Multi-application single login authentication method, system, equipment and medium

Abstract

The invention relates to the technical field of identity authentication, in particular to a multi-application single login authentication method, system and device and a medium. In the method, when a user logs in, a user name and a user password are input once, and bidirectional authentication between the user and an authentication server is realized by adopting a symmetric encryption method; when the user subsequently applies for the application service from the application server in the system, the user does not need to repeatedly input a user name and a user password, but generates a dynamic label to propose an authentication request to the application server, and the application server and the authentication server exchange user authentication information, so that the application service application authentication of the user to the application server is realized, namely, the user authentication efficiency is improved. And bidirectional authentication between the user and the server can be realized by one authentication request.

Description

Technical Field

[0001] The present invention relates to the field of identity authentication technology, and in particular to a multi-application single-login authentication method, system, device and medium. Background Art

[0002] In a network environment, the client / server (C / S) model is usually used to provide application services to users, that is, users use the client to log in to the server to request the application services provided by the server. Usually, users access the login system on the client and enter the user name and password to log in to the remote application server. The application server verifies the user name and password provided by the user. If the verification is correct, it will continue to provide application services to the user, and both parties will exchange data information through network transmission; if the verification fails, it will refuse to continue to provide data information transmission services to the user. The process of user login verification is the process of the application server authenticating the user's identity.

[0003] When an enterprise or organization provides users with multiple application services through a network environment, if users need to enter a username and password for identity authentication every time they request an application service, it is not only inconvenient but also unnecessary for users. Users hope that they only need to log in once and enter a username and password once to conveniently access and use multiple application services provided by the enterprise or organization. This is called single sign-on.

[0004] How to securely implement single sign-on is a problem that many enterprises and organizations need to solve when integrating multiple applications. This process faces multiple security threats such as replay attacks and phishing attacks. Typical solutions include the Lightweight Directory Access method and the Kerberos system. However, in these two solutions, different user permission directory tables are stored in different security domains, so there are cross-domain trust issues. Summary of the invention

[0005] The purpose of the present invention is to provide a multi-application single-login authentication method, system, device and medium without cross-domain trust issues.

[0006] To solve the above technical problems, an embodiment of the present invention provides a multi-application single-sign-on authentication method, which is applied to a multi-application single-sign-on authentication system, the system comprising: a client, an authentication server and a plurality of application servers; wherein the authentication server pre-assigns a unique identifier to the user according to the user name and user password of the user;

[0007] The method comprises:

[0008] For any user, the client generates a user authentication request according to the user name input by the user, and sends the user authentication request to the authentication server;

[0009] The authentication server randomly generates a session key according to the user authentication request, and uses the user password as the encryption key to symmetrically encrypt the generated session key and the user's unique identifier to form encrypted information, which is then sent to the client.

[0010] If the client decrypts the encrypted information sent by the authentication server according to the user password entered by the user, and obtains the session key generated by the authentication server and the user's unique identifier, then the two-way authentication between the user and the authentication server is successful;

[0011] After the user and the authentication server have successfully completed two-way authentication, the client uses the session key generated by the authentication server as the encryption key to symmetrically encrypt the user's unique identifier to form a dynamic tag, and sends it to the application server corresponding to the application service requested by the user;

[0012] The application server sends the dynamic tag to the authentication server so that the authentication server decrypts the dynamic tag according to the generated session key. If the decryption obtains the user's unique identifier, the user who has successfully completed the two-way authentication with the authentication server will successfully authenticate the application service application of the application server.

[0013] Optionally, the authentication server includes a user authentication information list having current authentication information of all users, the user authentication information list includes one or more records, each record includes a user name of the user, a digital summary of the user password calculated using a hash algorithm, a unique identifier, a session key, a life cycle of the session key, and an IP address of a client currently logged in;

[0014] The authentication server randomly generates a session key according to the user authentication request, and uses the user password of the user as the encryption key, symmetrically encrypts the generated session key and the user's unique identifier to form encrypted information, and sends it to the client, including:

[0015] The authentication server receives the user authentication request and obtains the user name of the user requesting authentication and the IP address of the client currently used by the user to log in;

[0016] The user name is searched in the user authentication information list. If the search fails, the user is judged as a non-registered user and the authentication process ends. If the search succeeds, a session key is randomly generated, and a life cycle is set for the session key. The session key and the client's IP address are saved in the record corresponding to the user in the user authentication information list.

[0017] The digital summary of the user's password is used as the encryption key, and the user's unique identifier, session key and current timestamp are symmetrically encrypted and sent to the client.

[0018] Optionally, if the client decrypts the encrypted information sent by the authentication server according to the user password input by the user, and obtains the session key generated by the authentication server and the unique identifier of the user, then the two-way authentication between the user and the authentication server is successful, including:

[0019] Obtain the user password entered by the user on the client, and use the hash algorithm to calculate the digital summary of the user password, and use the digital summary of the user password as the decryption password of the symmetric encryption to decrypt the encrypted information sent by the authentication server;

[0020] If the decryption is successful, and the session key and the user's unique identifier generated by the authentication server are obtained, and the current timestamp is valid, then the user and the authentication server have successfully completed the two-way authentication, and the user's unique identifier and session key are saved; if the decryption fails, then the authentication fails and the authentication process ends.

[0021] Optionally, the client uses the session key generated by the authentication server as an encryption key, symmetrically encrypts the unique identifier of the user to form a dynamic tag, and sends it to the application server corresponding to the application service applied for by the user, including:

[0022] The client uses the session key generated by the authentication server as the encryption key to symmetrically encrypt the user's unique identifier, session key and current timestamp, and uses the encryption result as the dynamic tag for the user's application for application service, and sends the user's unique identifier and dynamic tag to the application server corresponding to the application service applied by the user.

[0023] Optionally, the authentication server corresponds to a pair of public-private key pairs, each application server also corresponds to a pair of public-private key pairs, and the authentication server stores a public key of the public-private key pair of each application server, and each application server stores a public key of the public-private key pair of the authentication server; wherein each application server has been pre-registered on the authentication server and is assigned a unique identifier by the authentication server;

[0024] The application server sends the dynamic tag to the authentication server, so that the authentication server decrypts the dynamic tag according to the generated session key. If the decryption obtains the unique identifier of the user, the user who has successfully completed the two-way authentication with the authentication server successfully applies for the application service of the application server, including:

[0025] The application server extracts the IP address of the client according to the unique identifier of the user and the dynamic tag sent by the client, and uses the public key in the public-private key pair of the authentication server to encrypt the unique identifier of the application server, the unique identifier of the user, the IP address of the client and the dynamic tag, and sends them to the authentication server;

[0026] The authentication server uses the private key in its own public-private key pair to decrypt the encrypted information sent by the application server, and obtains the unique identifier of the application server, the unique identifier of the user, the IP address of the client, and the dynamic tag;

[0027] Query the record corresponding to the user's unique identifier in the user authentication information list. If the query fails, the user is judged to be a fake user and the authentication process ends; if the query succeeds, compare whether the IP address of the client saved in the record is consistent with the IP address of the client sent by the application server; if they are inconsistent, it is judged to be an impersonation or invalid authentication request and the authentication process ends; if they are consistent, use the session key saved in the record to decrypt the dynamic tag; if the decryption fails, it is judged to be an invalid authentication request and the authentication process ends; if the decryption is successful, and the unique identifier and session key of the user obtained by decryption are consistent with the unique identifier and session key of the user saved in the record, and the session key life cycle is valid, and the current timestamp in the dynamic tag is valid, then the dynamic tag is judged to be valid;

[0028] The authentication server sends the decrypted unique identifier and session key of the user to the client via the application server, completing the application service application authentication process.

[0029] Optionally, the authentication server sends the decrypted unique identifier and session key of the user to the client via the application server to complete the application service application authentication process, including:

[0030] The authentication server searches for the corresponding application server in the public key of the public-private key pair of the stored application server according to the unique identifier of the application server. If the query fails, it is determined to be an invalid application server and the authentication process ends;

[0031] If the query is successful, a new session key is randomly generated, and the public key in the public-private key pair of the application server is used to symmetrically encrypt the user's unique identifier, the original session key, the new session key, and the current timestamp, and send them to the application server. The new session key is used to replace the original session key stored in the record of the user authentication information list, and the life cycle of the session key in the record is updated;

[0032] The application server uses the private key in its own public-private key pair to decrypt the encrypted information sent by the authentication server. If the decryption fails, it is determined to be a fake authentication server and the authentication process ends;

[0033] If the decryption is successful, the user's unique identifier, the original session key, the new session key and the current timestamp are obtained, and it is determined whether the current timestamp is valid. If the current timestamp is invalid, it is determined to be a replay attack and the authentication process ends;

[0034] If the current timestamp is valid, determine whether the unique identifier of the user obtained by decryption is consistent with the unique identifier of the user sent by the user through the client. If they are inconsistent, determine that the application service application is impersonated and end the authentication process;

[0035] If they are consistent, the user's application service application authentication is successful. The application server uses the original session key as the encryption key to symmetrically encrypt the user's unique identifier, the new session key, and the current timestamp, and then sends it to the client.

[0036] The client uses the original session key to decrypt the encrypted information sent by the application server. If the decryption fails, the application server is considered to be an impersonator and the authentication process ends.

[0037] If the decryption is successful, the user's unique identifier, new session key, and current timestamp are obtained, and then the timestamp is determined to be valid. If the current timestamp is invalid, it is determined to be a replay attack and the authentication process ends;

[0038] If the timestamp is valid, the user's application service authentication to the application server is successful.

[0039] Optionally, after the user successfully authenticates the application service application of the application server, the method further includes:

[0040] The user communicates with the application server through the client and uses the new session key as the current session key to perform symmetrical encryption transmission on the data of this application service communication.

[0041] The embodiment of the present invention also provides a multi-application single-login authentication system, comprising: a client, an authentication server and a plurality of application servers; wherein the authentication server pre-assigns a unique identifier to the user according to the user name and user password;

[0042] The client is used to generate a user authentication request for any user according to the user name input by the user, and send the user authentication request to the authentication server;

[0043] The authentication server is used to randomly generate a session key according to the user authentication request, and use the user password as the encryption key to symmetrically encrypt the generated session key and the user's unique identifier to form encrypted information, and send it to the client;

[0044] The client is also used to decrypt the encrypted information sent by the authentication server according to the user password input by the user, and obtain the session key generated by the authentication server and the user's unique identifier to determine that the two-way authentication between the user and the authentication server is successful;

[0045] The client is also used to, after the user and the authentication server have successfully performed two-way authentication, use the session key generated by the authentication server as the encryption key to symmetrically encrypt the user's unique identifier to form a dynamic tag, and send it to the application server corresponding to the application service applied for by the user;

[0046] The authentication server is also used to decrypt the dynamic tag according to the generated session key after the application server sends the dynamic tag to the authentication server, and obtain the user's unique identifier to confirm that the user who has successfully completed the two-way authentication with the authentication server has successfully applied for the application service of the application server.

[0047] An embodiment of the present invention also provides a computer device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the above-mentioned multi-application single login authentication method.

[0048] An embodiment of the present invention further provides a computer-readable storage medium storing a computer program, wherein the computer program implements the above-mentioned multi-application single-login authentication method when executed by a processor.

[0049] The multi-application single login authentication method provided by the present invention has at least the following beneficial effects:

[0050] After the user enters the user name on the client, the client first generates a user authentication request based on the user name entered by the user and sends it to the authentication server. The authentication server will randomly generate a session key for the user, and use the user's password as the encryption key. After symmetrically encrypting the session key and the user's unique identifier, it will be sent to the client. At this time, if the client decrypts the encrypted information sent by the authentication server based on the user's password, and obtains the session key and the user's unique identifier generated by the authentication server, it can be confirmed that the two-way authentication between the user and the authentication server is successful. That is, the user enters the user name and user password once, and first performs two-way authentication with the authentication server.

[0051] After the user and the authentication server have successfully completed the two-way authentication, when the user applies for application services from any application server, the client uses the session key generated by the authentication server as the encryption key, symmetrically encrypts the user's unique identifier to form a dynamic tag, and sends it to the application server for which the user applied for the application service. Therefore, for any application service application for any application server, there is no need to enter the user name and password again. It is only necessary to send the user's dynamic tag (the user's unique identifier) ​​to the application server corresponding to the applied application service, and then the authentication server decrypts the dynamic tag according to the generated session key, that is, authenticates the user's identity. If the user's unique identifier is decrypted, it can be confirmed that the user who has successfully completed the two-way authentication with the authentication server has successfully authenticated the application service application of the application server, thereby realizing that by entering the user name and password once, it is possible to conveniently access the application services of multiple application servers, thereby realizing single sign-on.

[0052] Therefore, the present invention actually implements authentication of different users (including authentication between the user and the authentication server, and authentication between the user and the application server) through the authentication server. As long as the authentication server and the application server are reachable and accessible on the network, the user can implement authentication access to multiple application servers in any security domain through the client, and there is no cross-domain trust problem. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] One or more embodiments are exemplarily described by the pictures in the corresponding drawings, and these exemplary descriptions do not constitute limitations on the embodiments.

[0054] Figure 1 is a flow chart of a multi-application single login authentication method provided according to an embodiment of the present invention;

[0055] Figure 2 is a structural diagram of a multi-application single sign-on authentication system provided according to an embodiment of the present invention;

[0056] Figure 3 is a flowchart of system initialization provided according to an embodiment of the present invention;

[0057] Figure 4 This is a flowchart of a single authentication for user login provided according to an embodiment of the present invention;

[0058] Figure 5 The present invention provides a flowchart of a user requesting application service authentication according to an embodiment of the present invention. DETAILED DESCRIPTION

[0059] In order to make the purpose, technical scheme and advantages of the embodiments of the present invention clearer, the embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings. However, it will be appreciated by those skilled in the art that in the embodiments of the present invention, many technical details are proposed in order to enable the reader to better understand the present invention. However, even without these technical details and various changes and modifications based on the following embodiments, the technical scheme claimed in the present invention can be implemented. The division of the following embodiments is for the convenience of description and should not constitute any limitation on the specific implementation of the present invention. The various embodiments can be combined and referenced with each other without contradiction.

[0060] An embodiment of the present invention relates to a multi-application single-sign-on authentication method, which is applied to a multi-application single-sign-on authentication system, which includes: a client, an authentication server and multiple application servers; wherein the authentication server pre-assigns a unique identifier to a user based on the user's username and user password.

[0061] The specific process of the multi-application single sign-on authentication method of this embodiment can be as follows: Figure 1 As shown, including:

[0062] Step 101: For any user, the client generates a user authentication request according to the user name input by the user, and sends the user authentication request to the authentication server;

[0063] Step 102: The authentication server randomly generates a session key according to the user authentication request, and uses the user password as the encryption key to symmetrically encrypt the generated session key and the user's unique identifier to form encrypted information, and sends it to the client;

[0064] Step 103: If the client decrypts the encrypted information sent by the authentication server according to the user password input by the user and obtains the session key generated by the authentication server and the user's unique identifier, then the two-way authentication between the user and the authentication server is successful;

[0065] Step 104, after the user and the authentication server have successfully completed two-way authentication, the client uses the session key generated by the authentication server as an encryption key to symmetrically encrypt the user's unique identifier to form a dynamic tag, and sends it to the application server corresponding to the application service requested by the user;

[0066] Step 105, the application server sends the dynamic tag to the authentication server, so that the authentication server decrypts the dynamic tag according to the generated session key. If the decryption obtains the user's unique identifier, the user who has successfully performed two-way authentication with the authentication server successfully applies for application service authentication to the application server.

[0067] In this embodiment, after the user enters the user name on the client, the client first generates a user authentication request according to the user name entered by the user, and sends it to the authentication server. The authentication server will randomly generate a session key for the user, and use the user password of the user as the encryption key, symmetrically encrypt the session key and the user's unique identifier, and send it to the client. At this time, if the client decrypts the encrypted information sent by the authentication server according to the user password entered by the user, and obtains the session key generated by the authentication server and the user's unique identifier, it can be confirmed that the two-way authentication between the user and the authentication server is successful. That is, the user enters the user name and user password once, and first performs two-way authentication with the authentication server.

[0068] After the user and the authentication server have successfully completed the two-way authentication, when the user applies for application services from any application server, the client uses the session key generated by the authentication server as the encryption key, symmetrically encrypts the user's unique identifier to form a dynamic tag, and sends it to the application server for which the user applied for the application service. Therefore, for any application service application for any application server, there is no need to enter the user name and password again. It is only necessary to send the user's dynamic tag (the user's unique identifier) ​​to the application server corresponding to the applied application service, and then the authentication server decrypts the dynamic tag according to the generated session key, that is, authenticates the user's identity. If the user's unique identifier is decrypted, it can be confirmed that the user who has successfully completed the two-way authentication with the authentication server has successfully authenticated the application service application of the application server, thereby realizing that by entering the user name and password once, it is possible to conveniently access the application services of multiple application servers, thereby realizing single sign-on.

[0069] Therefore, in this embodiment, authentication of different users (including authentication between the user and the authentication server, and authentication between the user and the application server) is actually implemented through the authentication server. As long as the authentication server and the application server are reachable and accessible through the network, the user can implement authentication access to multiple application servers in any security domain through the client, and there is no cross-domain trust issue.

[0070] The implementation details of the multi-application single sign-on authentication method of this embodiment are specifically described below. The following content is only the implementation details provided for easy understanding and is not necessary for implementing this solution.

[0071] First, the multi-application single sign-on authentication system described in this embodiment is as follows Figure 2As shown, it includes multiple registered users (i.e., users), multiple clients for user login, an authentication server, and multiple application servers that provide different application services for registered users. Among them, registered users need to provide a user name and a user password when registering; the client for user login refers to a computer connected to the network to run a client login program and provide users with user names and user passwords when logging in; the authentication server includes a public key encryption label for a public key encryption system, a user authentication information list containing the current authentication information of all registered users, and an application server public key list for public key encryption containing all application servers; the application server includes an application server unique identifier that is automatically assigned by the authentication server to identify its own identity, its own public key encryption label for a public key encryption system, and the authentication server public key.

[0072] For the authentication server, its public key encryption tag contains a public-private key pair for public key encryption automatically generated by the authentication server and assigned to itself: a private key and a public key. The user authentication information list contains one or more records, each of which contains a user unique identifier automatically assigned to the registered user, a user name, a digital summary of the user password, the user's current session key, the life cycle of the session key, and the IP address of the client currently logged in by the user. The application server public key list also contains one or more records, each of which contains an automatically assigned application server unique identifier that identifies the application server, and the application server's own public key used for public key encryption.

[0073] The multi-application single-sign-on authentication method described in this embodiment specifically includes three parts: (1) system initialization; (2) user login single-sign-on authentication; and (3) user request for application service authentication.

[0074] The specific process of system initialization is as follows: Figure 3 As shown, the following steps are included:

[0075] Step 3-1: The authentication server automatically generates a public-private key pair for the public key encryption system and stores it in the public key encryption tag of the authentication server;

[0076] Step 3-2: Each application server automatically generates a public-private key pair for the public key encryption system and stores it in its own public key encryption tag;

[0077] Step 3-3: The application server is registered on the authentication server, an application server unique identifier is automatically assigned to each application server, each application server unique identifier and its corresponding public key are saved in the application server public key list of the authentication server; the application server unique identifier and the authentication server public key are saved in the registered application server;

[0078] Step 3-4: User registration is done on the authentication server. After the user successfully registers as required, a new record corresponding to the user is created in the user authentication information list of the authentication server. A unique identifier for the user is automatically generated and saved in the record. The user's username is saved in the corresponding record. After the digital summary of the user password provided by the user during registration is calculated, the digital summary value is saved in the corresponding record.

[0079] The specific process of user login single authentication is as follows Figure 4 As shown, the following steps are included:

[0080] Step 4-1: The user uses the client to send the user name to the authentication server to request authentication;

[0081] Step 4-2: The authentication server receives the user authentication request, obtains the user name for the authentication request and the IP address of the client used by the user, and searches the user name for the authentication request in the user authentication information list; if the query fails, it is determined to be a non-registered user and the authentication process ends; if the query succeeds, a session key is randomly generated, and the session key and the client IP address are saved in the record corresponding to the user in the user authentication information list, and the life cycle of the session key is set; then the digital summary of the user password saved in the record is used as the encryption key, and the user's unique identifier, session key and current timestamp are symmetrically encrypted together, and sent to the client requesting authentication;

[0082] Step 4-3: After receiving the encrypted information, the client requires the user requesting authentication to enter the user password, uses the same hash algorithm as the authentication server to calculate the digital summary of the user password, and uses the digital summary as the decryption password of the symmetric encryption to decrypt the received encrypted information; if the decryption is successful and the timestamp is valid, the user and the authentication server have successfully verified each other, the user's unique identifier is saved in the memory, and the received session key is saved in the memory as the current session key, otherwise the authentication fails and the single authentication process ends.

[0083] The specific process of users requesting application service authentication is as follows Figure 5 As shown, the following steps are included:

[0084] When a user who has successfully passed the above authentication needs to apply for application services from an application server, he / she shall follow the steps below to complete the application authentication and service information transmission process.

[0085] Step 5-1: The client uses the current session key as the encryption key for symmetric encryption to symmetric-encrypt the user's unique identifier, the current session key, and the current timestamp. The encryption result is used as the dynamic tag for the user's request for application services. The client sends the user's unique identifier and the dynamic tag to the application server that is about to request services.

[0086] Step 5-2: After receiving the user unique identifier and dynamic tag sent by the client, the application server extracts the client IP address, and uses the public key of the authentication server to encrypt the application server unique identifier, user unique identifier, client IP address, and dynamic tag together, and sends them to the authentication server;

[0087] Step 5-3: The authentication server receives the encrypted information sent by the application server, decrypts it with its own private key, and obtains the application server unique identifier, user unique identifier, client IP address, and dynamic tag; searches the user authentication information list for the record corresponding to the user unique identifier. If the query fails, it is determined to be a fake user, the authentication fails, and the authentication process ends; if the query succeeds, the client IP address stored in the record is compared with the client IP address sent by the application server to see if they are consistent. If they are inconsistent, it is determined to be an impersonation or invalid authentication request, the authentication fails, and the authentication process ends; if the comparison is successful, the record is used to verify the identity of the user. The stored session key is used to decrypt the dynamic tag. If the decryption fails, it is judged as an invalid authentication request and the authentication process ends. If the decryption succeeds, and the user unique identifier and session key obtained by decryption are consistent with the corresponding values ​​stored in the record, and the session key life cycle is valid (the life cycle is valid means that the time value of the life cycle does not exceed the current time value of the authentication server), and the timestamp in the dynamic tag is valid (the timestamp is valid means that the deviation between the time value of the timestamp and the current time value of the authentication server is within a preset range), then the dynamic tag is judged to be valid and step 5-4 is continued; otherwise, it is judged to be a false request or an expired request, the authentication fails, and the authentication process ends;

[0088] Step 5-4: The authentication server uses the received application server unique identifier to search for the corresponding application server public key list record in its own application server public key list. If the search fails, it is judged as an invalid application server, the authentication fails, and the authentication process ends; if the search is successful, the authentication server randomly generates a new session key, uses the public key of the corresponding application server stored in the application server public key list record, encrypts the user unique identifier, the old session key (referring to the session key stored in the corresponding user authentication information list record), the new session key (referring to the randomly generated new session key), and the current timestamp together, and sends them to the application server; the authentication server uses the new session key to replace the old session key stored in the corresponding user authentication information list record, and updates the lifetime value of the session key in the record;

[0089] Step 5-5: The application server receives the information sent by the authentication server and decrypts it using its own private key; if the decryption fails, it is determined to be a fake authentication server and the authentication process ends; if the decryption is successful, the user unique identifier, old session key, new session key, and timestamp are obtained, and it is determined whether the timestamp is valid. If the timestamp is invalid, it is determined to be a replay attack and the authentication process ends; if the timestamp is valid, it is determined whether the user unique identifier obtained by decryption is consistent with the user unique identifier sent by the user. If they are inconsistent, it is determined that the application service request is impersonated, the authentication fails, and the authentication process ends; if they are consistent, it is determined that the user's application service request is authenticated successfully, and the application server uses the old session key as the symmetric encryption key to symmetrically encrypt the user unique identifier, new session key, and current timestamp, and sends the encryption result to the client;

[0090] Step 5-6: The client receives the encrypted information packet sent by the application server and decrypts it using the current session key (old key). If the decryption fails, the application server is judged to be an impersonator and the authentication process ends. If the decryption succeeds, the unique user identifier, new session key, and timestamp are obtained, and the timestamp is judged to be valid. If the timestamp is invalid, it is judged to be a replay attack and the authentication process ends. If the timestamp is valid, the application request to the application server is authenticated successfully, and communication with the application service of the application server can begin.

[0091] Step 5-7: The user successfully requests application service authentication from the application server on the client, and application service communication between the two parties begins. Both parties use the new session key as the current session key to symmetrically encrypt and transmit the data of this application service communication.

[0092] Therefore, users can repeat Figure 5 By following the steps shown in the figure to request application services, you can automatically use dynamic tags to request services from other application servers.

[0093] It can be seen that this embodiment provides a multi-application single-login authentication method based on dynamic tags. This method realizes that after a user logs in to an authentication server once and successfully authenticates by providing a user name and password, a dynamic tag is formed. When applying for application services from other registered application servers, the dynamic tag is used to realize automatic authentication between the application server and the user, without having to repeatedly enter the user name and password for authentication for each application service request. The network environment of this method can be different complex network environments such as wide area networks, local area networks, and cloud computing virtual platforms. The deployment of multiple application services is not limited by the trust domain of the network environment. In addition, one authentication communication can realize mutual two-way authentication between the user and the authentication server, between the user and the application server, and between the authentication server and the application server, and can prevent replay attacks and any counterfeit attacks on the user, the authentication server, and the application server. Furthermore, each time an application service is requested, the session key in the dynamic tag will change, and this change enhances the confidentiality of the communication data between the user and the application server that is symmetrically encrypted using the session key.

[0094] The following is a specific example to illustrate the multi-application single login authentication method of the present invention:

[0095] In this embodiment, the client, authentication server, and application server are interconnected through a local area network and a wide area network. The client, authentication server, and application server may also be partially or entirely virtual machines in a cloud computing environment, interconnected through a virtual network.

[0096] When a user registers, he / she uses a registration application or a registration web page on the client to register with the authentication server through the network. When registering, he / she needs to provide a username username and a user password userpass, and the authentication server assigns a unique identifier UID to the user.

[0097] The authentication server includes a public key encryption tag for a public key encryption system, a user authentication information list containing current authentication information of all registered users, and an application server public key list containing all application servers for public key encryption.

[0098] The public key encryption tag contained in the authentication server includes a public-private key pair for the public key encryption system automatically generated by the authentication server and assigned to itself: private key CS_private_key and public key CS_public_key; the private key is used for the authentication server to sign the sent information during the authentication process, and the public key is used to decrypt the corresponding private key signature; the public key encryption algorithm can use the standard RSA algorithm or the Elliptic Curve Cryptography (ECC) algorithm.

[0099] The authentication server contains a list of user authentication information. The table contains one or more records. Each record contains a unique user identifier UID automatically assigned to the registered user, the username username, the digital summary Hash (userpass) of the user's password, the user's current session key session_key, the lifetime of the session key lifetime, and the client IP address IP_addr used by the user to log in.

[0100] The user authentication information list is implemented using a database storage table.

[0101] The user's unique identifier UID is a string of numbers automatically assigned by the authentication server during registration. The length depends on the number of users and can be 16 or 32 digits.

[0102] The user password is not stored in plain text in the user authentication information list. Instead, the digital summary of the user password inscription is calculated using a hash function and the digital summary value is stored. The purpose is to enhance the confidentiality of the user password; the hash function for calculating the digital summary can use a standard algorithm (Message Digest Algorithm 5, MD5) or a secure hash algorithm (Secure Hash Algorithm, SHA) series function.

[0103] The user's current session key session_key is the key used to symmetrically encrypt communication data when the user communicates with the authentication server or application server. The symmetric encryption algorithm uses standard algorithms such as (DataEncryption Standard, DES) and (AdvancedEncryptionStandard, AES).

[0104] The lifetime of the session key is a time value. When the current time value of the authentication server exceeds the lifetime value of the session key, the session key becomes invalid and the user needs to re-enter the password for single login. The lifetime of the session key is usually set to within 8 hours after the session key is generated.

[0105] The client IP address ip_addr used by the user to log in is extracted by the authentication server from the network IP message packet of the user requesting authentication and stored in the record corresponding to the user authentication information list of the authentication server.

[0106] The application server public key list in the authentication server contains one or more record information, each record contains an automatically assigned application server unique identifier ASID that identifies the application server identity, and the application server's own public key AS_public_key used for public key encryption.

[0107] The unique identifier of the application server, ASID, is a string of numbers automatically assigned by the authentication server when the application server registers with the authentication server, and uses an 8-bit or 16-bit value.

[0108] When the application server registers with the authentication server, it needs to automatically generate its own public-private key pair for the public key encryption system: private key AS_private_key and public key AS_public_key; the private key is used by the application server to sign the information it sends, and the public key is used to decrypt the corresponding private key signature. The application server public key encryption algorithm uses the same public key encryption standard algorithm as the authentication server.

[0109] The authentication server needs to store the public keys of all application servers, and all application servers need to store the public key of the authentication server to achieve mutual authentication between the authentication server and the application servers.

[0110] The hash algorithm, symmetric encryption algorithm, and public key encryption algorithm used by the client, authentication server, and application server must be consistent, including the key length of the corresponding algorithm used must be the same.

[0111] First, initialize the system:

[0112] (1) The authentication server CS automatically generates a pair of public key encryption keys: private key CS_private_key and public key CS_public_key, which are stored in the public key encryption tag of the authentication server;

[0113] In this embodiment, the public key encryption standard RSA algorithm is used, and the key length is selected as 1024 bits;

[0114] (2) The application server AS automatically generates a public-private key pair for the public key encryption system: private key AS_private_key and public key AS_public_key, and stores them in its own public key encryption tag. The public key encryption algorithm and key length are the same as those of the authentication server.

[0115] (3) The application server AS is registered on the authentication server CS. The authentication server automatically assigns an application server unique identifier ASID to the application server, saves the application server unique identifier ASID and its corresponding public key AS_public_key in the application server public key list of the authentication server; and saves the application server unique identifier ASID and the authentication server public key CS_public_key in the registered application server.

[0116] (4) The user registers according to the organization's requirements. The registration information that must be provided for successful registration includes the user name username and user password userpass. After the user successfully registers, the authentication server saves a record corresponding to the user in its user authentication information list. The user's unique identifier UID in the record is automatically generated by the authentication server. The user's username username is saved in the corresponding record. After calculating the digital digest of the user password userpass provided by the user during registration, the digital digest value Hash (userpass) is saved in the corresponding record.

[0117] In this embodiment, the user registration process is completed by using a browser to remotely access a web page, and the digital summary is calculated using the international standard SHA-256 algorithm to generate a 256-bit digital summary value.

[0118] The above system initialization work is aimed at establishing a trust relationship between the authentication server and the application server, wherein the public and private key pairs of the servers are used for mutual authentication between the authentication server and the application server in the subsequent user authentication service and application request service process. New application servers can be added to the system at any time. The newly added application servers only need to complete the registration with the authentication server according to steps (2) and (3).

[0119] Then, perform a single authentication for user login:

[0120] (1) The user uses the client to send the username username to the authentication server CS to request authentication;

[0121] In this embodiment, the user's access request to the authentication server and the application server is completed by running the web application using a browser;

[0122] During the user login process, the user needs to enter the username and password once. For the username and password entered by the user on the login page, only the username is transmitted to the authentication server without transmitting the user password. The password entered by the user is stored in the client memory for the client local verification in step 3-3;

[0123] (2) The authentication server AS receives the user authentication request, obtains the username username and the IP address IP_addr of the client used by the user, and uses the username to query the user record in the user authentication information list; if the query fails, it is determined that the user is not a registered user and the authentication process ends; if the query succeeds, it randomly generates a session key session_key, saves the session_key and IP_addr to the user record, and sets the lifetime of the session key in the record; then uses the digital summary Hash (userpass) of the user password saved in the record as the encryption key, symmetrically encrypts the user's unique identifier UID, the session key session_key and the current timestamp timestamp_CS, and sends them to the client requesting authentication;

[0124] In this embodiment, the authentication server can directly extract the IP address of the client from the network data message; after the user logs in once, it is only valid on the client used when logging in. If the user changes the client used, the user must re-enter the user name and password to log in;

[0125] The generated session key is used for symmetric encryption of subsequent communication data packets between the user and the application server. The key length is 256 bits.

[0126] The session key lifetime is set to 8 hours, that is, the lifetime value is the current time value when the session key is generated + 8 hours;

[0127] Use the digital summary Hash (userpass) of the user password as the encryption key for symmetric encryption. The symmetric encryption algorithm is the standard AES algorithm with a key length of 256 bits.

[0128] (3) After receiving the encrypted information sent by the authentication server, the client uses the same hash algorithm as the authentication server to calculate the digital summary value Hash(userpass)_client of the user password userpass entered when the user logged in, and uses Hash(userpass)_client as the key to decrypt the received encrypted information; if the decryption is successful and the timestamp timestamp_CS is valid, the user and the authentication server have successfully authenticated each other, and the user's unique identifier UID is saved in the memory, and the received session key session_key is saved in the memory as the current session key; otherwise, the authentication fails, and the single authentication process ends;

[0129] In this embodiment, the authentication server, client, and application server use the same symmetric encryption standard algorithm AES;

[0130] The timestamp is to prevent replay attacks. The timestamp is valid when the timestamp_CS obtained by decryption is compared with the timestamp of the client's current time. If the error is less than a preset value, it is valid. In the embodiment, the preset value is 240 seconds.

[0131] After the user enters the user name and password and completes single login authentication with the authentication server, he or she does not need to enter the user name and password again when applying for application services from the application server during the login validity period; the login validity period means that the user does not change the login client and the current session key does not expire.

[0132] Next, the user requests the application service:

[0133] (1) The client uses the current session key session_key as the encryption key for symmetric encryption to symmetric-encrypt the user unique identifier UID, the current session key session_key, and the client's current timestamp timestamp_Client. The encryption result is used as the dynamic label dync_Ulabel for the user's request for application service. The client sends the plaintext user unique identifier UID and the ciphertext dynamic label dync_Ulabel to the application server AS that is about to request the service.

[0134] (2) After receiving the user unique identifier UID and dynamic label dync_Ulabel sent by the client, the application server AS extracts the client IP address IP_addr from the network message, and uses the saved public key CS_public_key of the authentication server CS as the encryption key to encrypt the application server unique identifier ASID, the user unique identifier UID, the client IP address IP_addr, and the dynamic label dync_Ulabel together, and sends them to the authentication server;

[0135] In this embodiment, the public key encryption standard RSA algorithm is used, and the key length is selected as 1024 bits;

[0136] (3) The authentication server CS receives the encrypted information sent by the application server AS, decrypts it using its own private key CS_private_key, and obtains the application server unique identifier ASID, the user unique identifier UID, the client IP address IP_addr, and the dynamic label dync_Ulabel; it searches the user authentication information list for the record corresponding to the user unique identifier UID. If the query fails, it is determined to be a fake user, the authentication fails, and the authentication process ends; if the query succeeds, it compares the client IP address stored in the record with the client IP address sent by the application server to see if they are consistent. If If they are not consistent, it is judged as an impersonation or invalid authentication request, the authentication fails, and the authentication process ends; if the comparison is successful, the session key session_key stored in the record is used to decrypt the dynamic label dync_Ulabel. If the decryption fails, it is judged as an invalid authentication request and the authentication process ends; if the decryption is successful, and the user unique identifier and session key obtained by decryption are consistent with the corresponding values ​​stored in the record, and the session key life cycle is valid, and the timestamp in the dynamic label is valid, then the dynamic label is judged to be valid and the step (4) is continued; otherwise, it is judged as a false request or an expired request, the authentication fails, and the authentication process ends;

[0137] In this embodiment, since the dynamic tag is forwarded by the application server to the authentication server, which increases the network delay, and the authentication server private key decryption also increases the time delay, after the authentication server decrypts the dynamic tag, the validity judgment of the timestamp therein should increase the time delay. In this embodiment, the timestamp error value is set to 720 seconds;

[0138] (4) The authentication server CS uses the received application server unique identifier ASID to search for the corresponding application server public key list record in its own application server public key list. If the search fails, it is judged as an invalid application server, the authentication fails, and the authentication process ends; if the search succeeds, the authentication server randomly generates a new session key session_key_new, and uses the public key AS_public_key of the corresponding application server stored in the application server public key list record to encrypt the user unique identifier UID, the old session key session_key (referring to the session key stored in the corresponding user authentication information list record), the new session key session_key_new (referring to the randomly generated new session key), and the current timestamp timestamp together, and sends them to the application server AS; the authentication server CS uses the new session key session_key_new value to replace the old session key stored in the corresponding user authentication information list record, and updates the lifetime value lifetime of the session key in the record;

[0139] (5) The application server AS receives the information sent by the authentication server CS and decrypts it using its own private key AS_private_key. If the decryption fails, it is determined to be a fake authentication server and the authentication process ends. If the decryption succeeds, the user unique identifier UID, the old session key session_key, the new session key session_key_new, and the timestamp timestamp are obtained. It is determined whether the timestamp is valid. If the timestamp is invalid, it is determined to be a replay attack and the authentication process ends. If the timestamp is valid, it is determined whether the user unique identifier obtained by decryption is consistent with the user unique identifier UID sent by the user. If they are inconsistent, it is determined that the application service request is impersonated, the authentication fails, and the authentication process ends. If they are consistent, it is determined that the user's application service request is authenticated successfully, and the application server uses the old session key session_key as the symmetric encryption key to symmetric encrypt the user unique identifier UID, the new session key session_key_new, and the current timestamp timestamp, and sends the encryption result to the client.

[0140] In this embodiment, the current timestamp refers to the timestamp generated by the application server according to its own time;

[0141] (6) The client receives the encrypted information packet sent by the application server AS and decrypts it using the current session key session_key (old key). If the decryption fails, the application server is judged to be an impersonator and the authentication process ends. If the decryption succeeds, the client obtains the user unique identifier UID, the new session key session_key_new, and the timestamp timestamp and determines whether the timestamp is valid. If the timestamp is invalid, it is judged to be a replay attack and the authentication process ends. If the timestamp is valid, the application request to the application server is successfully authenticated, and the new session key session_key_new is used to replace the value of the old session key session_key, and communication with the application service of the application server begins.

[0142] (7) The user successfully requests application service authentication from the application server AS on the client, and application service communication between the two parties begins. Both parties use the new session key as the current session key to perform symmetrical encryption transmission on the data of this application service communication.

[0143] Each time a user successfully requests an application service, a new session key will be generated for symmetric encryption of data between the two parties.

[0144] Therefore, the user repeats the above steps of requesting application services, and can automatically use dynamic tags to request services from other application servers.

[0145] The step division of the various methods above is only for clear description. When implemented, they can be combined into one step or some steps can be split and decomposed into multiple steps. As long as they include the same logical relationship, they are all within the protection scope of the present invention. Adding insignificant modifications or introducing insignificant designs to the algorithm or process without changing the core design of the algorithm and process are all within the protection scope of the invention.

[0146] Another embodiment of the present invention relates to a multi-application single-sign-on authentication system. The implementation details of the multi-application single-sign-on authentication system of this embodiment are specifically described below. The following content is only for the convenience of understanding the implementation details provided, and is not necessary for implementing this solution. The multi-application single-sign-on authentication system of this embodiment includes: a client, an authentication server, and multiple application servers; wherein the authentication server pre-assigns a unique identifier to the user according to the user name and user password of the user;

[0147] The client is used to generate a user authentication request for any user according to the user name input by the user, and send the user authentication request to the authentication server;

[0148] The authentication server is used to randomly generate a session key according to the user authentication request, and use the user password as the encryption key to symmetrically encrypt the generated session key and the user's unique identifier to form encrypted information, and send it to the client;

[0149] The client is also used to decrypt the encrypted information sent by the authentication server according to the user password input by the user, and obtain the session key generated by the authentication server and the user's unique identifier to determine that the two-way authentication between the user and the authentication server is successful;

[0150] The client is also used to, after the user and the authentication server have successfully performed two-way authentication, use the session key generated by the authentication server as the encryption key to symmetrically encrypt the user's unique identifier to form a dynamic tag, and send it to the application server corresponding to the application service applied for by the user;

[0151] The authentication server is also used to decrypt the dynamic tag according to the generated session key after the application server sends the dynamic tag to the authentication server, and obtain the user's unique identifier to confirm that the user who has successfully completed the two-way authentication with the authentication server has successfully applied for the application service of the application server.

[0152] It is not difficult to find that this embodiment is a system embodiment corresponding to the above method embodiment, and this embodiment can be implemented in conjunction with the above method embodiment. The relevant technical details and technical effects mentioned in the above embodiment are still valid in this embodiment, and in order to reduce repetition, they are not repeated here. Accordingly, the relevant technical details mentioned in this embodiment can also be applied in the above embodiment.

[0153] It is worth mentioning that all modules involved in this embodiment are logic modules. In practical applications, a logic unit can be a physical unit, a part of a physical unit, or a combination of multiple physical units. In addition, in order to highlight the innovative part of the present invention, this embodiment does not introduce units that are not closely related to solving the technical problem proposed by the present invention, but this does not mean that there are no other units in this embodiment.

[0154] Another embodiment of the present invention relates to a computer device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the multi-application single login authentication method in the above-mentioned embodiments.

[0155] Among them, the memory and the processor are connected in a bus manner, and the bus may include any number of interconnected buses and bridges, and the bus connects various circuits of one or more processors and memories together. The bus can also connect various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be one element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices on a transmission medium. The data processed by the processor is transmitted on a wireless medium via an antenna, and further, the antenna also receives data and transmits the data to the processor.

[0156] The processor is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. Memory can be used to store data used by the processor when performing operations.

[0157] Another embodiment of the present invention relates to a computer-readable storage medium storing a computer program, which implements the above method embodiment when executed by a processor.

[0158] That is, those skilled in the art can understand that all or part of the steps in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a program, and the program is stored in a storage medium, including a number of instructions for a device (which can be a single-chip microcomputer, chip, etc.) or a processor (processor) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as: ROM), random access memory (Random Access Memory, referred to as: RAM), disk or optical disk and other media that can store program codes.

[0159] Those skilled in the art will appreciate that the above embodiments are specific embodiments for implementing the present invention, and in actual applications, various changes may be made thereto in form and detail without departing from the spirit and scope of the present invention.

Claims

1. A multi-application single sign-on authentication method, characterized in that: Applied to a multi-application single-login authentication system, the system comprises: a client, an authentication server and a plurality of application servers; wherein the authentication server pre-assigns a unique identifier to the user according to the user name and user password; The method comprises: For any user, the client generates a user authentication request according to the user name input by the user, and sends the user authentication request to the authentication server; The authentication server randomly generates a session key according to the user authentication request, and uses the user password as the encryption key to symmetrically encrypt the generated session key and the user's unique identifier to form encrypted information, which is then sent to the client. If the client decrypts the encrypted information sent by the authentication server according to the user password entered by the user, and obtains the session key generated by the authentication server and the user's unique identifier, then the two-way authentication between the user and the authentication server is successful; After the user and the authentication server have successfully completed two-way authentication, the client uses the session key generated by the authentication server as the encryption key to symmetrically encrypt the user's unique identifier to form a dynamic tag, and sends it to the application server corresponding to the application service requested by the user; The application server sends the dynamic tag to the authentication server so that the authentication server decrypts the dynamic tag according to the generated session key. If the decryption obtains the user's unique identifier, the user who has successfully completed the two-way authentication with the authentication server will successfully authenticate the application service application of the application server.

2. The multi-application single sign-on authentication method according to claim 1, characterized in that: The authentication server includes a user authentication information list having current authentication information of all users, the user authentication information list includes one or more records, each record includes a user name, a digital summary of a user password calculated using a hash algorithm, a unique identifier, a session key, a life cycle of the session key, and an IP address of a client currently logged in; The authentication server randomly generates a session key according to the user authentication request, and uses the user password of the user as the encryption key, symmetrically encrypts the generated session key and the user's unique identifier to form encrypted information, and sends it to the client, including: The authentication server receives the user authentication request and obtains the user name of the user requesting authentication and the IP address of the client currently used by the user to log in; The user name is searched in the user authentication information list. If the search fails, the user is judged as a non-registered user and the authentication process ends. If the search succeeds, a session key is randomly generated, and a life cycle is set for the session key. The session key and the client's IP address are saved in the record corresponding to the user in the user authentication information list. The digital summary of the user's password is used as the encryption key, and the user's unique identifier, session key and current timestamp are symmetrically encrypted and sent to the client.

3. The multi-application single sign-on authentication method according to claim 2, characterized in that: If the client decrypts the encrypted information sent by the authentication server according to the user password input by the user, and obtains the session key generated by the authentication server and the unique identifier of the user, then the two-way authentication between the user and the authentication server is successful, including: Obtain the user password entered by the user on the client, and use the hash algorithm to calculate the digital summary of the user password, and use the digital summary of the user password as the decryption password of the symmetric encryption to decrypt the encrypted information sent by the authentication server; If the decryption is successful, and the session key and the user's unique identifier generated by the authentication server are obtained, and the current timestamp is valid, then the user and the authentication server have successfully completed the two-way authentication, and the user's unique identifier and session key are saved; if the decryption fails, then the authentication fails and the authentication process ends.

4. The multi-application single sign-on authentication method according to claim 3, characterized in that: The client uses the session key generated by the authentication server as the encryption key, symmetrically encrypts the user's unique identifier to form a dynamic tag, and sends it to the application server corresponding to the application service applied by the user, including: The client uses the session key generated by the authentication server as the encryption key to symmetrically encrypt the user's unique identifier, session key and current timestamp, and uses the encryption result as the dynamic tag for the user's application for application service, and sends the user's unique identifier and dynamic tag to the application server corresponding to the application service applied by the user.

5. The multi-application single sign-on authentication method according to claim 4, characterized in that: The authentication server corresponds to a pair of public-private key pairs, and each application server also corresponds to a pair of public-private key pairs, and the authentication server stores the public key of the public-private key pair of each application server, and each application server stores the public key of the public-private key pair of the authentication server; wherein each application server has been pre-registered on the authentication server and is assigned a unique identifier by the authentication server; The application server sends the dynamic tag to the authentication server, so that the authentication server decrypts the dynamic tag according to the generated session key. If the decryption obtains the unique identifier of the user, the user who has successfully completed the two-way authentication with the authentication server successfully applies for the application service of the application server, including: The application server extracts the IP address of the client according to the unique identifier of the user and the dynamic tag sent by the client, and uses the public key in the public-private key pair of the authentication server to encrypt the unique identifier of the application server, the unique identifier of the user, the IP address of the client and the dynamic tag, and sends them to the authentication server; The authentication server uses the private key in its own public-private key pair to decrypt the encrypted information sent by the application server, and obtains the unique identifier of the application server, the unique identifier of the user, the IP address of the client, and the dynamic label; Query the record corresponding to the user's unique identifier in the user authentication information list. If the query fails, the user is judged to be a fake user and the authentication process ends; if the query succeeds, compare whether the IP address of the client saved in the record is consistent with the IP address of the client sent by the application server; if they are inconsistent, it is judged to be an impersonation or invalid authentication request and the authentication process ends; if they are consistent, use the session key saved in the record to decrypt the dynamic tag; if the decryption fails, it is judged to be an invalid authentication request and the authentication process ends; if the decryption is successful, and the unique identifier and session key of the user obtained by decryption are consistent with the unique identifier and session key of the user saved in the record, and the session key life cycle is valid, and the current timestamp in the dynamic tag is valid, then the dynamic tag is judged to be valid; The authentication server sends the decrypted unique identifier and session key of the user to the client via the application server, completing the application service application authentication process.

6. The multi-application single sign-on authentication method according to claim 5, characterized in that: The authentication server sends the decrypted unique identifier and session key of the user to the client via the application server, completing the application service application authentication process, including: The authentication server searches for the corresponding application server in the public key of the public-private key pair of the stored application server according to the unique identifier of the application server. If the query fails, it is determined to be an invalid application server and the authentication process ends; If the query is successful, a new session key is randomly generated, and the public key in the public-private key pair of the application server is used to symmetrically encrypt the user's unique identifier, the original session key, the new session key, and the current timestamp, and send them to the application server. The new session key is used to replace the original session key stored in the record of the user authentication information list, and the life cycle of the session key in the record is updated; The application server uses the private key in its own public-private key pair to decrypt the encrypted information sent by the authentication server. If the decryption fails, it is determined to be a fake authentication server and the authentication process ends; If the decryption is successful, the user's unique identifier, the original session key, the new session key and the current timestamp are obtained, and it is determined whether the current timestamp is valid. If the current timestamp is invalid, it is determined to be a replay attack and the authentication process ends; If the current timestamp is valid, determine whether the unique identifier of the user obtained by decryption is consistent with the unique identifier of the user sent by the user through the client. If they are inconsistent, determine that the application service application is impersonated and end the authentication process; If they are consistent, the user's application service application authentication is successful. The application server uses the original session key as the encryption key to symmetrically encrypt the user's unique identifier, the new session key, and the current timestamp, and then sends it to the client. The client uses the original session key to decrypt the encrypted information sent by the application server. If the decryption fails, the application server is considered to be an impersonator and the authentication process ends. If the decryption is successful, the user's unique identifier, new session key, and current timestamp are obtained, and then the timestamp is determined to be valid. If the current timestamp is invalid, it is determined to be a replay attack and the authentication process ends; If the timestamp is valid, the user's application service authentication to the application server is successful.

7. The multi-application single sign-on authentication method according to claim 6, characterized in that: After the user successfully authenticates the application service application of the application server, the method further includes: The user communicates with the application server through the client and uses the new session key as the current session key to perform symmetrical encryption transmission on the data of this application service communication.

8. A multi-application single sign-on authentication system, characterized in that: include: A client, an authentication server and a plurality of application servers; wherein the authentication server pre-assigns a unique identifier to the user according to the user's user name and user password; The client is used to generate a user authentication request for any user according to the user name input by the user, and send the user authentication request to the authentication server; The authentication server is used to randomly generate a session key according to the user authentication request, and use the user password as the encryption key to symmetrically encrypt the generated session key and the user's unique identifier to form encrypted information, and send it to the client; The client is also used to decrypt the encrypted information sent by the authentication server according to the user password input by the user, and obtain the session key generated by the authentication server and the user's unique identifier to determine that the two-way authentication between the user and the authentication server is successful; The client is also used to, after the user and the authentication server have successfully performed two-way authentication, use the session key generated by the authentication server as the encryption key to symmetrically encrypt the user's unique identifier to form a dynamic tag, and send it to the application server corresponding to the application service applied for by the user; The authentication server is also used to decrypt the dynamic tag according to the generated session key after the application server sends the dynamic tag to the authentication server, and obtain the user's unique identifier to confirm that the user who has successfully completed the two-way authentication with the authentication server has successfully applied for authentication of the application service of the application server.

9. A computer device, characterized in that: include: at least one processor; And, a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the multi-application single login authentication method as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the multi-application single sign-on authentication method according to any one of claims 1 to 7 is implemented.

Images