool, one-to-one and one-to-many mapping between the business system and the user / authority system of the industrial Internet platform is achieved, completing low-intrusion single sign-on integration.

[0017] In order to achieve the above objectives, the technical solution adopted by the present invention is: An industrial Internet platform single sign-on system, comprising: Third-party applications include several application systems, wherein the several application systems integrate a single sign-on function; Identity and Access Management (IAM) module, used for user identity and access management; The MITM tool module is respectively communicated with the third-party application and the identity identification and access management module, and is used to receive the identity authentication request of the third-party application user, and send the identity authentication request to the identity identification and access management module for industrial Internet platform authentication and authorization, and dynamically generate the access, operation and data permissions of the third-party application according to the authentication result and configuration; as a relay of the authentication request, it performs the mapping of the industrial Internet platform user permission system and the third-party application user permission system, as well as the user's single sign-on.

[0018] Preferably, the identity recognition and access management module includes: The SSO tool module is used to manage the user's login status and session information on the Industrial Internet Platform. When a user logs in to the Industrial Internet Platform or an application that has been integrated with single sign-on, a login credential or session identifier is created for the user, and the credential is verified when the user accesses other systems; The USER tool module is connected to the SSO tool module for directly managing the user's basic information and permission information. During the single sign-on process, it is responsible for providing the user's identity information to the SSO tool module; The SYS tool module is respectively connected to the SSO tool module and the USER tool module for configuring and managing the relevant parameters of the single sign-on system.

[0019] 1. Third-party applications Preferably, in the three-party applications, the several application systems include existing application systems and incremental application systems, and both the existing application systems and the incremental application systems are integrated with a single sign-on function.

[0020] In the present invention, third-party applications refer to various application systems in the field of industrial Internet. These systems need to integrate a single sign-on function to enable users to log in repeatedly between different systems, including existing application systems and potential incremental application systems.

[0021] MITM Tool Module Preferably, the MITM tool module includes a Cookie injection component, a Session Storage injection component, and a Local Storage injection component, and the single sign-on system uses the Cookie injection component, the Session Storage injection component, and the Local Storage injection component to perform single sign-on on the industrial Internet platform.

[0022] In the present invention, for the MITM tool module: the MITM tool module receives the identity authentication request of the third-party application user, authenticates and authenticates on the industrial Internet platform, and dynamically generates the access, operation, and data permissions of the third-party application according to the authentication result and configuration. It acts as a relay for the authentication request and is responsible for completing the mapping between the industrial Internet platform user permission system and the third-party application user permission system. The MITM tool module consists of three core components, namely, the Cookie injection component, the Session Storage injection component, and the Local Storage injection component.

[0023] In the present invention, MITM refers to Module in the Middle, that is, an intermediate proxy module.

[0024] Cookies, Session Storage and Local Storage refer to the browser data storage methods. Among them, Cookies refer to the local storage space on the client (browser); Session Storage refers to the local session storage (which disappears when the browser is closed); Local Storage refers to the local permanent storage.

[0025] Specifically, the three injection components are as follows: 1. Cookie injection component Preferably, using the Cookie injection component to perform single sign-on on the industrial Internet platform includes: When a user logs in to a third-party application through a browser, the MITM tool module receives the login request submitted by the user and sends the login request to the identity recognition and access management module for industrial Internet platform identity authentication; After verification, the Cookie injection component calls the third-party application authentication interface to obtain the third-party application login credentials (i.e., Token), stores the credentials in the user's Cookie, and returns the Cookie to the user's browser; Later, when the user visits other third-party application systems, the browser automatically sends the Cookie containing the credentials to the other third-party application systems. The other third-party application systems verify the user's identity by parsing the credentials in the Cookie and create a corresponding session for the user.

[0026] 2. Session Storage injection component Preferably, using the Session Storage injection component to perform single sign-on on the industrial Internet platform includes: When a user logs in to a third-party application through a browser, the MITM tool module receives the login request submitted by the user and sends the login request to the identity recognition and access management module for industrial Internet platform identity authentication; After verification, the Session Storage injection component calls the third-party application authentication interface to obtain the third-party application login credentials (i.e., Token), stores the credentials in the user's Session Storage, and returns Session Storage to the user's browser; Later, when the user visits other third-party application systems, the browser automatically sends the SessionStorage containing the credentials to the other third-party application systems. The other third-party application systems verify the user's identity by parsing the credentials in the Session Storage and create a corresponding session for the user.

[0027] 3. Local Storage injection component Preferably, using the Local Storage injection component to perform single sign-on on the industrial Internet platform includes: When a user logs in to a third-party application through a browser, the MITM tool module receives the login request submitted by the user and sends the login request to the identity recognition and access management module for industrial Internet platform identity authentication; After verification, the Local Storage injection component calls the third-party application authentication interface to obtain the third-party application login credentials (i.e., Token), stores the credentials in the user's Local Storage, and returns the Local Storage to the user's browser; Later, when the user accesses other third-party application systems, the browser automatically sends the Local Storage containing the credentials to the other third-party application systems. The other third-party application systems verify the user's identity by parsing the credentials in the Local Storage and create a corresponding session for the user.

[0028] 3. SSO Tool Module In the present invention, for the SSO tool module: the SSO tool module is responsible for managing the user's login status and session information on the industrial Internet platform. When a user logs in to the industrial Internet platform or an application with single sign-on integration, the module will create a login credential or session identifier for the user, and verify the credential when the user accesses other systems, thereby achieving session retention and credential update.

[0029] In the present invention, SSO refers to Module of Single Sign On, that is, a single sign-on module.

[0030] 4. USER tool module Preferably, the USER tool module manages the user's basic information and permission information including: the user's username, password, role, and permission.

[0031] In the present invention, for the USER tool module: the USER tool module is used to directly manage the user's basic information and permission information, including the user's username, password, role, permission, etc. In the single sign-on process, this module is responsible for providing the user's identity information to the SSO tool module for identity verification.

[0032] In the present invention, USER refers to Module of User Information, that is, user information module.

[0033] SYS Tool Module Preferably, the SYS tool module configures and manages the relevant parameters of the single sign-on system including: authentication method, authentication service address, and user information storage method.

[0034] In the present invention, for the SYS tool module: the SYS tool module is used to configure and manage the relevant parameters and settings of the single sign-on system, including the authentication method, authentication service address, user information storage method, etc. It provides flexible configuration and management functions for the single sign-on system to meet the requirements of different environments and needs.

[0035] In the present invention, SYS refers to Module of System, that is, system configuration management module.

[0036] Preferably, the use process of the MITM tool module in the third-party application configuration phase includes the following steps: A1. Determine whether the third-party application is configuring the MITM tool module for the first time. If so, proceed to step A2; otherwise, proceed to step A3; A2. Integrate the MITM tool module on the industrial Internet platform, and then initialize the third-party application user / authority mapping table; A3. Configure the third-party application authentication API interface and configure the user / authority mapping relationship between the third-party application and the industrial Internet platform; A4. Confirm the login retention method of the third-party application front-end, including: If you keep logged in through cookies, configure it as Cookie injection mode; If you stay logged in through Session Storage, configure it as Session Storage injection mode; If you stay logged in through Local Storage, configure it to Local Storage injection mode; A5. Output the third-party application access link after the MITM tool module proxy.

[0037] Preferably, the use process of the MITM tool module in the third-party application access phase includes the following steps: B1. Access the third-party application access link behind the proxy of the MITM tool module, and then the MITM tool module and the industrial Internet platform complete single sign-on; B2, the MITM tool module determines the permissions of the third-party application based on the platform Token mapping. If there is access permission, it will enter B3, if there is no access permission, it will end; B3. The MITM tool module obtains the third-party application Token through the third-party application authentication interface; B4. Query the third-party application login retention method configured by the MITM tool module, including: If you keep logged in through cookies, inject the third-party token into the cookies of the third-party application; If you stay logged in through Session Storage, inject the third-party Token into the SessionStorage of the third-party application; If you stay logged in through Local Storage, inject the third-party token into the LocalStorage of the third-party application; B5. Access to a third-party application system with a logged-in user.

[0038] In the present invention, Token refers to the third-party application login credential.

[0039] On the other hand, based on the above-mentioned industrial Internet platform single sign-on system, the present invention also provides an industrial Internet platform, including: The basic service layer provides the infrastructure support required by the industrial Internet platform, including container services, relational database services, non-relational database services, object storage services, and message services; The business service layer includes identity authentication and access management services, IoT device management services, and message notification services. The identity authentication and access management services include MITM tool module, SSO tool module, USER tool module, and SYS tool module. The business service layer decouples common capabilities into fixed services, so that the decoupled business service modules can be flexibly combined and matched according to actual needs to meet the customized needs of different users or application scenarios. The application layer builds application systems in various fields based on general business service capabilities, including production management systems, quality management systems, and supply chain management systems. It provides business-oriented application system interfaces, outputs functions and services related to specific business fields, and meets users' specific business needs in these fields; The gateway layer serves as the unified data import and export of the industrial Internet platform and manages the system interface, including interface publishing, access control, and monitoring; forwards external requests to the corresponding services to implement request routing and load balancing; and provides security protection measures, including firewalls and DDoS attack protection; The display layer includes a variety of user interface applications: browser applications, mini-program applications, Hongmeng applications, Android applications, and iOS applications. Its function is to show users the various functions and services provided by the industrial Internet platform, as well as the interface for interacting with users. It covers a variety of different application platforms, including browsers, mobile applications, and smart devices, to meet the usage needs of different users in different scenarios.

[0040] In the present invention, it is possible to optimize the existing application access method, and it only serves as an extension tool module of the IAM service in the business service layer without affecting the architecture of the industrial Internet platform. It is sufficiently advanced when the industrial Internet platform accesses applications (especially existing applications).

[0041] Beneficial effects of the present invention: 1. The present invention can effectively support low-intrusion access of existing applications and incremental applications and has a wide range of applications.

[0042] 2. The present invention can support the access of third-party applications that save user login information through Cookie / Session Storage / Local Storage and maintain the user login status, and has strong compatibility.

[0043] 3. The present invention supports one-to-one and one-to-many configuration between platform users and third-party application system users, and can effectively support fine-grained control of single-account application access and user group permissions, with high flexibility. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 A schematic diagram of user login / authentication of a low-intrusive single sign-on integration method for an industrial Internet platform according to the present invention; Figure 2 The configuration flow chart of the MITM tool module of the present invention; Figure 3 This is a flowchart of the use of the MITM tool module of the present invention; Figure 4 The industrial Internet platform infrastructure after the present invention integrates the MITM tool module. DETAILED DESCRIPTION

[0045] The concept, specific structure and technical effects of the present invention will be clearly and completely described below in conjunction with the embodiments and drawings to fully understand the purpose, characteristics and effects of the present invention.

[0046] Example 1 An industrial Internet platform single sign-on system, such as Figure 1 As shown, it consists of 5 key modules / entities, including: ① Third-party applications: refers to various application systems in the field of industrial Internet. These systems need to integrate single sign-on functions to enable users to log in repeatedly between different systems, including existing application systems and potential incremental application systems.

[0047] ②MITM tool module: The MITM tool module receives the identity authentication request of the third-party application user, authenticates and authorizes on the industrial Internet platform, and dynamically generates the access, operation, and data permissions of the third-party application based on the authentication results and configuration. It acts as a relay for authentication requests and is responsible for completing the mapping between the industrial Internet platform user permission system and the third-party application user permission system. The MITM tool module consists of three core components, namely the Cookie injection component, the Session Storage injection component, and the Local Storage injection component.

[0048] a. Cookie injection component: When a user logs in to a third-party application, the MITM tool module receives the login request submitted by the user and performs industrial Internet platform identity authentication. After the verification is passed, the Cookie injection component calls the third-party application authentication interface to obtain the third-party application login credentials, stores the credentials in the user's Cookie, and returns the Cookie to the user's browser. After that, when the user accesses other systems, the browser will automatically send the Cookie containing the authentication credentials to the authentication third-party application. The third-party application system verifies the user's identity by parsing the credentials in the Cookie and creates a corresponding session for the user.

[0049] b.Session Storage injection component: When a user logs in to a third-party application, the MITM tool module receives the login request submitted by the user and performs industrial Internet platform identity authentication. After the verification is passed, the SessionStorage injection component calls the third-party application authentication interface to obtain the third-party application login credentials, stores the credentials in the user's Session Storage, and returns the Session Storage to the user's browser. After that, when the user accesses other systems, the browser will automatically send the Session Storage containing the authentication credentials to the authentication third-party application. The third-party application system verifies the user's identity by parsing the credentials in the Session Storage and creates a corresponding session for the user.

[0050] c. Local Storage injection component: When a user logs in to a third-party application, the MITM tool module receives the login request submitted by the user and performs industrial Internet platform identity authentication. After the verification is passed, the Local Storage injection component calls the third-party application authentication interface to obtain the third-party application login credentials, stores the credentials in the user's Local Storage, and returns the Local Storage to the user's browser. After that, when the user accesses other systems, the browser will automatically send the Local Storage containing the authentication credentials to the authentication third-party application. The third-party application system verifies the user's identity by parsing the credentials in the Local Storage and creates a corresponding session for the user.

[0051] ③SSO tool module: The SSO tool module is responsible for managing the user's login status and session information on the Industrial Internet platform. When a user logs in to the Industrial Internet platform or an application that has been integrated with single sign-on, the module will create a login credential or session identifier for the user and verify the credential when the user accesses other systems, thereby achieving session persistence and credential updates.

[0052] ④USER tool module: The USER tool module is used to directly manage the user's basic information and permission information, including the user's username, password, role, permission, etc. During the single sign-on process, this module is responsible for providing the user's identity information to the SSO tool module for identity authentication.

[0053] ⑤SYS tool module: The SYS tool module is used to configure and manage the relevant parameters and settings of the single sign-on system, including authentication method, authentication service address, user information storage method, etc. It provides flexible configuration and management functions for the single sign-on system to meet the requirements of different environments and needs.

[0054] The usage process of the MITM tool module in the third-party application configuration phase is as follows: Figure 2 As shown, the following steps are included: A1. Determine whether the third-party application is configuring the MITM tool module for the first time. If so, proceed to step A2; otherwise, proceed to step A3; A2. Integrate the MITM tool module on the industrial Internet platform, and then initialize the third-party application user / authority mapping table; A3. Configure the third-party application authentication API interface and configure the user / authority mapping relationship between the third-party application and the industrial Internet platform; A4. Confirm the login retention method of the third-party application front-end, including: If you keep logged in through cookies, configure it as Cookie injection mode; If you stay logged in through Session Storage, configure it as Session Storage injection mode; If you stay logged in through Local Storage, configure it to Local Storage injection mode; A5. Output the third-party application access link after the MITM tool module proxy.

[0055] The usage process of the MITM tool module in the third-party application access phase is as follows: Figure 3 As shown, the following steps are included: B1. Access the third-party application access link behind the proxy of the MITM tool module, and then the MITM tool module and the industrial Internet platform complete single sign-on; B2, the MITM tool module determines the permissions of the third-party application based on the platform Token mapping. If there is access permission, it will enter B3, if there is no access permission, it will end; B3. The MITM tool module obtains the third-party application Token through the third-party application authentication interface; B4. Query the third-party application login retention method configured by the MITM tool module, including: If you keep logged in through cookies, inject the third-party token into the cookies of the third-party application; If you stay logged in through Session Storage, inject the third-party Token into the SessionStorage of the third-party application; If you stay logged in through Local Storage, inject the third-party token into the LocalStorage of the third-party application; B5. Access to a third-party application system with a logged-in user.

[0056] Example 2 This embodiment further elaborates on the basis of embodiment 1, and introduces the MITM tool module into the post-industrial Internet platform architecture. Figure 4 As shown, where: ① The basic service layer provides the infrastructure support required by the industrial Internet platform, including container services, relational database services, non-relational database services, object storage services, message services, etc. These basic services constitute the technical cornerstone of the industrial Internet platform and provide the environment and infrastructure required for the operation of upper-level business services and application layers.

[0057] ② The business service layer includes identity authentication and access management services (including MITM tool modules), IoT device management services, and message notification services, etc. It decouples common capabilities into fixed services, so that the decoupled business service modules can be flexibly combined and matched according to actual needs to meet the customized needs of different users or application scenarios. At the same time, new business service modules can also be relatively easily integrated into the platform to achieve rapid expansion and upgrading of platform functions.

[0058] ③ The application layer builds application systems in various fields based on general business service capabilities, such as production management systems, quality management systems, supply chain management systems, etc. It provides business-oriented application system interfaces, outputs functions and services related to specific business fields, and meets users' specific business needs in this field.

[0059] ④ The gateway layer serves as the unified data import and export of the industrial Internet platform, and can manage the system interface, including interface publishing, access control, monitoring, etc. It can also forward external requests to the corresponding services to achieve request routing and load balancing. It can also provide security protection measures, such as firewalls and DDoS attack protection.

[0060] ⑤ The display layer includes a variety of user interface applications, such as browser applications, applet applications, Hongmeng applications, Android applications, iOS applications, etc. Its main function is to show users the various functions and services provided by the industrial Internet platform, as well as the interface for interacting with users. It covers a variety of different application platforms, such as browsers, mobile applications, smart devices, etc., which can meet the usage needs of different users in different scenarios.

[0061] In summary, the low-invasive single sign-on integration method and MITM tool module for the industrial Internet platform proposed in the present invention can not only optimize the existing application access method, but also only serve as an extended tool module of the IAM service in the business service layer without affecting the architecture of the industrial Internet platform. It is sufficiently advanced when the industrial Internet platform accesses applications (especially existing applications).

[0062] The above is a specific description of the implementation mode of the present invention, but the present invention is not limited to the described embodiments. Those skilled in the art may make various equivalent modifications or substitutions without violating the spirit of the present invention, and these equivalents or substitutions are all included in the scope defined by the claims of the present invention.

Claims

1. An industrial Internet platform single sign-on system, characterized in that: include: Third-party applications include several application systems, wherein the several application systems integrate a single sign-on function; Identity recognition and access management module, used for user identity recognition and access management; The MITM tool module is respectively connected to the third-party application and the identity identification and access management module for receiving the identity authentication request of the third-party application user, and sending the identity authentication request to the identity identification and access management module for industrial Internet platform authentication and authorization, and dynamically generating the access, operation and data permissions of the third-party application according to the authentication result and configuration; As a relay for authentication requests, it maps the industrial Internet platform user authority system and the third-party application user authority system, as well as the user's single sign-on.

2. The industrial Internet platform single sign-on system according to claim 1, characterized in that: The identity recognition and access management module includes: The SSO tool module is used to manage the user's login status and session information on the Industrial Internet Platform. When a user logs in to the Industrial Internet Platform or an application that has been integrated with single sign-on, a login credential or session identifier is created for the user, and the credential is verified when the user accesses other systems; The USER tool module is connected to the SSO tool module for directly managing the user's basic information and permission information. During the single sign-on process, it is responsible for providing the user's identity information to the SSO tool module; The SYS tool module is respectively connected to the SSO tool module and the USER tool module for configuring and managing the relevant parameters of the single sign-on system.

3. The industrial Internet platform single sign-on system according to claim 1, characterized in that: Among the three-party applications, the several application systems include existing application systems and incremental application systems, and both the existing application systems and the incremental application systems are integrated with a single sign-on function.

4. The industrial Internet platform single sign-on system according to claim 3, characterized in that: The MITM tool module includes a Cookie injection component, a Session Storage injection component, and a Local Storage injection component. The single sign-on system uses the Cookie injection component, the Session Storage injection component, and the Local Storage injection component to perform single sign-on on the industrial Internet platform.

5. The industrial Internet platform single sign-on system according to claim 4, characterized in that: Using Cookie injection components for single sign-on on the Industrial Internet platform includes: When a user logs in to a third-party application through a browser, the MITM tool module receives the login request submitted by the user and sends the login request to the identity recognition and access management module for industrial Internet platform identity authentication; After verification, the Cookie injection component calls the third-party application authentication interface to obtain the third-party application login credentials, stores the credentials in the user's Cookie, and returns the Cookie to the user's browser; Later, when the user visits other third-party application systems, the browser automatically sends the Cookie containing the credentials to the other third-party application systems. The other third-party application systems verify the user's identity by parsing the credentials in the Cookie and create a corresponding session for the user.

6. The industrial Internet platform single sign-on system according to claim 4, characterized in that: Using SessionStorage injection components for single sign-on on the Industrial Internet platform includes: When a user logs in to a third-party application through a browser, the MITM tool module receives the login request submitted by the user and sends the login request to the identity recognition and access management module for industrial Internet platform identity authentication; After verification, the Session Storage injection component calls the third-party application authentication interface to obtain the third-party application login credentials, stores the credentials in the user's Session Storage, and returns the Session Storage to the user's browser; Later, when the user accesses other third-party application systems, the browser automatically sends the Session Storage containing the credentials to the other third-party application systems. The other third-party application systems verify the user's identity by parsing the credentials in the Session Storage and create a corresponding session for the user.

7. The industrial Internet platform single sign-on system according to claim 4, characterized in that: Using LocalStorage injection components for single sign-on on the Industrial Internet platform includes: When a user logs in to a third-party application through a browser, the MITM tool module receives the login request submitted by the user and sends the login request to the identity recognition and access management module for industrial Internet platform identity authentication; After verification, the Local Storage injection component calls the third-party application authentication interface to obtain the third-party application login credentials, stores the credentials in the user's Local Storage, and returns the Local Storage to the user's browser; Later, when the user accesses other third-party application systems, the browser automatically sends the Local Storage containing the credentials to the other third-party application systems. The other third-party application systems verify the user's identity by parsing the credentials in the Local Storage and create a corresponding session for the user.

8. The industrial Internet platform single sign-on system according to claim 4, characterized in that: The usage process of the MITM tool module in the third-party application configuration phase includes the following steps: A1. Determine whether the third-party application is configuring the MITM tool module for the first time. If so, proceed to step A2; otherwise, proceed to step A3; A2. Integrate the MITM tool module on the industrial Internet platform, and then initialize the third-party application user / authority mapping table; A3. Configure the third-party application authentication API interface and configure the user / authority mapping relationship between the third-party application and the industrial Internet platform; A4. Confirm the login retention method of the third-party application front-end, including: If you keep logged in through cookies, configure it as Cookie injection mode; If you stay logged in through Session Storage, configure it to Session Storage injection mode; If you stay logged in through Local Storage, configure it to Local Storage injection mode; A5. Output the third-party application access link after the MITM tool module proxy.

9. The industrial Internet platform single sign-on system according to claim 8, characterized in that: The use process of the MITM tool module in the third-party application access phase includes the following steps: B1. Access the third-party application access link behind the proxy of the MITM tool module, and then the MITM tool module and the industrial Internet platform complete single sign-on; B2, the MITM tool module determines the permissions of the third-party application based on the platform Token mapping. If there is access permission, it will enter B3, if there is no access permission, it will end; B3. The MITM tool module obtains the third-party application Token through the third-party application authentication interface; B4. Query the third-party application login retention method configured by the MITM tool module, including: If you keep logged in through cookies, inject the third-party token into the cookies of the third-party application; If you stay logged in through Session Storage, inject the third-party Token into the SessionStorage of the third-party application; If you stay logged in through Local Storage, inject the third-party token into the Local Storage of the third-party application; B5. Access to a third-party application system with a logged-in user.

10. The industrial Internet platform single sign-on system according to claim 2, characterized in that: The USER tool module manages the basic information and permission information of the user, including: the user's username, password, role, and permission; The SYS tool module configures and manages the relevant parameters of the single sign-on system including: authentication method, authentication service address, and user information storage method.

Images