Single sign-on method and system and electronic equipment

Abstract

The invention discloses a single sign-on method and system and electronic equipment, and the method comprises the steps that a user terminal obtains login information and initiates a login session for requesting to log in a target application in a first server according to the login information, and then the first server checks whether a login session of the user account about the target application in the login information is expired, if not, the first server can exit other applications logged in by the user account and then log in the target application, and if yes, the first server can request a second server to update the login session, so that the user account can log in the target application. And the second server updates the login session and quits other applications logged in by the user account on the second server, and then the user terminal logs in the target application according to the updated login session. The method can improve the safety of logging in a ship system and a shore system, and can be widely applied to the technical field of communication.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a single sign-on method, system and electronic device. Background Art

[0002] At present, the single sign-on method for the linkage between the marine geological survey ship and the shore base is implemented separately on the ship and the shore, that is, the login system of the marine geological ship and the login system on the shore are completely isolated. Under normal circumstances, the ship system will regularly synchronize account information and other information from the shore system. The implementation scheme of the existing technology is as follows: 1) The terminal on the geological ship requests to log in to the ship system to obtain data, and the ship system determines the rationality of the terminal account. 2) After the ship system confirms that it can log in, the terminal can access the ship system normally.

[0003] Disadvantages of the prior art: When a user logs into the system on a geological vessel through a terminal, the onshore base will not perform account verification, single-point sign-on check, etc., that is, there may be a state where multiple users of one account are online at the same time, which is not conducive to data confidentiality. Summary of the invention

[0004] In view of this, the present application provides a single-point login method, system and electronic device to improve the security when logging into ship systems and shore systems.

[0005] One aspect of the present application provides a single sign-on method, including:

[0006] Acquire login information through a user terminal and initiate a login session for requesting to log in to a target application in the first server according to the login information; wherein the login information includes a user account;

[0007] Checking, by the first server, whether a login session of the user account with respect to the target application has expired;

[0008] If it has not expired, checking whether the user account has logged into the first application in the first server through the first server, and if so, causing the user account to log out of the first application through the first server, and then returning a message allowing login to the user terminal, and the user terminal logs in to the target application after receiving the message allowing login; if the user has not logged into the first application in the first server, returning a message allowing login to the user terminal through the first server, and the user terminal logs in to the target application after receiving the message allowing login;

[0009] If it has expired, the first server is used to request the second server to update the login session; the second server is used to update the login session, and it is checked whether the user account has logged in to the second application in the second server; if so, the second server is used to log out of the second application, and then the updated login session is returned to the first server through the second server, the updated login session is received and updated through the first server, and then a message allowing login is returned to the user terminal, and the user terminal receives the message allowing login and then logs in to the target application; if the second application in the second server has not been logged in, the updated login session is returned to the first server through the second server, the updated login session is received and updated through the first server, and then a message allowing login is returned to the user terminal, and the user terminal receives the message allowing login and then logs in to the target application.

[0010] Optionally, before acquiring login information through the user terminal, the method further includes:

[0011] Requesting to update the public key and private key of asymmetric encryption through the user terminal.

[0012] Optionally, requesting to update the public key and private key of asymmetric encryption through the user terminal includes:

[0013] Requesting the first server to update the public key of the asymmetric encryption through the user terminal, and then requesting the third server to update the public key of the asymmetric encryption through the first server;

[0014] Requesting the second server to update the asymmetric encryption private key through the user terminal, and then requesting the third server to update the asymmetric encryption private key through the second server;

[0015] Generate a corresponding asymmetric encryption public key and private key through the third server according to the application identifier in the login information requested for encryption;

[0016] Returning the newly generated public key to the first server through the third server, saving the newly generated public key through the first server, and returning a message that the public key has been updated to the user terminal;

[0017] The newly generated private key is returned to the second server through the third server, the newly generated private key is saved through the second server, and a message that the private key has been updated is returned to the user terminal.

[0018] Optionally, the requesting the third server to update the asymmetric encryption public key through the first server comprises: requesting the third server to update the asymmetric encryption public key through the first server through the TCP protocol in the local area network;

[0019] The requesting the third server to update the asymmetric encryption private key through the second server includes: requesting the third server to update the asymmetric encryption private key through the second server in the local area network through the TCP protocol;

[0020] The returning the newly generated public key to the first server through the third server includes: returning the newly generated public key to the first server through the third server in the local area network through the TCP protocol;

[0021] The returning the newly generated private key to the second server through the third server includes: returning the newly generated private key to the second server through the TCP protocol in the local area network through the third server.

[0022] Optionally, checking, by the first server, whether a login session of the user account with respect to the target application has expired includes:

[0023] The first server checks whether the current time exceeds the token update deadline corresponding to the user account. If so, it is determined that the login session of the user account for the target application has expired; if it does not exceed the token update deadline corresponding to the user account, it is determined that the login session of the user account for the target application has not expired.

[0024] Optionally, the method further comprises:

[0025] If the number of times the user terminal logs into the target application within a set time period reaches a preset threshold number, the token update deadline is extended by the first server before the token update deadline.

[0026] Optionally, the requesting the second server to update the login session through the first server comprises: sending request information to a satellite through the first server; receiving the request information through the satellite and forwarding the request information to the second server; updating the login session through the second server;

[0027] The returning the updated login session to the first server through the second server includes: returning the updated login session to the satellite through the second server; receiving the updated login session through the satellite and returning the updated login session to the first server.

[0028] Another aspect of the present application further provides a single sign-on system, comprising: a user terminal, a first server and a second server;

[0029] The user terminal, the first server and the second server are used to execute the above-mentioned single sign-on method.

[0030] Optionally, the system further includes a third server;

[0031] The user terminal is further configured to request the first server to update the public key of the asymmetric encryption; and request the second server to update the private key of the asymmetric encryption;

[0032] The first server is further configured to request the third server to update the public key of the asymmetric encryption; save the newly generated public key, and return a message indicating that the public key has been updated to the user terminal;

[0033] The second server is further configured to request the third server to update the asymmetric encryption private key; save the newly generated private key, and return a message to the user terminal indicating that the private key has been updated;

[0034] The third server is used to generate a corresponding asymmetric encryption public key and private key according to the application identifier in the login information requested for encryption; return the newly generated public key to the first server; and return the newly generated private key to the second server.

[0035] Another aspect of the present application also provides an electronic device, including a processor and a memory;

[0036] The memory is used to store programs;

[0037] The processor executes the program to implement the above method.

[0038] Another aspect of the present application further provides a computer-readable storage medium, wherein the storage medium stores a program, and the program is executed by a processor to implement the aforementioned method.

[0039] The present application also discloses a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. A processor of an electronic device can read the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the electronic device executes the above method.

[0040] The user terminal of the present application obtains login information and requests to log in to the target application in the first server according to the login information, and then the first server checks whether the login session of the user account in the login information about the target application has expired. If it has not expired, the first server can exit other applications logged in by the user account (i.e., the first application) and then log in to the target application. If it has expired, the first server can request the second server to update the login session, and then the second server updates the login session and exits other applications logged in by the user account on the second server (i.e., the second application), and then the user terminal logs in to the target application according to the updated login session. When the user account logs in to the target application of the first server for the first time or logs in to the target application again after a long interval, the present application can promptly confirm the communication status of the login session (session) corresponding to the user account, determine whether it has expired, and then exit other applications that the user account has logged in, ensuring that the user account has only a single user account logged in to the application on the first server or the second server. The present application can also use session caching technology to ensure the smoothness of the user account when logging in to the first server (i.e., the server on the ship). BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0042] Figure 1 A schematic diagram of communication between a ship and a shore base provided in an embodiment of the present application;

[0043] Figure 2 A schematic diagram of a single sign-on method provided in an embodiment of the present application;

[0044] Figure 3 and Figure 4 A schematic diagram of a process for updating a login session provided in an embodiment of the present application;

[0045] Figure 5 A schematic diagram of a process for updating asymmetric encryption public keys and secret keys provided in an embodiment of the present application;

[0046] Figure 6 A timing diagram of updating asymmetric encryption public keys and secret keys provided in an embodiment of the present application;

[0047] Figure 7 A timing diagram of a single sign-on method provided in an embodiment of the present application;

[0048] Figure 8A schematic diagram of the structure of a single sign-on system provided in an embodiment of the present application;

[0049] Fig. 9 A schematic diagram of the structure of another single sign-on system provided in an embodiment of the present application;

[0050] Fig.10 A structural block diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0052] It should be noted that although the functional modules are divided in the device schematic and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart.

[0053] The terms "first", "second", etc. in the specification and claims and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. Moreover, the terms "comprises", "comprising", or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device that includes a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article, or device. In the absence of further limitations, an element limited by the sentence "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or device that includes the element.

[0054] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0055] In order to facilitate understanding of the embodiments of the present application, the following keywords may be used in the embodiments of the present application:

[0056] Single Sign-On (SSO): after a user logs in once on the identity authentication server, he or she can obtain the permission to access other related systems and application software in the single sign-on system.

[0057] Single user online: The system only allows one user with one account to be online at the same time, that is, no two users can log in with the same account and password. Usually, systems with confidentiality requirements will have this requirement, such as various bank card apps.

[0058] VSAT satellite communication (Very Small Aperture Terminal): Since VSAT is derived from the traditional satellite communication system, it is also called a small satellite data station or a personal earth station. The "small" here refers to the small antenna aperture of the small station equipment in the VSAT system, which is usually 0.3m to 1.4m. The equipment has a compact structure, is solid, intelligent, cheap, easy to install, has low requirements on the use environment, is not restricted by the ground network, and has flexible networking.

[0059] Drilling Vessel is a ship dedicated to drilling submarine geological structures, mainly used for marine geological exploration. With the in-depth implementation of the national marine strategy, my country's drilling vessels are increasingly appearing in the Pacific Ocean and other international oceans. At this time, the only means of communication between the ship and the shore base is satellite. The communication process can be referred to Figure 1 .

[0060] Asymmetric encryption (Drilling Vessel): Asymmetric encryption algorithms use two completely different but completely matching pairs of keys - a public key and a private key. When using an asymmetric encryption algorithm to encrypt a file, only a matching pair of public and private keys can be used to complete the encryption and decryption process of the plaintext. RSA is one of the most representative asymmetric encryption algorithms. The RSA public key cryptosystem uses different encryption keys and decryption keys.

[0061] The MD5 algorithm is often used to verify the integrity of network file transmission and prevent files from being tampered with. The full name of MD5 is Message-Digest Algorithm 5. This algorithm calculates information of any length bit by bit to generate a "fingerprint" (or "message digest") with a binary length of 128 bits (hexadecimal length is 32 bits). The possibility of different files generating the same message digest is very, very small. Generally speaking, after Linux is installed, there will be a tool called md5sum, which can be run directly in the command line terminal.

[0062] TCP (Transmission Control Protocol) is a connection-oriented, reliable, byte-stream-based transport layer communications protocol. TCP is designed to fit into a layered protocol hierarchy that supports multiple network applications. Pairs of processes in host computers connected to different but interconnected computer communications networks rely on TCP for reliable communications services. TCP assumes that it can get simple, potentially unreliable datagram services from lower-level protocols. In principle, TCP should be able to operate on a variety of communications systems from hard-wired connections to packet switching or circuit switching networks.

[0063] MAC address (Media Access Control Address), literally translated as media access control address, each device in the network has a unique network identifier, this address is called MAC address or network card address, which is written inside the hardware by the network equipment manufacturer when it is produced. MAC address is 48 bits (6 bytes), usually expressed as 12 hexadecimal numbers, with colons separating every 2 hexadecimal numbers, such as 08:00:20:0A:8C:6D is a MAC address. The first 3 bytes represent OUI (Organizationally Unique Identifier), which is the code assigned by the IEEE registration management agency to different manufacturers to distinguish different manufacturers. The last 3 bytes are assigned by the manufacturer.

[0064] HTTPS (Hypertext Transfer Protocol Secure) is an HTTP channel with security as its goal. It ensures the security of the transmission process through transmission encryption and identity authentication based on HTTP. HTTPS adds SSL to HTTP. The security foundation of HTTPS is SSL, so the details of encryption require SSL. HTTPS has a default port different from HTTP and an encryption / authentication layer (between HTTP and TCP). This system provides authentication and encryption communication methods. It is widely used in security-sensitive communications on the World Wide Web, such as transaction payments.

[0065] Reference Figure 2 , the embodiment of the present application provides a single sign-on method, including steps S200 to S230, which are as follows:

[0066] S200: The user terminal obtains login information and initiates a login session for requesting to log in to a target application in the first server according to the login information; wherein the login information includes a user account.

[0067] First, the user terminal, the first server and the second server involved in this embodiment are explained: the user terminal can be a mobile phone, a tablet computer, a PC computer and other optional forms of smart terminals; the first server can be a server set on a marine geological survey ship, and the first server can also be called a shipboard server or a shipboard login server; the second server can be a server set at a shore base, and the second server can also be called a shore server or a shore login server.

[0068] Specifically, the login information may include application ID, user UID (corresponding to user account), login password, etc. The target application is one of the applications in the first server, so S200 may be that the user terminal requests to log in to the application corresponding to the application ID in the first server according to the user UID and login password.

[0069] S210: The first server checks whether the login session of the user account for the target application has expired; if not, execute S220; if expired, execute S230.

[0070] Specifically, the first server may query the user information according to the user UID and password. The user information may include login session information, that is, a login session, and then check whether the login session is expired.

[0071] Further, S210 may include: the first server checks whether the current time exceeds the token update deadline corresponding to the user account to determine whether the login session of the user account with respect to the target application has expired.

[0072] Specifically, the login session may include the application ID, the last login time, the last logout time, the last login IP, the login MAC address, the last login geographic location, whether the user is currently online, and the token update time, i.e., the token update deadline.

[0073] Among them, the login session saves the login information of all application IDs of the current user. The application ID is the ID used to log in to the first server, the most recent login time is the information of the last login, and the most recent logout time is the information of the last logout. The last login IP is the IP information of the last login (the IP of the desktop computer on the ship can be assigned in advance, and the IP of the mobile phone logging in through WIFI is assigned by DHCP). If it is a desktop computer, the IP will not change, if it is a mobile phone, it may change. The login MAC address is the MAC address of the last login, and the last login geographic location is the geographic location corresponding to the uploaded login IP. The IP and geographic location are one-to-one corresponding. Whether it is currently online is to confirm whether the user account corresponding to the user UID is online on the target application. The token update time refers to the deadline when the application needs to update the token. The token update is based on the MAC as the basis for requesting an update.

[0074] Taking into account that the user may log in to the target application multiple times within a certain period of time, this embodiment can automatically extend the token update deadline. That is, this embodiment can further include: if the number of times the user terminal logs in to the target application within a set time period reaches a preset threshold number, the first server extends the token update deadline before the token update deadline.

[0075] Specifically, if a user account logs in to the target application beyond the token renewal deadline, it is necessary to log in to the onshore server to renew the token. If the user account logs in frequently, the first server can automatically renew the token before the remaining time of the token, such as 1 day or half a day ago, that is, the token of the frequently logged-in user account is automatically renewed, and there is no need to frequently request the onshore server for login verification.

[0076] S220: If it has not expired, the first server checks whether the user account has logged in to the first application in the first server. If so, the first server logs out of the first application by the user account, and then returns a message allowing login to the user terminal. After receiving the message allowing login, the user terminal logs in to the target application. If the user has not logged in to the first application in the first server, the first server returns a message allowing login to the user terminal. After receiving the message allowing login, the user terminal logs in to the target application.

[0077] S230: If it has expired, the first server requests the second server to update the login session; the second server updates the login session and checks whether the user account has logged in to the second application in the second server; if so, the second server causes the user account to log out of the second application, and then the second server returns the updated login session to the first server, the first server receives and updates the updated login session, and then returns a message allowing login to the user terminal, and the user terminal logs in to the target application after receiving the message allowing login; if the second application in the second server has not been logged in, the second server returns the updated login session to the first server, the first server receives and updates the updated login session, and then returns a message allowing login to the user terminal, and the user terminal logs in to the target application after receiving the message allowing login.

[0078] It should be noted that the first application and the second application are other applications that are not the target application.

[0079] Considering that the communication signal may be poor when the ship is at sea, optionally, this embodiment can update the login session by transmitting data via satellite. Therefore, as a further implementation method, refer to Figure 3 In S230, the first server requests the second server to update the login session, including:

[0080] S301: the first server sends a request message to the satellite to update the login session; S302: the satellite receives the request message and forwards the request message to the second server; S303: the second server updates the login session.

[0081] Reference Figure 4 The second server in S230 returns the updated login session to the first server, including:

[0082] S401: The second server returns an updated login session to the satellite; S402: The satellite receives the updated login session and returns the updated login session to the first server.

[0083] In order to ensure data integrity and encryption of the login process, before the user terminal obtains the login information in S200, this embodiment may further include S240: the user terminal requests to update the public key and private key of the asymmetric encryption.

[0084] Specifically, both the public key and the private key can be used to encrypt and decrypt login data, such as the login information described above. In an optional implementation, the public key can be stored in a first server, ie, the shipboard server, and the private key can be stored in a second server, ie, the shore server.

[0085] Furthermore, refer to Figure 5 , S240 may include S241 to S245:

[0086] S241: The user terminal requests the first server to update the asymmetric encryption public key, and the first server then requests the third server to update the asymmetric encryption public key.

[0087] Considering that the local area network is a confidential network with high security, when the ship docks and enters the land local area network, this embodiment can update the secret key in the local area network to ensure the security of the secret key. Therefore, the first server requests the third server to update the asymmetric encryption public key further including: the first server requests the third server to update the asymmetric encryption public key through the TCP protocol in the local area network.

[0088] S242: The user terminal requests the second server to update the asymmetric encryption private key, and the second server then requests the third server to update the asymmetric encryption private key.

[0089] The second server requesting the third server to update the asymmetric encryption private key may further include: the second server requesting the third server to update the asymmetric encryption private key through the TCP protocol in the local area network.

[0090] S243: The third server generates a corresponding asymmetric encryption public key and private key according to the application identifier in the login information requested for encryption.

[0091] S244: The third server returns the newly generated public key to the first server. The first server saves the newly generated public key and returns a message to the user terminal indicating that the public key has been updated.

[0092] The third server returning the newly generated public key to the first server may further include: the third server returning the newly generated public key to the first server via the TCP protocol within the local area network.

[0093] S245: The third server returns the newly generated private key to the second server. The second server saves the newly generated private key and returns a message to the user terminal indicating that the private key has been updated.

[0094] The third server returning the newly generated private key to the second server may further include: the third server returning the newly generated private key to the second server via the TCP protocol within the local area network.

[0095] This embodiment proposes a single sign-on method for linking a marine geological survey ship and an onshore base. The implementation process of the method may include:

[0096] 1) The login server on the geological ship (i.e., the first server) obtains data and requests to determine whether it is necessary to go to the login server on shore (i.e., the second server) for data verification based on the current session. If necessary, it is forwarded to the authentication server on the land base (i.e., the third server) based on satellite communication technology.

[0097] 2) When the login server on shore receives the user's login access request, it checks the account data status, user data status, and secret key status through the user account session data to determine whether the user can log in.

[0098] 3) After the login server on the geological ship receives the notification from the login server on shore via satellite, the login is successful and the target application can be accessed normally.

[0099] In order to more clearly understand the key update process of this application, Figure 6 The key update process of the present application is described with a complete optional example, which may specifically include steps 1 to 12:

[0100] Step 1: The operation and maintenance personnel log in to the server (i.e., the first server) on the geological vessel and request to update the asymmetric encrypted public key of the target application through the operation and maintenance interface with the help of the TCP protocol.

[0101] Step 2: The login server on the geological ship requests the authentication center server (i.e., the third server) to update the asymmetric encryption public key of the login target application through the TCP protocol. The request information includes personnel ID, ship ID (which can also be the application ID of a specific software system) and other information.

[0102] Step 3: The operation and maintenance personnel log in to the server (i.e., the second server) on the shore and request to update the asymmetric encryption private key of the target application through the operation and maintenance interface with the help of the TCP protocol. Generally, the time to update the secret key is when the ship docks, and the public key and private key are updated on land through the local area network, that is, steps 1 and 3 are usually completed by the operation and maintenance personnel in sequence. The land local area network is a confidential network, and its security is guaranteed.

[0103] Step 4: The login server on shore requests the authentication center server to update the asymmetric encryption private key of the target system through the TCP protocol. The request information includes personnel ID, ship ID (it can also be the application ID of a specific software system) and other information.

[0104] Step 5: The authentication center server generates an asymmetric encryption private key and public key based on the AppID of the requesting system. The AppID of the system generally refers to the ship ID (it can also be the application ID of a specific software system). Then the corresponding public key and private key are generated based on RSA-2048 and stored in the database together with the AppID. Each AppID only retains the latest key storage.

[0105] Step 6: The authentication center server responds to the asymmetrically encrypted public key request of the login server on the geological vessel through the TCP protocol. The response information includes the personnel ID, the ship ID (which can also be the application ID of a specific software system), and the public key information.

[0106] Step 7: The login server on the geological vessel can store a copy of the public key locally in the form of an encrypted file.

[0107] Step 8: The login server on the geological ship replies to the operation and maintenance personnel, and the asymmetric encryption public key of the login server on the geological ship is updated successfully.

[0108] Step 9: The authentication center server responds to the asymmetrically encrypted private key request of the shore login server. The response information includes personnel ID, ship ID (which can also be the application ID of a specific software system), and private key information.

[0109] Step 10: The onshore login server can store a copy of the private key locally in the form of an encrypted file.

[0110] Step 11: The login server on shore replies to the operation and maintenance personnel that the private key of the asymmetric encryption of the login server on shore has been successfully updated.

[0111] Step 12: The operation and maintenance personnel initiate a login test through the user terminal.

[0112] There are a few points to note about the above steps:

[0113] 1. Timing of key update: Generally, the key will be updated on land before each voyage, but it is not necessary to update the key on the open sea.

[0114] 2. Network for key update: In order to ensure the confidentiality of ship data, all ship data on shore are deployed in the local area network, and the confidentiality level is strengthened, so the above key update process can be updated through a dedicated line in the local area network. The authentication center server on shore is responsible for the key generation and storage of all key systems in the local area network, and its key is saved according to the system's Appid. And steps 1 and 3 are usually completed by operation and maintenance personnel.

[0115] 3. Distribution of public and private keys: Because the login server on shore can serve as the absolute authority for communication, the login server on shore can distribute private keys, and the login server on the geological ship can distribute public keys. When the operation and maintenance personnel request to log in to the target application through the user terminal, they use the private key to encrypt the login information, and the login server on shore uses the public key to decrypt the login information.

[0116] In order to more clearly understand the embodiments of the present application, Figure 7 This application is illustrated with a complete optional example.

[0117] The single sign-on method for linking the login server on the geological vessel with the login server on shore may specifically include steps 1 to 15:

[0118] Step 1: The user requests to log in to the application of the shipboard server through the user terminal on the ship 1. The user logs in to the login server on the geological ship through a mobile phone App or a fixed machine. The request can be made through the HTTPS protocol. The login information includes application ID, user UID, login password and other data.

[0119] Step 2: Application 1 on board requests to log in to the login server on board. The login server on board queries the user information (including login session information) according to the user UID and password to confirm whether the login is allowed.

[0120] Step 3: The login server on the ship checks whether the login session of application 1 on the ship is up or expired. The data format included in the application session can be: "Application ID, last login time, last logout time, last login IP, login MAC address, last login geographic location, whether currently online, token update time", and the session saves the login information of all application IDs of the current user. The application ID is the ID of the login server on the ship, the last login time is the information of the last login, and the last logout time is the information of the last logout. The last login IP is the IP information of the last login (the IP of the desktop computer on the ship is allocated in advance, and the IP of the mobile phone logged in through WIFI is allocated by DHCP). If it is a desktop computer, the IP will not change, but if it is a mobile phone, it may change. The login MAC address is the MAC address of the last login, and the last login geographic location is the geographic location corresponding to the uploaded login IP. The IP and geographic location are one-to-one. Whether it is currently online is to confirm whether the application is online on application 1. The token update time refers to the deadline when the application needs to update the token. The update of the token is based on the MAC as the basis for requesting an update, which will be described in detail below.

[0121] Take step 3 as an example: if user A has logged in to application 1 and application 2, the content of the session may include: {[application 1ID, 2022-10-23 18:00:34, 2022-10-23 19:21:04, 192.168.10.126, 81:03:C7:39:11:6B, No. 1 deck monitoring station desktop ThinkVersion EP270, No, 2022-10-25 16:21:04], [application 2ID, 2022-10-2316:00:34, 2022-10-23 12:21:04, 192.168.10.121, 12:58:E2:DB:70:B1, No. 1 deck Wifi access point, No, 2022-10-25 16:21:04]}.

[0122] The token renewal time of application 1 is 2022-10-25 16:21:04, that is, if you log in to application 1 after this time, you need to renew the token on the onshore login server. If the user logs in frequently, it will be automatically renewed when the remaining time of the token is 1 day. That is, the token of users who log in frequently will be automatically renewed, and there is no need to frequently request onshore server login verification.

[0123] Step 4: The login server on the ship checks the login status of other applications. After obtaining the user's session information, the login server on the ship will check the login status of the application. Because according to data confidentiality requirements, an application can only log in to one system at a time (for example, if the OA application is online, if it logs in to the laboratory system, the OA system will automatically go offline). Here, checking whether other applications are online can be achieved by checking "whether other applications are currently online". At the same time, it will also check whether the user's MAC address is a registered MAC address. A batch of MAC addresses will be registered on the ship in advance, and only registered ones will be allowed to log in to the system.

[0124] Step 5: The login server on the ship exits other applications. If multiple applications are found to be online, the login server on the ship will actively exit other applications and modify the session data status of the application. For example, if the user is online in application 2 and actively requests to log in to application 1, application 2 will be notified to exit the current user status, and the session information such as the last logout time of application 2 and whether it is currently online will be modified, and the session will be updated in the database.

[0125] Step 6: The login session of application 1 has not expired, and login is allowed. After handling the logout issues of other applications, the login server on the ship will confirm whether the user can log in based on the session information of the current application. It mainly checks whether the current time exceeds the token update time. If it exceeds, it means that the session has expired, otherwise it is within the validity period. If it is within the validity period, the session information will be updated, mainly the most recent login time, the most recent logout time, the last login IP, the login MAC address, the last login geographic location, whether it is currently online, and other information, and then try to update the token time. For example, assuming that the token update time of application 1 is 2022-10-25 16:21:04, and the current time is 2022-10-24 08:13:11, that is, it has not expired at this time, then the most recent login time, most recent logout time and other data of application 1 will be updated, and the token update time-current time>1 day, then this login will not be renewed for the token. If the current time is 2022-10-24 18:13:11, then the token update time - current time < 1 day, then the token will be renewed by default for one day, that is, the token update time is renewed from 2022-10-25 16:21:04 to 2022-10-26 16:21:04. It should be noted that token renewal does not need to notify the onshore server, which is a process optimization to improve user login efficiency.

[0126] Step 7: Application 1 logs in successfully. After the user's session check is successful (single sign-on, token check, etc.), Application 1 can log in normally.

[0127] Step 8: Application 1 login session expires, request update. If the session expires, it means that the user is logging in for the first time or has logged in after a long interval, and the token needs to be updated at this time. Because marine geological ships may be operating in the ocean, session updates need to be implemented with the help of satellites. In addition, the key update process was mentioned earlier, and the login server on the ship stores the public key corresponding to the application ID. The request for update includes the following information: application ID, user UID, user MAC address, user IP address, random number, token update time, and digital signature. The random number is randomly generated based on time, and the digital signature is md5sum (application ID + user UID + user MAC address + random number + token update time). This information will be encrypted using the assigned asymmetric encryption public key and sent to the login server on shore via satellite.

[0128] Step 9: Update the session information of application 1. After receiving the information, the login server on the shore will use the asymmetric encrypted private key to decrypt it. If the decryption fails, the session information will be refused to be updated. After the decryption is successful, the server on the shore will recalculate the digital signature, array signature = md5sum (application ID + user UID + user MAC address + random number + token update time). If the calculated digital signature is inconsistent with the transmitted digital signature, the session information will be refused to be updated. If they are consistent, it proves that the application ID and user UID do need to update the session.

[0129] Step 10: Check the login status of other applications on shore. After obtaining the user's session information, the login server on shore will check the login status of the application. Because according to data confidentiality requirements, an application can only log in to one system at a time (for example, if the application OA is online, if it logs in to the laboratory system, the OA system will automatically go offline). Checking whether it is online here is achieved by checking whether it is currently online. At the same time, it will also check whether the user's MAC address is a registered MAC address. A batch of MAC addresses will be registered on the ship in advance, and only registered ones are allowed to log in to the system.

[0130] Step 11: Exit other applications. If multiple applications are found online, the login server on the shore will actively exit other applications and modify the session data status of the application. For example, if the user is online in application 2 and actively requests to log in to application 1, application 2 will be notified to exit the current user status, and the session information of application 2, such as the last logout time and whether it is currently online, will be modified, and the session will be updated in the database.

[0131] Step 12: Reply to update the session information of application 1. At this time, the server on shore calculates the latest token update time based on the current time. Generally speaking, token update time = current time + N days, where N is generally 2 and N is configurable. Then regenerate the random number and calculate the digital signature, where array signature = md5sum (application ID + user UID + user MAC address + random number + token update time), and then send it to the login server on the ship via the satellite server.

[0132] Step 13: Update the session information of application 1. After receiving the information, the login server on the ship will use the asymmetric encrypted public key to decrypt it. If the decryption fails, the user login will be rejected. After the decryption is successful, the server on the ship will recalculate the digital signature, array signature = md5sum (application ID + user UID + user MAC address + random number + token update time). If the calculated digital signature is inconsistent with the transmitted digital signature, the login will be rejected. If they are consistent, the session will be updated directly.

[0133] Step 14: The login session of application 1 has not expired, so the user is allowed to log in. After the session is successfully updated, application 1 is notified directly, allowing the user to log in.

[0134] Step 15: Application 1 logs in successfully. After the user's session check is successful (single sign-on, token check, etc.), Application 1 can log in normally.

[0135] Reference Figure 8 , an embodiment of the present application provides a single sign-on system, including: a user terminal, a first server and a second server;

[0136] The user terminal, the first server and the second server are used to execute the above-mentioned single sign-on method.

[0137] Reference Fig. 9 , the embodiment of the present application provides another single sign-on system, further, the system also includes a third server;

[0138] The user terminal is further configured to request the first server to update the public key of the asymmetric encryption; and request the second server to update the private key of the asymmetric encryption;

[0139] The first server is further configured to request the third server to update the public key of the asymmetric encryption; save the newly generated public key, and return a message indicating that the public key has been updated to the user terminal;

[0140] The second server is further configured to request the third server to update the asymmetric encryption private key; save the newly generated private key, and return a message to the user terminal indicating that the private key has been updated;

[0141] The third server is used to generate a corresponding asymmetric encryption public key and private key according to the application identifier in the login information requested for encryption; return the newly generated public key to the first server; and return the newly generated private key to the second server.

[0142] The specific implementation of the single sign-on system is basically the same as the specific implementation of the single sign-on method described above, and will not be repeated here.

[0143] The embodiment of the present application also provides an electronic device, the electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the above-mentioned single sign-on method when executing the computer program. Specifically, the electronic device can be a user terminal or a server. The embodiment of the present application takes the computer device as an example of a user terminal, and the details are as follows:

[0144] like Fig.10 As shown, the computer device 1000 may include an RF (Radio Frequency) circuit 1010, a memory 1020 including one or more computer-readable storage media, an input unit 1030, a display unit 1040, a sensor 1050, an audio circuit 1060, a short-range wireless transmission module 1070, a processor 1080 including one or more processing cores, and a power supply 1090. Those skilled in the art will appreciate that Fig.10 The device structure shown in the figure does not constitute a limitation on the electronic device, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0145] The RF circuit 1010 can be used for receiving and sending signals during information transmission or calls. In particular, after receiving the downlink information of the base station, it is handed over to one or more processors 1080 for processing; in addition, the data related to the uplink is sent to the base station. Generally, the RF circuit 1010 includes but is not limited to an antenna, at least one amplifier, a tuner, one or more oscillators, a user identity module (SIM) card, a transceiver, a coupler, an LNA (Low Noise Amplifier), a duplexer, etc. In addition, the RF circuit 1010 can also communicate with the network and other devices through wireless communication. Wireless communication can use any communication standard or protocol, including but not limited to GSM (Global System of Mobile communication), GPRS (General Packet Radio Service), CDMA (Code Division Multiple Access), WCDMA (Wideband Code Division Multiple Access), LTE (Long Term Evolution), email, SMS (Short Messaging Service), etc.

[0146] The memory 1020 can be used to store software programs and modules. The processor 1080 executes various functional applications and data processing by running the software programs and modules stored in the memory 1020. The memory 1020 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area may store data created according to the use of the device 1000 (such as audio data, a phone book, etc.), etc. In addition, the memory 1020 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices. Accordingly, the memory 1020 may also include a memory controller to provide the processor 1080 and the input unit 1030 with access to the memory 1020. Although Fig.10 The RF circuit 1010 is shown, but it is understandable that it is not a necessary component of the device 1000 and can be omitted as needed without changing the essence of the invention.

[0147] The input unit 1030 can be used to receive input digital or character information, and generate keyboard, mouse, joystick, optical or trackball signal input related to user settings and function control. Specifically, the input unit 1030 may include a touch-sensitive surface 1031 and other input devices 1032. The touch-sensitive surface 1031, also known as a touch display screen or a touch pad, can collect user touch operations on or near it (such as operations performed by the user using any suitable object or accessory such as a finger, stylus, etc. on or near the touch-sensitive surface 1031), and drive the corresponding connection device according to a pre-set program. Optionally, the touch-sensitive surface 1031 may include two parts: a touch detection device and a touch controller. Among them, the touch detection device detects the user's touch direction, detects the signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts it into touch point coordinates, and then sends it to the processor 1080, and can receive and execute commands sent by the processor 1080. In addition, the touch-sensitive surface 1031 may be implemented in various types such as resistive, capacitive, infrared, and surface acoustic wave. In addition to the touch-sensitive surface 1031, the input unit 1030 may further include other input devices 1032. Specifically, the other input devices 1032 may include, but are not limited to, one or more of a physical keyboard, a function key (such as a volume control key, a switch key, etc.), a trackball, a mouse, a joystick, and the like.

[0148] The display unit 1040 can be used to display information input by the user or information provided to the user and various graphical user interfaces of the control 1000, which can be composed of graphics, text, icons, videos and any combination thereof. The display unit 1040 may include a display panel 1041. Optionally, the display panel 1041 may be configured in the form of LCD (Liquid Crystal Display), OLED (Organic Light-Emitting Diode), etc. Further, the touch-sensitive surface 1031 may be covered on the display panel 1041. When the touch-sensitive surface 1031 detects a touch operation on or near it, it is transmitted to the processor 1080 to determine the type of touch event. Subsequently, the processor 1080 provides a corresponding visual output on the display panel 1041 according to the type of touch event. Although in Fig.10 In the embodiment, the touch-sensitive surface 1031 and the display panel 1041 are implemented as two independent components to implement input and output functions, but in some embodiments, the touch-sensitive surface 1031 and the display panel 1041 can be integrated to implement input and output functions.

[0149] The computer device 1000 may also include at least one sensor 1050, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor may include an ambient light sensor and a proximity sensor, wherein the ambient light sensor may adjust the brightness of the display panel 1041 according to the brightness of the ambient light, and the proximity sensor may turn off the display panel 1041 and / or the backlight when the device 1000 is moved to the ear. As a type of motion sensor, the gravity acceleration sensor can detect the magnitude of acceleration in each direction (generally three axes), and can detect the magnitude and direction of gravity when stationary, which can be used for applications that recognize the posture of the mobile phone (such as horizontal and vertical screen switching, related games, magnetometer posture calibration), vibration recognition related functions (such as pedometer, tapping), etc.; as for other sensors that can also be configured in the device 1000, such as gyroscopes, barometers, hygrometers, thermometers, infrared sensors, etc., they will not be repeated here.

[0150] The audio circuit 1060, the speaker 1061, and the microphone 1062 can provide an audio interface between the user and the device 1000. The audio circuit 1060 can transmit the received audio data to the speaker 1061 after converting the received audio data into an electrical signal, which is converted into a sound signal for output by the speaker 1061; on the other hand, the microphone 1062 converts the collected sound signal into an electrical signal, which is received by the audio circuit 1060 and converted into audio data, and then the audio data is processed by the output processor 1080 and sent to another control device through the RF circuit 1010, or the audio data is output to the memory 1020 for further processing. The audio circuit 1060 may also include an earphone jack to provide communication between an external headset and the device 1000.

[0151] The short-distance wireless transmission module 1070 may be a WIFI (wireless fidelity) module, a Bluetooth module, an infrared module, etc. The device 1000 may transmit information with a wireless transmission module provided on a competing device through the short-distance wireless transmission module 1070 .

[0152] The processor 1080 is the control center of the device 1000. It uses various interfaces and lines to connect various parts of the entire control device. By running or executing software programs and / or modules stored in the memory 1020, and calling data stored in the memory 1020, it executes various functions of the device 1000 and processes data, thereby monitoring the control device as a whole. Optionally, the processor 1080 may include one or more processing cores; optionally, the processor 1080 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, etc., and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 1050.

[0153] The device 1000 also includes a power supply 1090 (such as a battery) for supplying power to each component. Preferably, the power supply can be logically connected to the processor 1080 through a power management system, so that the power management system can manage charging, discharging, and power consumption management. The power supply 1090 can also include any components such as one or more DC or AC power supplies, recharging systems, power failure detection circuits, power converters or inverters, and power status indicators.

[0154] Although not shown, the device 1000 may also include a camera, a Bluetooth module, etc., which are not described in detail here. The present application also provides a computer-readable storage medium, which stores a computer program, and when the computer program is executed by a processor, the above single sign-on method is implemented.

[0155] An embodiment of the present application also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned single sign-on method is implemented.

[0156] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0157] The present application also discloses a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. The processor of the electronic device can read the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction so that the electronic device executes Figure 2 The method shown.

[0158] In some optional embodiments, the function / operation mentioned in the block diagram may not occur in the order mentioned in the operation diagram. For example, depending on the function / operation involved, the two boxes shown in succession can actually be executed substantially simultaneously or the boxes can sometimes be executed in reverse order. In addition, the embodiment presented and described in the flow chart of the application is provided by way of example, for the purpose of providing a more comprehensive understanding of technology. The disclosed method is not limited to the operation and logic flow presented herein. Optional embodiments are expected, wherein the order of various operations is changed and the sub-operation described as a part of a larger operation is performed independently.

[0159] In addition, although the present application is described in the context of functional modules, it should be understood that, unless otherwise specified, one or more of the functions and / or features described may be integrated into a single physical device and / or software module, or one or more functions and / or features may be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the present application. More specifically, in view of the properties, functions, and internal relationships of the various functional modules in the device disclosed herein, the actual implementation of the module will be understood within the conventional skills of the engineer. Therefore, those skilled in the art can implement the present application set forth in the claims without excessive experimentation using ordinary techniques. It is also understood that the specific concepts disclosed are merely illustrative and are not intended to limit the scope of the present application, which is determined by the full scope of the attached claims and their equivalents.

[0160] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for enabling an electronic device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0161] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0162] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0163] It should be understood that the various parts of the present application can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0164] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0165] Although the embodiments of the present application have been shown and described, those skilled in the art will appreciate that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present application, and that the scope of the present application is defined by the claims and their equivalents.

[0166] The above is a specific description of the preferred implementation of the present application, but the present application is not limited to the described embodiments. Technical personnel familiar with the field may make various equivalent modifications or substitutions without violating the spirit of the present application. These equivalent modifications or substitutions are all included in the scope defined by the claims of the present application.

Claims

1. A single sign-on method, characterized in that: include: Acquire login information through a user terminal and initiate a login session for requesting to log in to a target application in the first server according to the login information; wherein the login information includes a user account; Checking, by the first server, whether a login session of the user account with respect to the target application has expired; If it has not expired, checking whether the user account has logged into the first application in the first server through the first server, and if so, causing the user account to log out of the first application through the first server, and then returning a message allowing login to the user terminal, and the user terminal logs in to the target application after receiving the message allowing login; if the user has not logged into the first application in the first server, returning a message allowing login to the user terminal through the first server, and the user terminal logs in to the target application after receiving the message allowing login; If it has expired, the first server is used to request the second server to update the login session; the second server is used to update the login session, and it is checked whether the user account has logged in to the second application in the second server; if so, the second server is used to log out of the second application, and then the updated login session is returned to the first server through the second server, the updated login session is received and updated through the first server, and then a message allowing login is returned to the user terminal, and the user terminal receives the message allowing login and then logs in to the target application; if the second application in the second server has not been logged in, the updated login session is returned to the first server through the second server, the updated login session is received and updated through the first server, and then a message allowing login is returned to the user terminal, and the user terminal receives the message allowing login and then logs in to the target application.

2. A single sign-on method according to claim 1, characterized in that: Before acquiring the login information through the user terminal, the method further includes: Requesting to update the public key and private key of asymmetric encryption through the user terminal.

3. A single sign-on method according to claim 2, characterized in that: The requesting, through the user terminal, to update the public key and the private key of the asymmetric encryption comprises: Requesting the first server to update the public key of the asymmetric encryption through the user terminal, and then requesting the third server to update the public key of the asymmetric encryption through the first server; Requesting the second server to update the asymmetric encryption private key through the user terminal, and then requesting the third server to update the asymmetric encryption private key through the second server; Generate a corresponding asymmetric encryption public key and private key through the third server according to the application identifier in the login information requested for encryption; Returning the newly generated public key to the first server through the third server, saving the newly generated public key through the first server, and returning a message that the public key has been updated to the user terminal; The newly generated private key is returned to the second server through the third server, the newly generated private key is saved through the second server, and a message that the private key has been updated is returned to the user terminal.

4. A single sign-on method according to claim 3, characterized in that: The requesting the third server to update the asymmetric encryption public key through the first server includes: requesting the third server to update the asymmetric encryption public key through the first server in the local area network through the TCP protocol; The requesting the third server to update the asymmetric encryption private key through the second server includes: requesting the third server to update the asymmetric encryption private key through the second server in the local area network through the TCP protocol; The returning the newly generated public key to the first server through the third server includes: returning the newly generated public key to the first server through the third server in the local area network through the TCP protocol; The returning the newly generated private key to the second server through the third server includes: returning the newly generated private key to the second server through the TCP protocol in the local area network through the third server.

5. A single sign-on method according to claim 1, characterized in that: The checking, by the first server, whether the login session of the user account with respect to the target application has expired includes: The first server checks whether the current time exceeds the token update deadline corresponding to the user account. If so, it is determined that the login session of the user account for the target application has expired; if it does not exceed the token update deadline corresponding to the user account, it is determined that the login session of the user account for the target application has not expired.

6. A single sign-on method according to claim 5, characterized in that: The method further comprises: If the number of times the user terminal logs into the target application within a set time period reaches a preset threshold number, the token update deadline is extended by the first server before the token update deadline.

7. A single sign-on method according to claim 1, characterized in that: The requesting the second server to update the login session through the first server includes: sending request information to a satellite through the first server; receiving the request information through the satellite and forwarding the request information to the second server; updating the login session through the second server; The returning the updated login session to the first server through the second server includes: returning the updated login session to the satellite through the second server; receiving the updated login session through the satellite and returning the updated login session to the first server.

8. A single sign-on system, characterized in that: include: A user terminal, a first server and a second server; The user terminal, the first server and the second server are used to execute a single sign-on method as described in any one of claims 1 to 7.

9. A single sign-on system according to claim 8, characterized in that: The system further comprises a third server; The user terminal is further configured to request the first server to update the public key of the asymmetric encryption; and request the second server to update the private key of the asymmetric encryption; The first server is further used to request the third server to update the public key of the asymmetric encryption; Save the newly generated public key and return a message that the public key has been updated to the user terminal; The second server is further configured to request the third server to update the asymmetric encryption private key; save the newly generated private key, and return a message to the user terminal indicating that the private key has been updated; The third server is used to generate a corresponding asymmetric encryption public key and private key according to the application identifier in the login information requested for encryption; and return the newly generated public key to the first server; The newly generated private key is returned to the second server.

10. An electronic device, characterized in that: including a processor and a memory; The memory is used to store programs; The processor executes the program to implement a single sign-on method according to any one of claims 1 to 7.

Images