Multi-application single login authentication method, system, device and medium

Abstract

The present invention relates to the field of identity authentication technology, and more particularly to a multi-application single-login authentication method, system, device, and medium. In this method, a user enters a username and password once when logging in, and a symmetric encryption method is used to achieve two-way authentication between the user and an authentication server. When the user subsequently requests an application service from an application server in the system, the user does not need to repeatedly enter the username and password. Instead, a dynamic tag is generated and an authentication request is submitted to the application server. The application server and the authentication server exchange user authentication information, enabling the user to authenticate the application service application of the application server. In other words, a single authentication request can achieve two-way authentication between the user and the server.

Description

Technical Field

[0001] The present invention relates to the field of identity authentication technology, and in particular to a multi-application single login authentication method, system, device and medium. Background Art

[0002] In a network environment, application services are typically provided to users using a client / server (C / S) model. This involves users logging into a server using a client and requesting the server's application services. Typically, users access the system from the client and enter their username and password to log into the remote application server. The application server verifies the username and password provided by the user. If the verification is correct, the application server continues to provide the user with application services, and both parties exchange data over the network. If the verification fails, the application server refuses to provide further data transmission services to the user. The user login verification process is the process by which the application server authenticates the user's identity.

[0003] When an enterprise or organization provides users with multiple application services over a network, requiring users to enter their username and password for identity authentication each time they request a service is both inconvenient and unnecessary. Users want to be able to conveniently access and use multiple application services provided by the enterprise or organization by simply logging in and entering their username and password once. This is called single sign-on.

[0004] How to securely implement single sign-on (SSO) is a challenge facing many enterprises and organizations integrating diverse applications. This process faces numerous security threats, including replay attacks and impersonation attacks. Typical solutions include the Lightweight Directory Access method and the Kerberos system. However, both solutions involve cross-domain trust issues, as different security domains store separate user permission directories. Summary of the Invention

[0005] The purpose of the present invention is to provide a multi-application single login authentication method, system, device and medium without cross-domain trust issues.

[0006] To solve the above technical problems, an embodiment of the present invention provides a multi-application single sign-on authentication method, which is applied to a multi-application single sign-on authentication system. The system includes: a client, an authentication server, and multiple application servers; wherein the authentication server pre-assigns a unique identifier to the user based on the user's username and password;

[0007] The method comprises:

[0008] For any user, the client generates a user authentication request based on the user name entered by the user and sends the user authentication request to the authentication server;

[0009] The authentication server randomly generates a session key based on the user authentication request, and uses the user's password as the encryption key to symmetrically encrypt the generated session key and the user's unique identifier to form an encrypted message, which is then sent to the client.

[0010] If the client decrypts the encrypted information sent by the authentication server based on the user password entered by the user and obtains the session key generated by the authentication server and the user's unique identifier, then the two-way authentication between the user and the authentication server is successful;

[0011] After the user and the authentication server have successfully completed mutual authentication, the client uses the session key generated by the authentication server as the encryption key to symmetrically encrypt the user's unique identifier to form a dynamic tag, and sends it to the application server corresponding to the application service requested by the user;

[0012] The application server sends the dynamic tag to the authentication server so that the authentication server decrypts the dynamic tag according to the generated session key. If the decryption obtains the user's unique identifier, the user who has successfully completed the two-way authentication with the authentication server will successfully authenticate the application service application of the application server.

[0013] Optionally, the authentication server includes a user authentication information list having current authentication information of all users, the user authentication information list including one or more records, each record including a user name, a digital digest of the user password calculated using a hash algorithm, a unique identifier, a session key, a life cycle of the session key, and an IP address of a client currently logged in;

[0014] The authentication server randomly generates a session key according to the user authentication request, and uses the user password as the encryption key to symmetrically encrypt the generated session key and the user's unique identifier to form encrypted information, which is sent to the client, including:

[0015] The authentication server receives the user authentication request and obtains the username of the user requesting authentication and the IP address of the client currently used by the user to log in;

[0016] The user's username is searched in the user authentication information list. If the search fails, the user is judged to be an unregistered user and the authentication process ends. If the search succeeds, a session key is randomly generated and a life cycle is set for the session key. The session key and the client's IP address are saved in the user's corresponding record in the user authentication information list.

[0017] The digital summary of the user's password is used as the encryption key, and the user's unique identifier, session key and current timestamp are symmetrically encrypted and sent to the client.

[0018] Optionally, if the client decrypts the encrypted information sent by the authentication server according to the user password input by the user and obtains the session key generated by the authentication server and the unique identifier of the user, then the two-way authentication between the user and the authentication server is successful, including:

[0019] Obtain the user password entered by the user on the client, and use the hash algorithm to calculate the digital digest of the user password. Use the digital digest of the user password as the decryption password of the symmetric encryption to decrypt the encrypted information sent by the authentication server.

[0020] If the decryption is successful, and the session key and the user's unique identifier generated by the authentication server are obtained, and the current timestamp is valid, then the user and the authentication server have successfully completed the two-way authentication, and the user's unique identifier and session key are saved; if the decryption fails, the authentication fails, and the authentication process ends.

[0021] Optionally, the client uses the session key generated by the authentication server as an encryption key to symmetrically encrypt the user's unique identifier to form a dynamic tag, and sends it to the application server corresponding to the application service requested by the user, including:

[0022] The client uses the session key generated by the authentication server as the encryption key to symmetrically encrypt the user's unique identifier, session key and current timestamp, and uses the encryption result as the dynamic tag for the user's application for application service, and sends the user's unique identifier and dynamic tag to the application server corresponding to the application service applied by the user.

[0023] Optionally, the authentication server corresponds to a pair of public-private key pairs, and each application server also corresponds to a pair of public-private key pairs, and the authentication server stores the public key of the public-private key pair of each application server, and each application server stores the public key of the public-private key pair of the authentication server; wherein each application server has been pre-registered on the authentication server and is assigned a unique identifier by the authentication server;

[0024] The application server sends the dynamic tag to the authentication server, so that the authentication server decrypts the dynamic tag according to the generated session key. If the decryption obtains the user's unique identifier, then the user who has successfully bidirectionally authenticated with the authentication server successfully applies for the application service of the application server, including:

[0025] The application server extracts the client's IP address based on the user's unique identifier and dynamic tag sent by the client, and uses the public key from the authentication server's public-private key pair to encrypt the application server's unique identifier, the user's unique identifier, the client's IP address, and the dynamic tag, and sends the encrypted encrypted message to the authentication server.

[0026] The authentication server uses the private key in its public-private key pair to decrypt the encrypted information sent by the application server, obtaining the unique identifier of the application server, the unique identifier of the user, the IP address of the client, and the dynamic tag;

[0027] The record corresponding to the user's unique identifier is searched in the user authentication information list. If the query fails, the user is judged to be a fake user and the authentication process is terminated. If the query is successful, the IP address of the client saved in the record is compared with the IP address of the client sent by the application server to see if they are consistent. If they are inconsistent, it is judged to be an impersonation or invalid authentication request and the authentication process is terminated. If they are consistent, the dynamic tag is decrypted using the session key saved in the record. If the decryption fails, it is judged to be an invalid authentication request and the authentication process is terminated. If the decryption is successful, and the unique identifier and session key of the user obtained by decryption are consistent with the unique identifier and session key of the user saved in the record, and the session key life cycle is valid, and the current timestamp in the dynamic tag is valid, then the dynamic tag is judged to be valid.

[0028] The authentication server sends the decrypted user's unique identifier and session key to the client via the application server, completing the application service application authentication process.

[0029] Optionally, the authentication server sends the decrypted unique identifier and session key of the user to the client via the application server, completing the application service application authentication process, including:

[0030] The authentication server searches for the corresponding application server in the public key of the stored public-private key pair based on the unique identifier of the application server. If the query fails, the application server is determined to be invalid and the authentication process ends.

[0031] If the query is successful, a new session key is randomly generated. The public key in the application server's public-private key pair is used to symmetrically encrypt the user's unique identifier, the original session key, the new session key, and the current timestamp. The encryption key is then sent to the application server. The new session key replaces the original session key stored in the record of the user authentication information list, and the lifetime of the session key in the record is updated.

[0032] The application server uses the private key in its own public-private key pair to decrypt the encrypted information sent by the authentication server. If the decryption fails, it is determined to be a fake authentication server and the authentication process ends;

[0033] If the decryption is successful, the user's unique identifier, the original session key, the new session key, and the current timestamp are obtained, and the current timestamp is judged to be valid. If the current timestamp is invalid, it is judged as a replay attack and the authentication process ends;

[0034] If the current timestamp is valid, determine whether the unique identifier of the user obtained by decryption is consistent with the unique identifier of the user sent by the user through the client. If they are inconsistent, determine that the application service application is impersonated and end the authentication process;

[0035] If they match, the user's application service application authentication is successful. The application server uses the original session key as the encryption key to symmetrically encrypt the user's unique identifier, the new session key, and the current timestamp, and then sends it to the client.

[0036] The client uses the original session key to decrypt the encrypted information sent by the application server. If the decryption fails, the application server is considered to be impersonating and the authentication process ends.

[0037] If the decryption is successful, the user's unique identifier, new session key, and current timestamp are obtained. Then, the timestamp is determined to be valid. If the current timestamp is invalid, it is determined to be a replay attack and the authentication process ends.

[0038] If the timestamp is valid, the user's application service authentication to the application server is successful.

[0039] Optionally, after the user successfully authenticates the application service application of the application server, the method further includes:

[0040] The user communicates with the application server through the client and uses the new session key as the current session key to perform symmetrical encryption transmission on the data of this application service communication.

[0041] An embodiment of the present invention further provides a multi-application single-login authentication system, comprising: a client, an authentication server, and a plurality of application servers; wherein the authentication server pre-assigns a unique identifier to the user based on the user's username and password;

[0042] The client is used to generate a user authentication request for any user according to the user name input by the user, and send the user authentication request to the authentication server;

[0043] The authentication server is used to randomly generate a session key according to the user authentication request, and use the user password as the encryption key to symmetrically encrypt the generated session key and the user's unique identifier to form an encrypted message, and send it to the client;

[0044] The client is further configured to decrypt the encrypted information sent by the authentication server based on the user password entered by the user, and obtain the session key generated by the authentication server and the user's unique identifier, so as to confirm that the two-way authentication between the user and the authentication server is successful;

[0045] The client is further configured to, after successful mutual authentication between the user and the authentication server, symmetrically encrypt the user's unique identifier using the session key generated by the authentication server as an encryption key to form a dynamic tag, and send the tag to the application server corresponding to the application service requested by the user;

[0046] The authentication server is also used to decrypt the dynamic tag according to the generated session key after the application server sends the dynamic tag to the authentication server, and obtain the user's unique identifier to confirm that the user who has successfully completed two-way authentication with the authentication server has successfully applied for authentication of the application service of the application server.

[0047] An embodiment of the present invention also provides a computer device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the above-mentioned multi-application single login authentication method.

[0048] An embodiment of the present invention further provides a computer-readable storage medium storing a computer program, which implements the above-mentioned multi-application single-login authentication method when executed by a processor.

[0049] The multi-application single login authentication method provided by the present invention has at least the following beneficial effects:

[0050] After a user enters their username on the client, the client first generates a user authentication request based on the username and sends it to the authentication server. The authentication server then randomly generates a session key for the user and symmetrically encrypts the session key and the user's unique identifier using the user's password as the encryption key. The encrypted information is then sent to the client. If the client decrypts the encrypted information sent by the authentication server using the user's password, obtaining the session key and the user's unique identifier generated by the authentication server, the two-way authentication between the user and the authentication server is confirmed to be successful. In other words, the user enters their username and password once, and then performs two-way authentication with the authentication server.

[0051] After the user and the authentication server have successfully completed two-way authentication, when the user applies for application services from any application server, the client uses the session key generated by the authentication server as the encryption key to symmetrically encrypt the user's unique identifier to form a dynamic tag, and sends it to the application server where the user applies for application services. Therefore, for application service applications from any application server, there is no need to enter the user name and user password again. It is only necessary to send the user's dynamic tag (the user's unique identifier) ​​to the application server corresponding to the applied application service, and then the authentication server decrypts the dynamic tag based on the generated session key, that is, authenticates the user's identity. If the user's unique identifier is obtained by decryption, it can be confirmed that the user who has successfully completed two-way authentication with the authentication server has successfully authenticated the application service application of the application server, thereby realizing that by entering the user name and password once, you can easily access the application services of multiple application servers, thereby realizing single sign-on.

[0052] Therefore, the present invention actually uses the authentication server to realize the authentication of different users (including authentication between the user and the authentication server, and authentication between the user and the application server). As long as the authentication server and the application server are network reachable and accessible, the user can realize authentication access to multiple application servers in any security domain through the client, and there is no cross-domain trust problem. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] One or more embodiments are exemplarily described by the figures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments.

[0054] Figure 1 This is a flowchart of a multi-application single login authentication method provided according to an embodiment of the present invention;

[0055] Figure 2 1 is a schematic structural diagram of a multi-application single sign-on authentication system provided according to an embodiment of the present invention;

[0056] Figure 3 is a flowchart of system initialization provided according to an embodiment of the present invention;

[0057] Figure 4 This is a flowchart of a single authentication method for user login provided according to an embodiment of the present invention;

[0058] Figure 5 The present invention provides a flowchart of a user requesting application service authentication according to an embodiment of the present invention. DETAILED DESCRIPTION

[0059] To make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the embodiments of the present invention will be described in detail below with reference to the accompanying drawings. However, it will be understood by those skilled in the art that in the embodiments of the present invention, many technical details are provided to enable the reader to better understand the present invention. However, even without these technical details and the various changes and modifications based on the following embodiments, the technical solutions claimed in the present invention can be implemented. The division of the following embodiments is for convenience of description and should not constitute any limitation on the specific implementation of the present invention. The various embodiments can be combined with each other and referenced to each other under the premise that there is no contradiction.

[0060] An embodiment of the present invention relates to a multi-application single-sign-on authentication method, which is applied to a multi-application single-sign-on authentication system, which includes: a client, an authentication server and multiple application servers; wherein the authentication server pre-assigns a unique identifier to the user based on the user's username and user password.

[0061] The specific process of the multi-application single sign-on authentication method of this embodiment can be as follows: Figure 1 Shown, including:

[0062] Step 101: For any user, the client generates a user authentication request based on the user name input by the user, and sends the user authentication request to the authentication server;

[0063] Step 102: The authentication server randomly generates a session key based on the user authentication request, and uses the user password as the encryption key to symmetrically encrypt the generated session key and the user's unique identifier to form an encrypted message, which is then sent to the client.

[0064] In step 103, if the client decrypts the encrypted information sent by the authentication server according to the user password entered by the user and obtains the session key generated by the authentication server and the user's unique identifier, then the two-way authentication between the user and the authentication server is successful;

[0065] Step 104: After the user and the authentication server have successfully completed mutual authentication, the client uses the session key generated by the authentication server as the encryption key to symmetrically encrypt the user's unique identifier to form a dynamic tag, and sends it to the application server corresponding to the application service requested by the user;

[0066] In step 105, the application server sends the dynamic tag to the authentication server so that the authentication server decrypts the dynamic tag according to the generated session key. If the decryption obtains the user's unique identifier, the user who has successfully performed two-way authentication with the authentication server successfully applies for authentication of the application service of the application server.

[0067] In this embodiment, after a user enters their username on a client, the client first generates a user authentication request based on the username entered and sends it to the authentication server. The authentication server then randomly generates a session key for the user and symmetrically encrypts the session key and the user's unique identifier using the user's password as the encryption key. The encrypted information is then sent to the client. If the client decrypts the encrypted information sent by the authentication server using the user's password, obtaining the session key and the user's unique identifier generated by the authentication server, the two-way authentication between the user and the authentication server is confirmed to be successful. That is, the user enters their username and password once, and then performs two-way authentication with the authentication server.

[0068] After the user and the authentication server have successfully completed two-way authentication, when the user applies for application services from any application server, the client uses the session key generated by the authentication server as the encryption key to symmetrically encrypt the user's unique identifier to form a dynamic tag, and sends it to the application server where the user applies for application services. Therefore, for application service applications from any application server, there is no need to enter the user name and user password again. It is only necessary to send the user's dynamic tag (the user's unique identifier) ​​to the application server corresponding to the applied application service, and then the authentication server decrypts the dynamic tag based on the generated session key, that is, authenticates the user's identity. If the user's unique identifier is obtained by decryption, it can be confirmed that the user who has successfully completed two-way authentication with the authentication server has successfully authenticated the application service application of the application server, thereby realizing that by entering the user name and password once, you can easily access the application services of multiple application servers, thereby realizing single sign-on.

[0069] Therefore, in this embodiment, authentication of different users is actually achieved through the authentication server (including authentication between the user and the authentication server, and authentication between the user and the application server). As long as the authentication server and the application server are reachable and accessible on the network, the user can achieve authentication access to multiple application servers in any security domain through the client, and there is no cross-domain trust issue.

[0070] The following describes in detail the implementation details of the multi-application single sign-on authentication method of this embodiment. The following content is only provided for ease of understanding and is not essential for implementing this solution.

[0071] First, the multi-application single sign-on authentication system described in this embodiment is as follows Figure 2As shown, it includes multiple registered users (i.e., users), multiple client computers for user login, an authentication server, and multiple application servers that provide different application services to the registered users. A registered user needs to provide a username and password when registering; a client computer for user login refers to a computer connected to the network that runs a client login program and provides the user with a username and password when logging in; the authentication server includes a public key encryption tag for a public key encryption system, a user authentication information list containing the current authentication information of all registered users, and a list of application server public keys for public key encryption of all application servers; and the application server includes a unique application server identifier automatically assigned by the authentication server to identify itself, its own public key encryption tag for a public key encryption system, and the authentication server public key.

[0072] For an authentication server, its public key encryption tag contains a private key and a public key, automatically generated and assigned by the authentication server for public key encryption. The user authentication information list contains one or more records, each of which includes a unique identifier automatically assigned to a registered user, the username, a digital digest of the user's password, the user's current session key, the session key lifetime, and the IP address of the client the user is currently logged in from. The application server public key list also contains one or more records, each of which includes an automatically assigned unique identifier identifying the application server and the application server's own public key for public key encryption.

[0073] The multi-application single-login authentication method described in this embodiment specifically includes three parts: (1) system initialization; (2) user login single authentication; and (3) user request application service authentication.

[0074] The specific process of system initialization is as follows: Figure 3 As shown, the following steps are included:

[0075] Step 3-1: The authentication server automatically generates a public-private key pair for the public key encryption system and stores it in the public key encryption tag of the authentication server;

[0076] Step 3-2: Each application server automatically generates a public-private key pair for the public key encryption system and stores it in its own public key encryption tag;

[0077] Step 3-3: The application server registers on the authentication server, automatically assigns an application server unique identifier to each application server, saves each application server unique identifier and its corresponding public key in the application server public key list of the authentication server; and saves the application server unique identifier and the authentication server public key to the registered application server.

[0078] Step 3-4: User registration is done on the authentication server. After the user successfully registers as required, a new record corresponding to the user is created in the user authentication information list of the authentication server. A unique identifier for the user is automatically generated and saved in the record. The user's username is saved in the corresponding record. After calculating the digital digest of the user password provided during user registration, the digital digest value is saved in the corresponding record.

[0079] The specific process of user login single authentication is as follows Figure 4 As shown, the following steps are included:

[0080] Step 4-1: The user uses the client to send the username to the authentication server to request authentication;

[0081] Step 4-2: The authentication server receives the user authentication request, obtains the username requesting authentication and the IP address of the client used by the user, and searches the user authentication information list for the username requesting authentication. If the query fails, the user is determined to be an unregistered user and the authentication process ends. If the query succeeds, a session key is randomly generated and saved along with the client IP address in the record corresponding to the user in the user authentication information list. The session key lifecycle is set. The digital digest of the user password stored in the record is then used as the encryption key to symmetrically encrypt the user's unique identifier, session key, and current timestamp, and then send the encrypted key to the client requesting authentication.

[0082] Step 4-3: After receiving the encrypted information, the client requires the user requesting authentication to enter the user password, uses the same hash algorithm as the authentication server to calculate the digital summary of the user password, uses the digital summary as the decryption password of the symmetric encryption, and decrypts the received encrypted information; if the decryption is successful and the timestamp is valid, the user and the authentication server are successfully authenticated, the user's unique identifier is saved in the memory, and the received session key is saved in the memory as the current session key; otherwise, the authentication fails and the single authentication process ends.

[0083] The specific process of users requesting application service authentication is as follows Figure 5 As shown, the following steps are included:

[0084] When a user who has successfully passed the above authentication needs to apply for application services from an application server, he / she should follow the steps below to complete the application authentication and service information transmission process.

[0085] Step 5-1: The client uses the current session key as the symmetric encryption key to symmetric-encrypt the user's unique identifier, the current session key, and the current timestamp. The encryption result serves as the dynamic tag for the user's application service request. The client sends the user's unique identifier and the dynamic tag to the application server that will request the service.

[0086] Step 5-2: After receiving the user unique identifier and dynamic tag from the client, the application server extracts the client IP address. The application server uses the authentication server's public key to encrypt the application server unique identifier, user unique identifier, client IP address, and dynamic tag, and sends the encrypted message to the authentication server.

[0087] Step 5-3: The authentication server receives the encrypted information sent by the application server, decrypts it with its own private key, and obtains the application server unique identifier, user unique identifier, client IP address, and dynamic tag; searches for the record corresponding to the user unique identifier in the user authentication information list. If the query fails, it is determined to be a fake user, the authentication fails, and the authentication process ends; if the query is successful, the client IP address saved in the record is compared with the client IP address sent by the application server to see if they are consistent. If they are inconsistent, it is determined to be an impersonation or invalid authentication request, the authentication fails, and the authentication process ends; if the comparison is successful, the record saved in the record is used to verify the identity of the user. The dynamic tag is decrypted using the stored session key. If the decryption fails, it is determined to be an invalid authentication request and the authentication process ends. If the decryption succeeds, and the decrypted user unique identifier and session key are consistent with the corresponding values ​​stored in the record, and the session key life cycle is valid (a valid life cycle means that the time value of the life cycle does not exceed the current time value of the authentication server), and the timestamp in the dynamic tag is valid (a valid timestamp means that the deviation between the time value of the timestamp and the current time value of the authentication server is within a pre-set range), then the dynamic tag is determined to be valid and the process continues with step 5-4. Otherwise, it is determined to be a false request or an expired request, the authentication fails, and the authentication process ends.

[0088] Step 5-4: The authentication server uses the received application server unique identifier to search for the corresponding application server public key list record in its own application server public key list. If the search fails, the application server is determined to be invalid, the authentication fails, and the authentication process ends. If the search succeeds, the authentication server randomly generates a new session key, uses the public key of the corresponding application server stored in the application server public key list record, encrypts the user unique identifier, the old session key (the session key stored in the corresponding user authentication information list record), the new session key (the randomly generated new session key), and the current timestamp, and sends it to the application server. The authentication server replaces the old session key stored in the corresponding user authentication information list record with the new session key and updates the lifetime value of the session key in the record.

[0089] Step 5-5: The application server receives the information sent by the authentication server and decrypts it using its own private key. If the decryption fails, it is determined that the authentication server is being impersonated and the authentication process ends. If the decryption succeeds, the user's unique identifier, old session key, new session key, and timestamp are obtained, and the validity of the timestamp is determined. If the timestamp is invalid, it is determined to be a replay attack and the authentication process ends. If the timestamp is valid, the decrypted user unique identifier is determined to be consistent with the user unique identifier sent by the user. If they are inconsistent, the application service request is determined to be impersonated, the authentication fails, and the authentication process ends. If they are consistent, the user's application service request is determined to be authenticated successfully, and the application server uses the old session key as the symmetric encryption key to symmetric encrypt the user unique identifier, new session key, and current timestamp, and sends the encrypted result to the client.

[0090] Step 5-6: The client receives the encrypted information packet sent by the application server and decrypts it using the current session key (old key). If the decryption fails, the client determines that the application server is impersonating and the authentication process ends. If the decryption succeeds, the client obtains the user's unique identifier, new session key, and timestamp. The client determines whether the timestamp is valid. If the timestamp is invalid, it is determined to be a replay attack and the authentication process ends. If the timestamp is valid, the application request to the application server is successfully authenticated and communication with the application server's application service can begin.

[0091] Step 5-7: The user successfully requests application service authentication from the application server on the client, and application service communication between the two parties begins. Both parties use the new session key as the current session key to symmetrically encrypt the data of this application service communication.

[0092] Therefore, the user repeats Figure 5 By following the steps shown in the figure to request application services, you can automatically use dynamic tags to request services from other application servers.

[0093] As can be seen, this embodiment provides a multi-application single-login authentication method based on dynamic tags. This method implements a dynamic tag after a user successfully authenticates by providing a username and password to an authentication server. Subsequently, when requesting application services from other registered application servers, the dynamic tag is used to automatically authenticate the application server and the user, eliminating the need to repeatedly enter the username and password for each application service request. This method can be used in diverse and complex network environments, such as wide area networks, local area networks, and cloud computing virtual platforms. The deployment of multiple application services is not restricted by the network environment's trust domain. Furthermore, a single authentication communication can achieve mutual authentication between the user and the authentication server, between the user and the application server, and between the authentication server and the application server, while preventing replay attacks and any impersonation attacks against the user, the authentication server, or the application server. Furthermore, with each application service request, the session key in the dynamic tag changes. This change enhances the confidentiality of data communicated between the user and the application server, which is symmetrically encrypted using the session key.

[0094] The following is a specific example to illustrate the multi-application single login authentication method of the present invention:

[0095] In this embodiment, the client, authentication server, and application server are interconnected through a local area network and a wide area network. The client, authentication server, and application server may also be partially or entirely virtual machines in a cloud computing environment, interconnected through a virtual network.

[0096] When a user registers, he or she uses a registration application or a registration web page on the client to register with the authentication server through the network. When registering, he or she needs to provide a username username and a user password userpass, and the authentication server assigns a unique identifier UID to the user.

[0097] The authentication server includes a public key encryption tag for a public key encryption system, a user authentication information list including current authentication information of all registered users, and an application server public key list including public key encryption of all application servers.

[0098] The authentication server contains a public key encryption tag, which includes a public-private key pair for public key encryption, automatically generated and assigned by the authentication server: a private key CS_private_key and a public key CS_public_key. The private key is used to sign the authentication server's sent information during the authentication process, and the public key is used to decrypt the corresponding private key signature. The public key encryption algorithm can use the standard RSA algorithm or the Elliptic Curve Cryptography (ECC) algorithm.

[0099] The authentication server contains a list of user authentication information. The table contains one or more records. Each record contains a unique user identifier (UID) automatically assigned to the registered user, the username (username), the digital digest Hash (userpass) of the user's password, the user's current session key (session_key), the lifetime of the session key (lifetime), and the client IP address (IP_addr) used by the user to log in.

[0100] The user authentication information list is implemented using a database storage table.

[0101] The user's unique identifier (UID) is a string of numbers automatically assigned by the authentication server during registration. The length depends on the number of users and can be 16 or 32 digits.

[0102] User passwords are not stored in plain text in the user authentication information list. Instead, a digital digest of the user password inscription is calculated using a hash function and the digital digest value is stored. The purpose is to enhance the confidentiality of the user password. The hash function used to calculate the digital digest can use the standard algorithm (Message Digest Algorithm 5, MD5) or the Secure Hash Algorithm (Secure Hash Algorithm, SHA) series function.

[0103] The user's current session key session_key is the key used to symmetrically encrypt communication data when the user communicates with the authentication server or application server. The symmetric encryption algorithm uses standard algorithms such as (Data Encryption Standard, DES) and (Advanced Encryption Standard, AES).

[0104] The lifetime of a session key is a time value. When the current time on the authentication server exceeds the lifetime of the session key, the session key becomes invalid and the user needs to re-enter the password for single login. The lifetime of a session key is usually set to within 8 hours after the session key is generated.

[0105] The client IP address ip_addr used by the user to log in is extracted by the authentication server from the network IP message packet of the user requesting authentication and stored in the corresponding record of the user authentication information list of the authentication server.

[0106] The application server public key list in the authentication server contains one or more records. Each record contains an automatically assigned application server unique identifier (ASID) that identifies the application server and the application server's own public key (AS_public_key) used for public key encryption.

[0107] The unique identifier (ASID) of an application server is an 8-bit or 16-bit digital string automatically assigned by the authentication server when the application server registers with the authentication server.

[0108] When an application server registers with an authentication server, it automatically generates its own public-private key pair for public-key encryption: a private key, AS_private_key, and a public key, AS_public_key. The private key is used by the application server to sign messages it sends, and the public key is used to decrypt the corresponding private key signature. The application server uses the same public-key encryption standard algorithm as the authentication server.

[0109] The authentication server needs to store the public keys of all application servers, and all application servers need to store the public key of the authentication server to achieve mutual authentication between the authentication server and the application servers.

[0110] The hash algorithm, symmetric encryption algorithm, and public key encryption algorithm used by the client, authentication server, and application server must be consistent, including the key length of the corresponding algorithm.

[0111] First, initialize the system:

[0112] (1) The authentication server CS automatically generates a pair of public key encryption keys: private key CS_private_key and public key CS_public_key, which are stored in the public key encryption tag of the authentication server;

[0113] In this embodiment, the public key encryption standard RSA algorithm is used, and the key length is selected as 1024 bits;

[0114] (2) The application server AS automatically generates a public-private key pair for the public key encryption system: private key AS_private_key and public key AS_public_key, and stores them in its own public key encryption tag. The public key encryption algorithm and key length are the same as those of the authentication server.

[0115] (3) The application server AS is registered on the authentication server CS. The authentication server automatically assigns an application server unique identifier ASID to the application server, saves the application server unique identifier ASID and its corresponding public key AS_public_key in the application server public key list of the authentication server; and saves the application server unique identifier ASID and the authentication server public key CS_public_key in the registered application server.

[0116] (4) The user registers according to the organization's requirements. The registration information that must be provided for successful registration includes the user name username and user password userpass. After the user successfully registers, the authentication server saves a record corresponding to the user in its user authentication information list. The user's unique identifier UID in the record is automatically generated by the authentication server. The user's username username is saved in the corresponding record. After calculating the digital digest of the user password userpass provided during the user registration, the digital digest value Hash (userpass) is saved in the corresponding record.

[0117] In this embodiment, the user registration process is completed by remotely accessing a web page using a browser, and the digital digest is calculated using the international standard SHA-256 algorithm to generate a 256-bit digital digest value.

[0118] The system initialization described above is intended to establish a trust relationship between the authentication server and the application server. The server's public and private key pairs are used for mutual authentication between the authentication server and the application server during subsequent user authentication services and application request services. New application servers can be added to the system at any time. New application servers only need to complete registration with the authentication server according to steps (2) and (3).

[0119] Then, perform single authentication for user login:

[0120] (1) The user uses the client to send the username username to the authentication server CS to request authentication;

[0121] In this embodiment, the user's access request to the authentication server and the application server is completed by running the web application using a browser;

[0122] During the user login process, the user needs to enter a username and password once. For the username and password entered by the user on the login page, only the username is transmitted to the authentication server without transmitting the password. The password entered by the user is saved in the client memory for local client verification in step 3-3;

[0123] (2) The authentication server AS receives the user authentication request, obtains the username username and the IP address IP_addr of the client used by the user, and uses the username to query the user record in the user authentication information list; if the query fails, it is determined that the user is not a registered user and the authentication process ends; if the query succeeds, it randomly generates a session key session_key, saves the session_key and IP_addr to the user record, and sets the lifetime of the session key in the record; then uses the digital digest Hash (userpass) of the user password saved in the record as the encryption key, symmetrically encrypts the user's unique identifier UID, the session key session_key, and the current timestamp timestamp_CS, and sends it to the client requesting authentication;

[0124] In this embodiment, the authentication server can directly extract the IP address of the client from the network data message; after a user logs in once, the login is only valid on the client used at the time of login. If the user changes the client used, the user must re-enter the user name and password to log in;

[0125] The generated session key is used for symmetric encryption of subsequent communication data packets between the user and the application server. The key length is 256 bits.

[0126] The session key lifetime is set to 8 hours, that is, the lifetime value is the current time when the session key is generated + 8 hours;

[0127] Symmetric encryption is performed using the digital summary Hash (userpass) of the user password as the encryption key. The symmetric encryption algorithm is the standard AES algorithm with a key length of 256 bits.

[0128] (3) After receiving the encrypted information from the authentication server, the client uses the same hash algorithm as the authentication server to calculate the digital digest value Hash(userpass)_client of the user password userpass entered when the user logged in, and uses Hash(userpass)_client as the key to decrypt the received encrypted information; if the decryption is successful and the timestamp timestamp_CS is valid, the user and the authentication server have successfully authenticated each other, and the user's unique identifier UID is saved in the memory. The received session key session_key is also saved in the memory as the current session key. Otherwise, the authentication fails, and the single authentication process ends;

[0129] In this embodiment, the authentication server, client, and application server use the same symmetric encryption standard algorithm AES;

[0130] The timestamp is used to prevent replay attacks. The timestamp is valid when the decrypted timestamp timestamp_CS is compared with the timestamp of the client's current time. If the error is less than a preset value, the timestamp is valid. In this embodiment, the preset value is 240 seconds.

[0131] After the user enters the username and password and completes single login authentication with the authentication server, he or she does not need to enter the username and password again when applying for application services from the application server during the login validity period; the login validity period means that the user does not change the login client and the current session key does not expire.

[0132] Next, the user requests the application service:

[0133] (1) The client uses the current session key session_key as the symmetric encryption key to symmetric encrypt the user unique identifier UID, the current session key session_key, and the client's current timestamp timestamp_Client. The encryption result is used as the dynamic label dync_Ulabel for the user's request for application service. The client sends the plaintext user unique identifier UID and the ciphertext dynamic label dync_Ulabel to the application server AS that is about to request the service.

[0134] (2) After receiving the user unique identifier UID and dynamic label dync_Ulabel from the client, the application server AS extracts the client IP address IP_addr from the network message. The application server AS uses the saved public key CS_public_key of the authentication server CS as the encryption key to encrypt the application server unique identifier ASID, user unique identifier UID, client IP address IP_addr, and dynamic label dync_Ulabel together and sends it to the authentication server.

[0135] In this embodiment, the public key encryption standard RSA algorithm is used, and the key length is selected as 1024 bits;

[0136] (3) The authentication server CS receives the encrypted information sent by the application server AS, decrypts it using its own private key CS_private_key, and obtains the application server unique identifier ASID, the user unique identifier UID, the client IP address IP_addr, and the dynamic label dync_Ulabel; it searches the user authentication information list for the record corresponding to the user unique identifier UID. If the query fails, it is determined to be a fake user, the authentication fails, and the authentication process ends; if the query succeeds, it compares the client IP address saved in the record with the client IP address sent by the application server to see if they are consistent. If If the comparison is successful, the dynamic label dync_Ulabel is decrypted using the session key session_key stored in the record. If the decryption fails, it is determined to be an invalid authentication request and the authentication process is terminated. If the decryption is successful, and the user unique identifier and session key obtained by decryption are consistent with the corresponding values ​​stored in the record, and the session key life cycle is valid, and the timestamp in the dynamic label is valid, then the dynamic label is determined to be valid and the process continues to step (4). Otherwise, it is determined to be a false request or an expired request, the authentication fails, and the authentication process is terminated.

[0137] In this embodiment, since the dynamic tag is forwarded by the application server to the authentication server, which increases network latency, and the authentication server's private key decryption also increases time delay, the authentication server should add a time delay to determine the validity of the timestamp in the dynamic tag after decrypting it. In this embodiment, the timestamp error value is set to 720 seconds.

[0138] (4) The authentication server CS uses the received application server unique identifier ASID to search for the corresponding application server public key list record in its own application server public key list. If the search fails, it is determined to be an invalid application server, the authentication fails, and the authentication process ends; if the search succeeds, the authentication server randomly generates a new session key session_key_new, uses the public key AS_public_key of the corresponding application server stored in the application server public key list record, encrypts the user unique identifier UID, the old session key session_key (referring to the session key stored in the corresponding user authentication information list record), the new session key session_key_new (referring to the randomly generated new session key), and the current timestamp timestamp, and sends it to the application server AS; the authentication server CS uses the new session key session_key_new value to replace the old session key stored in the corresponding user authentication information list record, and updates the lifetime value of the session key in the record;

[0139] (5) The application server AS receives the information sent by the authentication server CS and decrypts it using its own private key AS_private_key. If the decryption fails, it is determined that the authentication server is being impersonated and the authentication process ends. If the decryption succeeds, the user unique identifier UID, the old session key session_key, the new session key session_key_new, and the timestamp timestamp are obtained. It is determined whether the timestamp is valid. If the timestamp is invalid, it is determined that it is a replay attack and the authentication process ends. If the timestamp is valid, it is determined whether the decrypted user unique identifier is consistent with the user unique identifier UID sent by the user. If they are inconsistent, it is determined that the application service request is impersonated, the authentication fails, and the authentication process ends. If they are consistent, it is determined that the user's application service request is authenticated successfully. The application server uses the old session key session_key as the symmetric encryption key to symmetric encrypt the user unique identifier UID, the new session key session_key_new, and the current timestamp timestamp and sends the encrypted result to the client.

[0140] In this embodiment, the current timestamp refers to the timestamp generated by the application server based on its own time;

[0141] (6) The client receives the encrypted information packet sent by the application server AS and decrypts it using the current session key session_key (old key). If the decryption fails, the client determines that the application server is impersonating and the authentication process ends. If the decryption succeeds, the client obtains the user unique identifier UID, the new session key session_key_new, and the timestamp timestamp. The client determines whether the timestamp is valid. If the timestamp is invalid, the client determines that it is a replay attack and the authentication process ends. If the timestamp is valid, the client successfully authenticates the application request to the application server and replaces the old session key session_key with the new session key session_key_new. The client then begins communicating with the application service of the application server.

[0142] (7) The user successfully authenticates the application service to the application server AS on the client, and the application service communication between the two parties begins. Both parties use the new session key as the current session key to symmetrically encrypt the data transmitted in this application service communication.

[0143] Each time a user successfully requests an application service, a new session key will be generated for symmetric encryption of communication data between the two parties.

[0144] Therefore, the user repeats the above steps of requesting application services and can automatically use dynamic tags to request services from other application servers.

[0145] The steps of the various methods above are divided only for the purpose of clear description. When implemented, they can be combined into one step or some steps can be split and decomposed into multiple steps. As long as they include the same logical relationship, they are within the scope of protection of the present invention. Adding insignificant modifications or introducing insignificant designs to the algorithm or process without changing the core design of the algorithm and process are all within the scope of protection of the invention.

[0146] Another embodiment of the present invention relates to a multi-application single sign-on authentication system. The implementation details of the multi-application single sign-on authentication system of this embodiment are described in detail below. The following content is provided for ease of understanding and is not required for implementing this solution. The multi-application single sign-on authentication system of this embodiment includes: a client, an authentication server, and multiple application servers; wherein the authentication server pre-assigns a unique identifier to a user based on the user's username and password;

[0147] The client is used to generate a user authentication request for any user according to the user name input by the user, and send the user authentication request to the authentication server;

[0148] The authentication server is used to randomly generate a session key according to the user authentication request, and use the user password as the encryption key to symmetrically encrypt the generated session key and the user's unique identifier to form an encrypted message, and send it to the client;

[0149] The client is further configured to decrypt the encrypted information sent by the authentication server based on the user password entered by the user, and obtain the session key generated by the authentication server and the user's unique identifier, so as to confirm that the two-way authentication between the user and the authentication server is successful;

[0150] The client is further configured to, after successful mutual authentication between the user and the authentication server, symmetrically encrypt the user's unique identifier using the session key generated by the authentication server as an encryption key to form a dynamic tag, and send the tag to the application server corresponding to the application service requested by the user;

[0151] The authentication server is also used to decrypt the dynamic tag according to the generated session key after the application server sends the dynamic tag to the authentication server, and obtain the user's unique identifier to confirm that the user who has successfully completed two-way authentication with the authentication server has successfully applied for authentication of the application service of the application server.

[0152] It is not difficult to find that this embodiment is a system embodiment corresponding to the above-mentioned method embodiment, and this embodiment can be implemented in conjunction with the above-mentioned method embodiment. The relevant technical details and technical effects mentioned in the above-mentioned embodiment are still valid in this embodiment, and to reduce repetition, they are not repeated here. Accordingly, the relevant technical details mentioned in this embodiment can also be applied to the above-mentioned embodiment.

[0153] It is worth noting that all modules involved in this embodiment are logical modules. In actual applications, a logical unit can be a physical unit, a part of a physical unit, or a combination of multiple physical units. In addition, to highlight the innovations of the present invention, this embodiment does not include units that are not closely related to solving the technical problems proposed by the present invention. However, this does not mean that other units do not exist in this embodiment.

[0154] Another embodiment of the present invention relates to a computer device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the multi-application single login authentication method of the above-mentioned embodiments.

[0155] The memory and processor are connected using a bus, which can include any number of interconnected buses and bridges. The bus connects various circuits of one or more processors and memories. The bus can also connect various other circuits such as peripheral devices, voltage regulators, and power management circuits. These are all well known in the art and are therefore not described further herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be a single component or multiple components, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium. Data processed by the processor is transmitted over a wireless medium via an antenna. Furthermore, the antenna receives data and transmits it to the processor.

[0156] The processor is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. Memory can be used to store data used by the processor when performing operations.

[0157] Another embodiment of the present invention relates to a computer-readable storage medium storing a computer program, which implements the above method embodiment when executed by a processor.

[0158] That is, those skilled in the art will understand that all or part of the steps in the above-described method embodiments can be implemented by instructing related hardware through a program, which is stored in a storage medium and includes a number of instructions for causing a device (such as a microcontroller or chip) or a processor to execute all or part of the steps in the method embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, a mobile hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0159] Those skilled in the art will appreciate that the above embodiments are specific embodiments for implementing the present invention, and that in actual applications, various changes may be made thereto in form and detail without departing from the spirit and scope of the present invention.

Claims

1. A multi-application single sign-on authentication method, characterized in that: Applied to a multi-application single sign-on authentication system, the system comprises: a client, an authentication server, and multiple application servers; wherein the authentication server pre-assigns a unique identifier to the user based on the user's username and password; The method comprises: For any user, the client generates a user authentication request based on the user name entered by the user and sends the user authentication request to the authentication server; The authentication server randomly generates a session key based on the user authentication request, and uses the user's password as the encryption key to symmetrically encrypt the generated session key and the user's unique identifier to form an encrypted message, which is then sent to the client. If the client decrypts the encrypted information sent by the authentication server based on the user password entered by the user and obtains the session key generated by the authentication server and the user's unique identifier, then the two-way authentication between the user and the authentication server is successful; After the user and the authentication server have successfully completed mutual authentication, the client uses the session key generated by the authentication server as the encryption key to symmetrically encrypt the user's unique identifier to form a dynamic tag, and sends it to the application server corresponding to the application service requested by the user; The application server sends the dynamic tag to the authentication server so that the authentication server decrypts the dynamic tag according to the generated session key. If the decryption obtains the user's unique identifier, the user who has successfully completed the two-way authentication with the authentication server will successfully authenticate the application service application of the application server.

2. The multi-application single sign-on authentication method according to claim 1, characterized in that: The authentication server includes a user authentication information list having current authentication information of all users, wherein the user authentication information list includes one or more records, each record including a user name, a digital digest of the user password calculated using a hash algorithm, a unique identifier, a session key, a life cycle of the session key, and an IP address of a client currently logged in; The authentication server randomly generates a session key according to the user authentication request, and uses the user password as the encryption key to symmetrically encrypt the generated session key and the user's unique identifier to form encrypted information, which is sent to the client, including: The authentication server receives the user authentication request and obtains the username of the user requesting authentication and the IP address of the client currently used by the user to log in; The user's username is searched in the user authentication information list. If the search fails, the user is judged to be an unregistered user and the authentication process ends. If the search succeeds, a session key is randomly generated and a life cycle is set for the session key. The session key and the client's IP address are saved in the user's corresponding record in the user authentication information list. The digital summary of the user's password is used as the encryption key, and the user's unique identifier, session key and current timestamp are symmetrically encrypted and sent to the client.

3. The multi-application single sign-on authentication method according to claim 2, characterized in that: If the client decrypts the encrypted information sent by the authentication server according to the user password input by the user and obtains the session key generated by the authentication server and the user's unique identifier, then the two-way authentication between the user and the authentication server is successful, including: Obtain the user password entered by the user on the client, and use the hash algorithm to calculate the digital digest of the user password. Use the digital digest of the user password as the decryption password of the symmetric encryption to decrypt the encrypted information sent by the authentication server. If the decryption is successful, and the session key and the user's unique identifier generated by the authentication server are obtained, and the current timestamp is valid, then the user and the authentication server have successfully completed the two-way authentication, and the user's unique identifier and session key are saved; if the decryption fails, the authentication fails, and the authentication process ends.

4. The multi-application single sign-on authentication method according to claim 3, characterized in that: The client uses the session key generated by the authentication server as the encryption key to symmetrically encrypt the user's unique identifier to form a dynamic tag, and sends it to the application server corresponding to the application service requested by the user, including: The client uses the session key generated by the authentication server as the encryption key to symmetrically encrypt the user's unique identifier, session key and current timestamp, and uses the encryption result as the dynamic tag for the user's application for application service, and sends the user's unique identifier and dynamic tag to the application server corresponding to the application service applied by the user.

5. The multi-application single sign-on authentication method according to claim 4, characterized in that: The authentication server has a public-private key pair, and each application server also has a public-private key pair. The authentication server stores the public key of each application server's public-private key pair, and each application server stores the public key of the authentication server's public-private key pair. Each application server is pre-registered on the authentication server and assigned a unique identifier by the authentication server. The application server sends the dynamic tag to the authentication server, so that the authentication server decrypts the dynamic tag according to the generated session key. If the decryption obtains the user's unique identifier, the user who has successfully performed two-way authentication with the authentication server successfully applies for authentication of the application service of the application server, including: The application server extracts the client's IP address based on the user's unique identifier and dynamic tag sent by the client, and uses the public key from the authentication server's public-private key pair to encrypt the application server's unique identifier, the user's unique identifier, the client's IP address, and the dynamic tag, and sends the encrypted encrypted message to the authentication server. The authentication server uses the private key in its public-private key pair to decrypt the encrypted information sent by the application server, obtaining the unique identifier of the application server, the unique identifier of the user, the IP address of the client, and the dynamic tag; The record corresponding to the user's unique identifier is searched in the user authentication information list. If the query fails, the user is judged to be a fake user and the authentication process is terminated. If the query is successful, the IP address of the client saved in the record is compared with the IP address of the client sent by the application server to see if they are consistent. If they are inconsistent, it is judged to be an impersonation or invalid authentication request and the authentication process is terminated. If they are consistent, the dynamic tag is decrypted using the session key saved in the record. If the decryption fails, it is judged to be an invalid authentication request and the authentication process is terminated. If the decryption is successful, and the unique identifier and session key of the user obtained by decryption are consistent with the unique identifier and session key of the user saved in the record, and the session key life cycle is valid, and the current timestamp in the dynamic tag is valid, then the dynamic tag is judged to be valid. The authentication server sends the decrypted user's unique identifier and session key to the client via the application server, completing the application service application authentication process.

6. The multi-application single sign-on authentication method according to claim 5, characterized in that: The authentication server sends the decrypted unique identifier and session key of the user to the client via the application server, completing the application service application authentication process, including: The authentication server searches for the corresponding application server in the public key of the stored public-private key pair based on the unique identifier of the application server. If the query fails, the application server is determined to be invalid and the authentication process ends. If the query is successful, a new session key is randomly generated. The public key in the application server's public-private key pair is used to symmetrically encrypt the user's unique identifier, the original session key, the new session key, and the current timestamp. The encryption key is then sent to the application server. The new session key replaces the original session key stored in the record of the user authentication information list, and the lifetime of the session key in the record is updated. The application server uses the private key in its own public-private key pair to decrypt the encrypted information sent by the authentication server. If the decryption fails, it is determined to be a fake authentication server and the authentication process ends; If the decryption is successful, the user's unique identifier, the original session key, the new session key, and the current timestamp are obtained, and the current timestamp is judged to be valid. If the current timestamp is invalid, it is judged as a replay attack and the authentication process ends; If the current timestamp is valid, determine whether the unique identifier of the user obtained by decryption is consistent with the unique identifier of the user sent by the user through the client. If they are inconsistent, determine that the application service application is impersonated and end the authentication process; If they match, the user's application service application authentication is successful. The application server uses the original session key as the encryption key to symmetrically encrypt the user's unique identifier, the new session key, and the current timestamp, and then sends it to the client. The client uses the original session key to decrypt the encrypted information sent by the application server. If the decryption fails, the application server is considered to be impersonating and the authentication process ends. If the decryption is successful, the user's unique identifier, new session key, and current timestamp are obtained. Then, the timestamp is determined to be valid. If the current timestamp is invalid, it is determined to be a replay attack and the authentication process ends. If the timestamp is valid, the user's application service authentication to the application server is successful.

7. The multi-application single sign-on authentication method according to claim 6, characterized in that: After the user successfully authenticates the application service application of the application server, the method further includes: The user communicates with the application server through the client and uses the new session key as the current session key to perform symmetrical encryption transmission on the data of this application service communication.

8. A multi-application single sign-on authentication system, characterized in that: include: A client, an authentication server, and multiple application servers; wherein the authentication server pre-assigns a unique identifier to the user based on the user's username and password; The client is used to generate a user authentication request for any user according to the user name input by the user, and send the user authentication request to the authentication server; The authentication server is used to randomly generate a session key according to the user authentication request, and use the user password as the encryption key to symmetrically encrypt the generated session key and the user's unique identifier to form an encrypted message, and send it to the client; The client is further configured to decrypt the encrypted information sent by the authentication server based on the user password entered by the user, and obtain the session key generated by the authentication server and the user's unique identifier, so as to confirm that the two-way authentication between the user and the authentication server is successful; The client is further configured to, after successful mutual authentication between the user and the authentication server, symmetrically encrypt the user's unique identifier using the session key generated by the authentication server as an encryption key to form a dynamic tag, and send the tag to the application server corresponding to the application service requested by the user; The authentication server is also used to decrypt the dynamic tag according to the generated session key after the application server sends the dynamic tag to the authentication server, and obtain the user's unique identifier to confirm that the user who has successfully completed the two-way authentication with the authentication server has successfully applied for authentication of the application service of the application server.

9. A computer device, characterized in that: include: at least one processor; And, a memory communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the multi-application single login authentication method as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the multi-application single sign-on authentication method according to any one of claims 1 to 7 is implemented.

Images