A unified authentication method for multi-architecture applications based on display and control application integration

Abstract

The present invention discloses a unified authentication method for multi-architecture applications based on display and control application integration, the method comprising the following steps: 1) deploying a display and control integration framework; the display and control integration framework is deployed on a user terminal and runs as multiple independent processes, including a main process, an authentication agent process, and a message bus process; 2) deploying clients for each application; 3) deploying a unified authentication center on the server side; 4) unified authentication single sign-on; 4.1) pre-step: the application and user registration are registered in the unified authentication center; 4.2) single sign-on process steps: 4.2.1) logging into the display and control integration framework; 4.2.2) the authentication agent service saves the token; 4.2.3) the display and control application obtains and caches the application token; 4.2.4) the back-end application verifies the token and logs in. The present invention implements unified authentication single sign-on for multi-architecture applications, solving the problem of users repeatedly entering usernames and passwords to log in to applications of different architectures.

Description

Technical Field

[0001] The present invention relates to information system technology, and in particular to a multi-architecture application unified authentication method based on display and control application integration. Background Art

[0002] With the development of software and information technology, application software has gradually adopted an architecture that separates software from hardware, and display and control from computing. Display and control applications, which are software modules deployed on user terminals, primarily include browser-based applications for B / S architectures, Qt plug-ins, clients for C / S architectures, and monolithic applications. These applications need to be deployed simultaneously on multiple user terminals, requiring users to open different interfaces when logging into applications with different architectures and repeatedly enter usernames and passwords. This increases operational complexity and impacts the user experience. To achieve unified authentication and login for applications, the current mainstream technical solution uses single sign-on (SSO) technology, allowing users to access multiple applications with a single login.

[0003] Existing unified authentication and single sign-on solutions mainly include Web application single sign-on solutions based on protocols such as OpenID Connect and CAS, and enterprise-level single sign-on solutions based on the Kerberos protocol. However, the existing unified authentication technology solutions still have the following problems: (1) The authentication method is not flexible enough for multi-architecture applications. For scenarios where multi-architecture display and control applications need to be deployed simultaneously, the existing unified authentication solutions are mostly targeted at browser-based B / S architecture application login modes and authentication methods, and have weak support for applications of other architectures. 2) There is a lack of technical mechanisms to support unified authentication for multi-architecture applications. Since the deployment of display and control applications is relatively independent, the user operation entrances are not unified, and there is a lack of inter-process message communication mechanisms. Therefore, there is a lack of a technical mechanism to support unified authentication for multi-architecture applications. (3) The user interaction method is relatively complex. Most of the existing solutions are general unified authentication solutions, and no customized solutions are proposed for user switching and other requirements, and the user interaction method is relatively complex. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to provide a unified authentication method for multi-architecture applications based on display and control application integration in response to the defects in the existing technology.

[0005] The technical solution adopted by the present invention to solve the technical problem is: a multi-architecture application unified authentication method based on display and control application integration, comprising the following steps:

[0006] 1) Deploy the display and control integration framework;

[0007] The display and control integration framework is deployed on the user terminal and runs as multiple independent processes, including a main process, an authentication agent process, and a message bus process;

[0008] Among them, the main process runs the corresponding driver on demand to load multiple integrated display and control application processes to simultaneously run display and control applications including web programs, plug-in programs, and client programs;

[0009] The message bus process is used for communication between the integrated display and control applications and the display and control integration framework, and is controlled by the display and control integration framework to achieve multi-architecture display and control application integration;

[0010] 2) Deploy the client of each application;

[0011] Deploy the client of each application on the user terminal;

[0012] 3) Deploy a unified authentication center on the server side;

[0013] The unified authentication center is used to manage registration information and provide the function of generating tokens; the authentication proxy service is used to manage the login and offline functions of local applications;

[0014] 4) Unified authentication and single sign-on;

[0015] 4.1) Preliminary steps:

[0016] Application and user registration;

[0017] Each application and user needs to register with the unified authentication center in advance. The registration information includes the application name, ID, and the user's username and password. After registration is complete, the unified authentication center assigns an application ID and key to each integrated application and assigns the user authentication permissions for the application. At the same time, the unified authentication center and the authentication proxy service keep the application registration data dynamically synchronized after startup.

[0018] 4.2) Single sign-on process steps:

[0019] 4.2.1) Log in to the display and control integration framework;

[0020] After the display and control integration framework is started, it obtains user identity information in terminal login mode or username login mode (the terminal login mode is implemented in that the display and control integration framework automatically uses the client terminal information as the user identity information for login, while the username login mode requires the user to open the login interface and enter the username and password to log in), and requests the unified authentication center to obtain a token;

[0021] After the unified authentication center verifies the parameters, it uses an encryption algorithm to generate a token containing identity information. The unified authentication center returns the token and a login success message to the display and control integration framework.

[0022] 4.2.2) The authentication proxy service saves the token;

[0023] The display and control integration framework sends the token to the authentication proxy service. The authentication proxy service saves the token during the first login and updates the token during subsequent logins.

[0024] 4.2.3) The display and control application obtains and caches the application token;

[0025] When a user accesses a display and control application, the application login is triggered. The display and control application carries the application ID and key parameters to request the authentication proxy service. After verification, the authentication proxy service returns a token to the display and control application. The display and control application caches the received token in the browser or a file in a specified path so that the display and control integration framework can manage the cached token. The front-end display and control application and the back-end application of the application should encrypt the cached token to avoid repeated acquisition.

[0026] 4.2.4) The backend application verifies the token and logs in;

[0027] The display and control application sends the token to the corresponding back-end application of this application. The back-end application uses the token parsing SDK provided by the unified authentication center to verify and decrypt it, parse out the user identity information, and complete the application login.

[0028] Each integrated application follows steps 1 to 4 to implement unified application authentication and user single sign-on.

[0029] According to the above solution, the unified authentication center sets an expiration date for each token it generates. When a token expires, the display and control integration framework automatically detects the expiration, clears its own stored old token, logs the application offline, and notifies the authentication proxy service to clear the token. When the user accesses the application again, the display and control integration framework automatically restarts the terminal login process (see the single sign-on process steps) and returns to the terminal login state.

[0030] According to the above solution, in step 1), the main process runs the corresponding driver program as needed to load multiple integrated display and control application processes to simultaneously run display and control applications including web programs, plug-in programs, and client programs.

[0031] According to the above solution, in step 2), the client of each application includes: a browser side of a B / S architecture application, a Qt plug-in, a client of a C / S architecture application, and a single client application.

[0032] The beneficial effects produced by the present invention are:

[0033] 1. The present invention realizes unified authentication and single sign-on for multi-architecture applications, solving the problem of users repeatedly entering usernames and passwords to log in to applications of different architectures.

[0034] 2. The local login of the present invention avoids frequent access to the authentication center by the application, reducing the pressure on the server. Authentication-related components do not need to invade the application code, reducing application maintenance costs.

[0035] 3. The present invention implements unified authentication and single sign-on for multiple architecture applications, simplifies user operation processes, and improves usability. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The present invention will be further described below with reference to the accompanying drawings and embodiments, in which:

[0037] Figure 1 is a flow chart of a method according to an embodiment of the present invention;

[0038] Figure 2 This is a diagram of the display and control application integration architecture based on the display and control integration framework according to an embodiment of the present invention. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0040] like Figure 1 and Figure 2 As shown, a unified authentication method for multi-architecture applications based on display and control application integration includes the following steps:

[0041] 1) Deploy the display and control integration framework;

[0042] The display and control integration framework is deployed on the user terminal and runs as multiple independent processes, including a main process, an authentication agent process, and a message bus process;

[0043] Among them, the main process runs the corresponding driver on demand to load multiple integrated display and control application processes to simultaneously run display and control applications including web programs, plug-in programs, and client programs;

[0044] Authentication agent process;

[0045] The message bus process is used for communication between the integrated display and control applications and the display and control integration framework, and for accepting control from the display and control integration framework, so as to realize the integration of multi-architecture display and control applications.

[0046] After the display and control applications are integrated, users only need to log in on the display and control integration framework login interface to log in to all integrated applications;

[0047] 2) Deploy each application client;

[0048] Deploy the client of each application on the user terminal;

[0049] The client side of each application includes: browser side of B / S architecture application, Qt plug-in, client side of C / S architecture application, and single application;

[0050] Web applications and Qt plug-in applications place the program in the specified directory, and the display and control integration framework natively supports loading and starting it;

[0051] For web applications, you need to configure the IP address and route to connect to the backend application. For Qt plug-in applications, you need to use the plug-in scaffolding provided by the display and control integration framework to achieve communication with the backend application. For client applications, since the programs are relatively independent, no special adaptation design is required. You only need to provide a startup script to enable loading and startup by the display and control integration framework.

[0052] 3) Deploy a unified authentication center;

[0053] Applications and users need to register with the unified authentication center in advance. Registration information includes the application name and ID and the user's username and password. Applications should be connected to the unified authentication user system, and independent user systems should not be designed.

[0054] When users access applications through the display and control integration framework, the display and control application should obtain a token from the authentication proxy service and send it to the application backend for verification. The application backend needs to use the token parsing SDK provided by the unified authentication center to complete the token verification.

[0055] 4) Application of unified authentication implementation

[0056] Preliminary steps:

[0057] 4.1) Application and User Registration.

[0058] Each application and user needs to register in the unified authentication center in advance. The unified authentication center assigns an application ID and key to each integrated application, and assigns application authentication permissions to the user. At the same time, the unified authentication center and the authentication agent service keep the application registration data dynamically synchronized after startup.

[0059] 4.2) Single sign-on process steps:

[0060] 4.2.1) Log in to the display and control integration framework. After the user turns on the computer, the display and control integration framework automatically starts and obtains the user's identity information in terminal login mode or username login mode (terminal login mode is implemented by the display and control integration framework automatically using the client terminal information as the user's identity information for login, while username login mode requires the user to open the login interface and enter the username and password to log in). It then requests the unified authentication center to obtain a token. The unified authentication center verifies that the parameters are passed, uses an encryption algorithm to generate a token containing the identity information, and returns the token and a login success message.

[0061] 4.2.2) The authentication proxy service saves the token. The display and control integration framework sends the token to the authentication proxy service. The authentication proxy service saves the token during the first login and updates the token during subsequent logins.

[0062] 4.2.3) The display and control application obtains and caches the application token. When a user accesses the display and control application, the application login is triggered. The display and control application sends a request to the authentication proxy service with the application ID and key parameters. The authentication proxy service returns the token after verification. The display and control application should cache the token in the browser or in a file in a specified path so that the display and control integration framework can manage the cached token.

[0063] 4.2.4) The backend application verifies the token and logs in. The display control application sends the token to the corresponding backend application of this application. The backend application uses the token parsing SDK provided by the unified authentication center to verify and decrypt it, parse out the user identity information, and complete the application login.

[0064] Each integrated application follows steps 1) to 4) to implement unified application authentication and user single sign-on.

[0065] When user switching is required, the architecture of the present invention supports switching between terminal login mode and username login mode.

[0066] If you are in the terminal login or username login state, if you need to switch to another username login, just open the display and control integration framework login interface and enter the username and password. The display and control integration framework will clear the old token saved by itself to realize the application offline, and then re-enter the username login process (see the single sign-on process steps).

[0067] If you are in the username login state and need to switch to terminal login, click Exit username login on the display and control integration framework interface. The display and control integration framework will clear the old token saved by itself to realize the application offline, and then automatically perform the terminal login process (see the single sign-on process steps) and return to the terminal login state.

[0068] It should be understood that those skilled in the art can make improvements or changes based on the above description, and all such improvements and changes should fall within the scope of protection of the appended claims of the present invention.

Claims

1. A unified authentication method for multi-architecture applications based on display and control application integration, characterized in that: The following steps are involved: 1) Deploy the display and control integration framework; The display and control integration framework is deployed on the user terminal and runs as multiple independent processes, including a main process, an authentication agent process, and a message bus process; Among them, the main process is used to load multiple integrated display and control application processes; The message bus process is used for communication between the integrated display and control applications and the display and control integration framework, and is controlled by the display and control integration framework to achieve multi-architecture display and control application integration; 2) Deploy the client of each application; Deploy the client of each application on the user terminal; 3) Deploy a unified authentication center on the server side; The unified authentication center is used to manage registration information and provide token generation functions. The authentication proxy service is deployed on the server side and is used to manage the login and logout functions of local applications. 4) Unified authentication and single sign-on; 4.1) Preliminary steps: Applications and users are registered with the unified authentication center; the unified authentication center assigns an application ID and key to each integrated application; 4.2) Single sign-on process steps: 4.2.1) Log in to the display and control integration framework; After the display and control integration framework is started, the user identity information is obtained in the terminal login mode or the user name login mode, and the unified authentication center is requested to obtain a token; After the unified authentication center verifies the user's identity information parameters, an encryption algorithm is used to generate a token containing the identity information. The unified authentication center returns the token and a login success message to the display and control integration framework. 4.2.2) The authentication proxy service saves the token; The display and control integration framework sends the token to the authentication proxy service. The authentication proxy service saves the token during the first login and updates the token during subsequent logins. 4.2.3) The display and control application obtains and caches the application token; When a user accesses the display and control application, the application login is triggered. The display and control application carries the application ID and key parameters to request the authentication proxy service. After verification, the authentication proxy service returns a token to the display and control application. The display and control application caches the received token in the browser or a specified path file so that the display and control integration framework can manage the cached token. 4.2.4) The backend application verifies the token and logs in; The display control application sends the token to the corresponding back-end application of this application. The back-end application uses the token parsing SDK provided by the unified authentication center to verify and decrypt it, parse out the user identity information, and complete the application login. Each integrated application follows steps 1) to 4) to implement unified application authentication and user single sign-on.

2. The multi-architecture application unified authentication method based on display and control application integration according to claim 1 is characterized in that: In step 1), the main process runs the corresponding driver program as needed to load multiple integrated display and control application processes, so as to run display and control applications including web programs, plug-in programs, and client programs at the same time.

3. The unified authentication method for multi-architecture applications based on display and control application integration according to claim 1 is characterized in that: In step 2), the client of each application includes: a browser of a B / S architecture application, a Qt plug-in, a client of a C / S architecture application, and a single client application.

4. The unified authentication method for multi-architecture applications based on display and control application integration according to claim 1 is characterized in that: In step 4.1), each application and user needs to register in advance with the unified authentication center. The registration information includes the name and ID of the application and the user's username and password. After registration is completed, the unified authentication center assigns an application ID and key to each integrated application, and assigns the user authentication permissions for the application.

5. The unified authentication method for multi-architecture applications based on display and control application integration according to claim 1 is characterized in that: In the step 4.1), after the unified authentication center and authentication proxy service are started, the application registration data is kept dynamically synchronized.

6. The unified authentication method for multi-architecture applications based on display and control application integration according to claim 1 is characterized in that: In step 4.2.1), the unified authentication center will set an expiration time for each token generated.

7. The unified authentication method for multi-architecture applications based on display and control application integration according to claim 6 is characterized in that: In step 4.2.1), when the token expires, the display and control integration framework will automatically detect the token expiration, clear the old token saved by itself to realize the application offline, and notify the authentication proxy service to clear the token. When the user accesses the application again, the display and control integration framework will automatically re-perform the terminal login process and return to the terminal login state.

8. The unified authentication method for multi-architecture applications based on display and control application integration according to claim 1, characterized in that: In step 4.2.3), the front-end display and control application and the back-end application of the application encrypt the cache token to avoid repeated acquisition.

9. An electronic device, characterized in that: include: one or more processors; as well as a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors are enabled to perform the method according to any one of claims 1 to 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images