Single sign-on method, system and electronic device

Abstract

The application discloses a single sign-on method, system and electronic equipment. The method comprises the following steps: a user terminal acquires login information and initiates a login session for requesting to log in a target application in a first server according to the login information; then, the first server checks whether the login session of a user account in the login information about the target application is expired; if not, the first server can log in the target application again after logging out other applications of the user account; if yes, the first server can request a second server to update the login session; then, the second server updates the login session and logs out other applications of the user account on the second server; and finally, the user terminal logs in the target application according to the updated login session. The application can improve the security of logging in a ship system and a shore system, and can be widely applied in the technical field of communication.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication, and in particular to a single sign-on method, system and electronic device. BACKGROUND

[0002] Currently, the single sign-on method of the linkage between the marine geological survey ship and the shore base is realized separately on the ship and the shore, that is, the login system of the marine geological ship and the login system on the shore are completely isolated, and the ship system generally synchronizes the account information from the shore system at regular intervals. The implementation scheme of the prior art is as follows: 1) the terminal on the geological ship requests to log in to the ship system to obtain data, and the ship system judges the rationality of the terminal account. 2) After the ship system confirms that it can log in, the terminal can normally access the ship system.

[0003] The disadvantages of the prior art are that the user logging in to the system on the geological ship through the terminal does not perform account verification, single sign-on check and other work on the shore base, that is, there may be a state that multiple users are online simultaneously with one account, which is not conducive to data security. SUMMARY

[0004] Therefore, the present application provides a single sign-on method, system and electronic device to improve the security when logging in to the ship system and the shore system.

[0005] An aspect of the present application provides a single sign-on method, comprising:

[0006] obtaining login information through a user terminal and initiating a login session about requesting to log in to a target application in a first server according to the login information; wherein the login information comprises a user account;

[0007] checking whether the login session of the user account about the target application is expired through the first server;

[0008] if not, checking whether the user account has logged in a first application in the first server through the first server, if yes, causing the user account to log out of the first application through the first server, then returning a login allowed message to the user terminal, and logging in to the target application after receiving the login allowed message through the user terminal; if not logged in to the first application in the first server, returning a login allowed message to the user terminal through the first server, and logging in to the target application after receiving the login allowed message through the user terminal;

[0009] If expired, request the first server to request the second server to update the login session; update the login session by the second server, and check whether the user account has logged into a second application in the second server; if yes, make the user account log out of the second application by the second server, then return the updated login session to the first server by the second server, receive the updated login session by the first server and update, then return the message allowing login to the user terminal, log into the target application after receiving the message allowing login by the user terminal; if not logged into the second application in the second server, return the updated login session to the first server by the second server, receive the updated login session by the first server and update, then return the message allowing login to the user terminal, log into the target application after receiving the message allowing login by the user terminal.

[0010] Optionally, before the login information is obtained by the user terminal, the method further comprises:

[0011] Request the user terminal to update the public key and the private key of the asymmetric encryption.

[0012] Optionally, the request of the user terminal to update the public key and the private key of the asymmetric encryption comprises:

[0013] Request the first server to request the third server to update the public key of the asymmetric encryption by the user terminal, and further request the third server to update the public key of the asymmetric encryption by the first server;

[0014] Request the second server to request the third server to update the private key of the asymmetric encryption by the user terminal, and further request the third server to update the private key of the asymmetric encryption by the second server;

[0015] Generate the corresponding public key and the private key of the asymmetric encryption according to the application identifier in the requested encrypted login information by the third server;

[0016] Return the newly generated public key to the first server by the third server, save the newly generated public key by the first server, and return the message that the public key has been updated to the user terminal by the first server;

[0017] Return the newly generated private key to the second server by the third server, save the newly generated private key by the second server, and return the message that the private key has been updated to the user terminal by the second server.

[0018] Optionally, the requesting, by the first server, the third server for updating the public key of the asymmetric encryption comprises: requesting, by the first server, the third server for updating the public key of the asymmetric encryption through a TCP protocol within a local area network.

[0019] The requesting, by the second server, the third server for updating the private key of the asymmetric encryption comprises: requesting, by the second server, the third server for updating the private key of the asymmetric encryption through a TCP protocol within the local area network.

[0020] The returning, by the third server, the newly generated public key to the first server comprises: returning, by the third server, the newly generated public key to the first server through a TCP protocol within the local area network.

[0021] The returning, by the third server, the newly generated private key to the second server comprises: returning, by the third server, the newly generated private key to the second server through a TCP protocol within the local area network.

[0022] Optionally, the checking, by the first server, whether the login session of the user account about the target application is expired comprises:

[0023] checking, by the first server, whether the current time exceeds the token update deadline corresponding to the user account, and if yes, determining that the login session of the user account about the target application is expired; and if not, determining that the login session of the user account about the target application is not expired.

[0024] Optionally, the method further comprises:

[0025] if the number of times of logging into the target application by the user terminal within a set time period reaches a preset threshold number of times, then extending, by the first server, the token update deadline before the token update deadline.

[0026] Optionally, the requesting, by the first server, the second server for updating the login session comprises: sending, by the first server, request information to a satellite; receiving, by the satellite, the request information and forwarding the request information to the second server; and updating, by the second server, the login session.

[0027] The returning, by the second server, the updated login session to the first server comprises: returning, by the second server, the updated login session to the satellite; and receiving, by the satellite, the updated login session and returning the updated login session to the first server.

[0028] Another aspect of the present application also provides a single sign-on system, comprising a user terminal, a first server and a second server;

[0029] The user terminal, the first server and the second server are configured to perform the single sign-on method described above.

[0030] Optionally, the system further comprises a third server;

[0031] The user terminal is further configured to request the first server to update the public key of the asymmetric encryption, and request the second server to update the private key of the asymmetric encryption.

[0032] The first server is further configured to request the third server to update the public key of the asymmetric encryption, save the newly generated public key, and return a message to the user terminal that the public key has been updated.

[0033] The second server is further configured to request the third server to update the private key of the asymmetric encryption, save the newly generated private key, and return a message to the user terminal that the private key has been updated.

[0034] The third server is configured to generate the corresponding public key and private key of the asymmetric encryption according to the application identifier in the requested encrypted login information, return the newly generated public key to the first server, and return the newly generated private key to the second server.

[0035] Another aspect of the present application also provides an electronic device, comprising a processor and a memory;

[0036] The memory is configured to store a program.

[0037] The processor executes the program to implement the method described above.

[0038] Another aspect of the present application also provides a computer-readable storage medium, which stores a program. The program is executed by a processor to implement the method described above.

[0039] The present application also discloses a computer program product or a computer program, which comprises computer instructions stored in a computer-readable storage medium. The processor of the electronic device can read the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions to make the electronic device perform the method described above.

[0040] The user terminal of the present application acquires login information and requests login of a target application in the first server according to the login information. Then, the first server checks whether the login session of the user account in the login information about the target application is expired. If not, the first server can log out other applications (i.e. the first application) logged in by the user account and log in the target application again. If the login session is expired, the first server can request the second server to update the login session. Then, the second server updates the login session and logs out other applications (i.e. the second application) logged in by the user account. Then, the user terminal logs in the target application according to the updated login session. When the user account logs in the target application of the first server for the first time or logs in the target application again after a long interval, the present application can confirm the communication state of the login session corresponding to the user account in time, determine whether the login session is expired, and then log out other applications logged in by the user account, so as to ensure that there is only a single user account logged in the first server or the second server. The present application can also use the session cache technology to ensure the fluency when the user account logs in the first server (i.e. the server on the ship). BRIEF DESCRIPTION OF DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0042] Figure 1 A communication schematic diagram of a ship and a shore base provided by an embodiment of the present application;

[0043] Figure 2 A flowchart of a single sign-on method provided by an embodiment of the present application;

[0044] Figure 3 And Figure 4 A flowchart of updating a login session provided by an embodiment of the present application;

[0045] Figure 5 A flowchart of updating a public key and a secret key of asymmetric encryption provided by an embodiment of the present application;

[0046] Figure 6 A timing diagram of updating a public key and a secret key of asymmetric encryption provided by an embodiment of the present application;

[0047] Figure 7 A timing diagram of a single sign-on method provided by an embodiment of the present application;

[0048] Figure 8A structural schematic diagram of a single sign-on system provided by an embodiment of the present application is shown in FIG. 1.

[0049] Figure 9 A structural schematic diagram of another single sign-on system provided by an embodiment of the present application is shown in FIG. 2.

[0050] Figure 10 A structural block diagram of an electronic device provided by an embodiment of the present application is shown in FIG. 3. DETAILED DESCRIPTION

[0051] In order to make the objects, technical solutions and advantages of the present application clearer, the present application is further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and should not be used to limit the present application.

[0052] It should be noted that although the functional modules are divided in the device schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in a manner different from the module division in the device or the order in the flowchart.

[0053] The terms "first", "second", and the like in the specification and claims and the above-described accompanying drawings are used to distinguish similar objects, and do not necessarily have to describe a specific order or sequence. Also, the terms "include", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or device. Without more limitations, the element defined by the statement "including a" does not exclude the presence of another identical element in the process, method, article or device including the element.

[0054] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the present application belongs. The terms used herein are only for the purpose of describing the embodiments of the present application and are not intended to limit the present application.

[0055] In order to facilitate the understanding of the embodiments of the present application, the key words that may be involved in the embodiments of the present application are explained:

[0056] Single sign-on (SSO), when a user logs in on an identity authentication server once, the user can obtain the access permission to other related systems and application software in the single sign-on system.

[0057] Single user online: the system allows only one account maximum at the same time a user online, that is, there is no two users using the same account password login, usually have the requirement of confidentiality of the system will have this requirement, such as various bank card app, etc.

[0058] VSAT satellite communication (Very Small Aperture Terminal): VSAT due to the traditional satellite communication system, so also known as satellite small data station or personal earth station, here "small" refers to the VSAT system of small station equipment antenna aperture is small, usually 0.3m~1.4m, the device structure is compact, solid, intelligent, cheap, easy to install, the use of environment requirements are not high, and not limited by the ground network, flexible networking.

[0059] Drilling vessel (Drilling Vessel) is used for drilling on the seabed geological structure of the ship, mainly for marine geological exploration. With the implementation of the national ocean strategy, China's drilling ship more and more frequently in the Pacific Ocean and other international ocean, at this time the ship and the shore base communication means only satellite, communication process can refer to Figure 1 .

[0060] Asymmetric encryption (Drilling Vessel): asymmetric encryption algorithm uses two completely different but completely matched pair of keys-public key and private key. In the use of asymmetric encryption algorithm to encrypt the file, only the use of matching pair of public key and private key, can complete the encryption and decryption process of plaintext. RSA is one of the most representative asymmetric encryption algorithm, RSA public key cryptography using different encryption and decryption key.

[0061] MD5 algorithm is often used to verify the integrity of network file transfer, to prevent the file tampered. MD5 full name is message digest algorithm (Message-Digest Algorithm 5), the algorithm on the information bit by bit calculation, produce a binary length of 128 bits (hexadecimal length is 32 bits) "fingerprint" (or "message digest"), the possibility of different files to produce the same message digest is very very small. Generally speaking, after the installation of Linux, there will be md5sum this tool, directly in the command line terminal directly run.

[0062] TCP (Transmission Control Protocol) is a connection-oriented, reliable, byte-stream based transport layer communication protocol. TCP is intended to fit into a layered protocol hierarchy that supports multi-network applications. Reliable communication services between pairs of processes in host computers connected to different but interconnected computer communication networks are provided by means of TCP. TCP assumes that it can obtain a simple, possibly unreliable datagram service from lower level protocols. In principle, TCP should be able to operate on top of a variety of communication systems ranging from hard-wired connections to packet-switched or circuit-switched networks.

[0063] MAC address (Media Access Control Address) is the network identification of each device in the network, which is written in the hardware by the manufacturer when the network device is produced. The MAC address is 48 bits (6 bytes), usually represented by 12 hexadecimal numbers, separated by colons between every 2 hexadecimal numbers, such as 08:00:20:0A:8C:6D is a MAC address. The first 3 bytes represent OUI (Organizationally Unique Identifier), which is the code assigned by the IEEE registration management agency to distinguish different manufacturers.

[0064] HTTPS (Hypertext Transfer Protocol Secure) is a secure HTTP channel, which is based on HTTP and ensures the security of the transmission process through transmission encryption and identity authentication. HTTPS adds SSL to HTTP, and the security basis of HTTPS is SSL, so the detailed content of encryption needs SSL. HTTPS has a different default port from HTTP and an encryption / identity authentication layer (between HTTP and TCP). This system provides identity authentication and encrypted communication methods. It is widely used in secure communication on the World Wide Web, such as transaction payment.

[0065] Reference Figure 2 The embodiment of the present application provides a single sign-on method, comprising steps S200 to S230, specifically as follows:

[0066] S200: The user terminal acquires login information and initiates a login session about requesting to log in to a target application in a first server according to the login information; wherein the login information comprises a user account.

[0067] Firstly, the user terminal, the first server and the second server involved in the embodiment are described: the user terminal can be a mobile phone, a tablet computer, a PC computer and other optional forms of smart terminal; the first server can be a server arranged on a marine geological survey ship, and the first server can also be referred to as a shipboard server or a shipboard login server; the second server can be a server arranged on a shore base, and the second server can also be referred to as a shore server or a shore login server.

[0068] Specifically, the login information can include application ID, user UID (corresponding to user account), login password and the like. The target application is one of the applications in the first server, so S200 can be that the user terminal requests to log in the application corresponding to the application ID in the first server according to the user UID and the login password.

[0069] S210: The first server checks whether the login session of the user account about the target application is expired; if not, S220 is executed, and if yes, S230 is executed.

[0070] Specifically, the first server can query user information according to the user UID and the password, and the user information can include login session information, i.e. login session, and then check whether the login session is expired.

[0071] Further, S210 can include: the first server checks whether the current time exceeds the token update deadline corresponding to the user account, to determine whether the login session of the user account about the target application is expired.

[0072] Specifically, the login session can include application ID, last login time, last logout time, last login IP, login MAC address, last login geographic location, whether online currently and token update time, i.e. token update deadline.

[0073] The login session saves the login information of all application IDs of the current user. The application ID is an ID used to log in to the first server, the last login time is the information of the last login, the last logout time is the information of the last logout, the last login IP is the IP information of the last login (the IP of the desktop computer on the ship can be allocated in advance, and the IP of the mobile phone logged in through WIFI is allocated by DHCP), if it is a desktop computer, the IP will not change, if it is a mobile phone, the IP can change. The login MAC address is the MAC address of the last login, the last login geographic location is the geographic location corresponding to the login IP, the IP and the geographic location are one-to-one correspondence. Whether the current user is online is to confirm whether the user account corresponding to the user UID is in the online state on the target application. The token update time refers to the deadline for the application to update the token, and the update of the token is requested based on the MAC.

[0074] Considering that the user can log in to the target application multiple times in a period of time, the token update deadline can be automatically extended in this embodiment, that is, the embodiment can further include: if the number of times that the user terminal logs in to the target application within a set time period reaches a preset threshold number of times, the first server extends the token update deadline before the token update deadline.

[0075] Specifically, if the user account logs in to the target application at a time exceeding the token update deadline, it needs to log in to the shore server to renew the token. If the user account frequently logs in, the first server can automatically renew the token before the remaining time of the token, for example, 1 day or half a day ago, that is, the token of the frequently logged-in user account is automatically renewed, and the shore server does not need to be frequently requested for login verification.

[0076] S220: If it is not expired, the first server checks whether the user account has logged in to the first application in the first server, if yes, the first server logs out the user account from the first application, and then returns a login allowed message to the user terminal, and the user terminal logs in to the target application after receiving the login allowed message; if not logged in to the first application in the first server, the first server returns a login allowed message to the user terminal, and the user terminal logs in to the target application after receiving the login allowed message.

[0077] S230: If expired, the first server requests the second server to update the login session; the second server updates the login session and checks whether the user account has logged into a second application in the second server; if yes, the second server causes the user account to log out of the second application, and then the second server returns the updated login session to the first server, the first server receives the updated login session and updates, and then returns a login-allowed message to the user terminal, and the user terminal logs into the target application after receiving the login-allowed message; if not logged into the second application in the second server, the second server returns the updated login session to the first server, the first server receives the updated login session and updates, and then returns a login-allowed message to the user terminal, and the user terminal logs into the target application after receiving the login-allowed message.

[0078] It should be noted that the first application and the second application are other applications than the target application.

[0079] It should be noted that the first application and the second application are other applications than the target application.

[0079] Considering that the communication signal may not be good when the ship is at sea, optionally, the embodiment can update the login session by satellite communication data, therefore, as a further implementation, referring to Figure 3 , the first server in S230 requests the second server to update the login session, including:

[0080] S301: The first server sends request information to the satellite to update the login session; S302: The satellite receives the request information and forwards the request information to the second server; S303: The second server updates the login session.

[0081] Referring to Figure 4 , the second server in S230 returns the updated login session to the first server, including:

[0082] S401: The second server returns the updated login session to the satellite; S402: The satellite receives the updated login session and returns the updated login session to the first server.

[0083] In order to ensure the data integrity and encryption of the login process, before the user terminal in S200 obtains the login information, the embodiment can further include S240: The user terminal requests to update the public key and the private key of the asymmetric encryption.

[0084] In particular, both the public key and the private key can be used to encrypt and decrypt login data, such as the login information described above. In an alternative embodiment, the public key can be stored in the first server, i.e. the on-board server, while the private key can be stored in the second server, i.e. the on-shore server.

[0085] Further, with reference to Figure 5 S240 can include S241-S245:

[0086] S241: The user terminal requests the first server to update the public key of the asymmetric encryption, and the first server requests the third server to update the public key of the asymmetric encryption.

[0087] Considering that the local area network belongs to a confidential network and has high security, when the ship docks into the land local area network, the embodiment can update the secret key in the local area network to ensure the security of the secret key. Therefore, the first server requesting the third server to update the public key of the asymmetric encryption can further include that the first server requests the third server to update the public key of the asymmetric encryption in the local area network through the TCP protocol.

[0088] S242: The user terminal requests the second server to update the private key of the asymmetric encryption, and the second server requests the third server to update the private key of the asymmetric encryption.

[0089] The second server requesting the third server to update the private key of the asymmetric encryption can further include that the second server requests the third server to update the private key of the asymmetric encryption in the local area network through the TCP protocol.

[0090] S243: The third server generates the corresponding public key and private key of the asymmetric encryption according to the application identifier in the encrypted login information.

[0091] S244: The third server returns the newly generated public key to the first server, the first server saves the newly generated public key, and returns a message that the public key has been updated to the user terminal.

[0092] The third server returning the newly generated public key to the first server can further include that the third server returns the newly generated public key to the first server in the local area network through the TCP protocol.

[0093] S245: The third server returns the newly generated private key to the second server, the second server saves the newly generated private key, and returns a message that the private key has been updated to the user terminal.

[0094] The third server returns the newly generated private key to the second server, which can further include that the third server returns the newly generated private key to the second server through a TCP protocol within the local area network.

[0095] The embodiment proposes a single sign-on method for linkage between an ocean geological survey ship and a shore base. The implementation process of the method can include:

[0096] 1) The login server (i.e., the first server) on the geological ship acquires data and requests to determine whether data verification is needed at the login server (i.e., the second server) on the shore according to the current session. If so, the data is forwarded to the authentication server (i.e., the third server) of the land base based on satellite communication technology.

[0097] 2) When the login server on the shore receives a login access request of a user, the account data state, the user data state, and the secret key state are checked through user account session data to determine whether the user can log in.

[0098] 3) The login server on the geological ship can normally access the target application after receiving the notification from the login server on the shore and logging in successfully through the satellite.

[0099] To facilitate a clearer understanding of the secret key update process of the present application, the secret key update process of the present application will be described below in combination with Figure 6 The secret key update process of the present application will be described below in combination with a complete optional example, which can include steps 1-12.

[0100] Step 1: The operation personnel on the login server (i.e., the first server) on the geological ship request to update the asymmetrically encrypted public key of the login target application through an operation interface by means of a TCP protocol.

[0101] Step 2: The login server on the geological ship requests to update the asymmetrically encrypted public key of the login target application to the authentication center server (i.e., the third server) through a TCP protocol. The request information includes personnel ID, ship ID (or application ID of a specific software system), and the like.

[0102] Step 3: The operation personnel on the login server (i.e., the second server) on the shore request to update the asymmetrically encrypted private key of the login target application through an operation interface by means of a TCP protocol. Generally, the timing of updating the secret key is when the ship is at the shore, and the public key and the private key are updated on the land through a local area network, i.e., steps 1 and 3 are usually completed by the operation personnel in sequence. The land local area network belongs to a confidential network, and the security is guaranteed.

[0103] Step 4: The login server on the shore requests the asymmetric encryption private key of the target system from the authentication center server through the TCP protocol, and the request information includes personnel ID, ship ID (or application ID of a specific software system), etc.

[0104] Step 5: The authentication center server generates asymmetric encryption private and public keys based on the Appid of the requesting system. The Appid generally refers to the ship ID (or application ID of a specific software system). Then, based on RSA-2048, the corresponding public and private keys are generated and stored in the database together with the Appid. Only the latest secret key is stored for each Appid.

[0105] Step 6: The authentication center server replies to the login server on the geological ship through the TCP protocol for the request of asymmetric encryption public key, and the reply information includes personnel ID, ship ID (or application ID of a specific software system), and public key information.

[0106] Step 7: The login server on the geological ship can store a copy of the public key locally in the form of an encrypted file.

[0107] Step 8: The login server on the geological ship replies to the maintenance personnel that the asymmetric encryption public key update of the login server on the geological ship is successful.

[0108] Step 9: The authentication center server replies to the login server on the shore for the request of asymmetric encryption private key, and the reply information includes personnel ID, ship ID (or application ID of a specific software system), and private key information.

[0109] Step 10: The login server on the shore can store a copy of the private key locally in the form of an encrypted file.

[0110] Step 11: The login server on the shore replies to the maintenance personnel that the asymmetric encryption private key update of the login server on the shore is successful.

[0111] Step 12: The maintenance personnel initiates a login test through the user terminal.

[0112] Regarding the above steps, the following points need to be explained:

[0113] 1. Secret key update timing: Generally, the secret key is updated on land before each voyage, and the secret key can not be updated on the ocean.

[0114] 2. Network of key update: In order to ensure the confidentiality of the ship data, the shore side about the ship data is deployed in the local area network, and the security level is enhanced, so the above key update process can be updated in the local area network through the dedicated line. The authentication center server on the shore is responsible for the key generation and storage of all key systems in the local area network, and its key is saved according to the system Appid. And step 1 and step 3 are usually completed by the operation personnel.

[0115] 3. Allocation of public and private keys: Because the login server on the shore can serve as the absolute authority of communication, the login server on the shore can allocate private keys, and the login server on the geological ship can allocate public keys. The operation personnel use the private key to encrypt the login information when requesting to log in to the target application through the user terminal, and the login server on the shore uses the public key to decrypt the login information.

[0116] In order to facilitate a clearer understanding of the present application, the following will be combined with Figure 7 The present application will be described in a complete optional example.

[0117] The single sign-on method of the login server on the geological ship and the login server on the shore can specifically include steps 1-15:

[0118] Step 1: The user requests to log in to the application 1 of the server on the ship through the user terminal on the ship. The user logs in to the login server on the geological ship through the mobile phone App or fixed machine, and the request can be requested through the HTTPS protocol. The login information includes application ID, user UID, login password and other data.

[0119] Step 2: The ship application 1 requests to log in to the ship login server. The login server on the ship queries the user information (including login session information) according to the user UID and password, and confirms whether it can log in.

[0120] Step 3: The on-board login server checks whether the login session of the on-board application 1 is expired or not. The data format included in the session of the application can be: {application ID, last login time, last logout time, last login IP, login MAC address, last login geographic location, current online status, token update time}, the session saves the login information of all application IDs of the current user. The application ID is the ID of the login server on the ship, the last login time is the last login information, and the last logout time is the last logout information. The last login IP is the IP information of the last login (the IP of the desktop on the ship is allocated in advance, and the IP of the mobile phone logged in through WiFi is allocated by DHCP), if it is a desktop, the IP will not change, if it is a mobile phone, the IP may change. The login MAC address is the MAC address of the last login, and the last login geographic location is the geographic location corresponding to the login IP, the IP and the geographic location are one-to-one. The current online status is to confirm whether the application is online on the application 1. The token update time refers to the deadline for the application to update the token (token), the update of the token is requested based on the MAC, which will be described in detail below.

[0121] Step 3 is illustrated by example: if user A has logged in application 1 and application 2, the content of the session can include: {[application 1 ID, 2022-10-23 18:00:34, 2022-10-23 19:21:04, 192.168.10.126, 81:03:C7:39:11:6B, No. 1 deck monitoring desktop ThinkVersion EP270, No, 2022-10-25 16:21:04], [application 2 ID, 2022-10-23 16:00:34, 2022-10-23 12:21:04, 192.168.10.121, 12:58:E2:DB:70:B1, No. 1 deck WiFi access point, No, 2022-10-25 16:21:04]}.

[0122] The token update time of application 1 is 2022-10-25 16:21:04, that is, if the login application 1 exceeds this time, the token renewal work needs to be done on the shore login server. If the user frequently logs in, the token will be automatically renewed when the remaining time is 1 day. That is, the token of the frequently logged-in user is automatically renewed, and there is no need to frequently request the shore server login verification.

[0123] Step 4: The login server on the ship checks the login status of other applications. After obtaining the session information of the user, the login server on the ship checks the login status of the application. According to the data security requirements, the application can only be logged in to one system at the same time (for example, if the application OA is online, if the laboratory system is logged in, the OA system will automatically log out). Here, checking whether other applications are online can be achieved by checking whether the current application is online. At the same time, it will also check whether the user's MAC address is a registered MAC address. A batch of MAC addresses will be registered in advance on the ship, and only registered MAC addresses are allowed to log in to the system.

[0124] Step 5: The login server on the ship logs out other applications. If multiple applications are found to be online, the login server on the ship will actively log out other applications and modify the session data state of the application. For example, if the user is online in application 2, and actively requests to log in to application 1, application 2 will be notified to exit the current user state, and the session information of application 2, such as the last logout time, whether it is currently online, etc., will be modified and updated in the database.

[0125] Step 6: Application 1 login session is not expired, allowing login. After processing the logout of other applications, the next step is for the login server on the ship to confirm whether the user can log in based on the current application's session information. The main check is whether the current time exceeds the token update time. If it exceeds, it means the session has expired, otherwise it is within the valid period. In the case of being within the valid period, the session information will be updated, mainly the last login time, the last logout time, the last login IP, the login MAC address, the last login geographic location, whether it is currently online, etc., and then try to update the token time. For example, assuming that the token update time of application 1 is 2022-10-25 16:21:04, and the current time is 2022-10-24 08:13:11, which means it is not expired at this time, then update the last login time, the last logout time, etc. of application 1, and the token update time - current time > 1 day, so this login will not renew the token. If the current time is 2022-10-24 18:13:11, then the token update time - current time < 1 day, at this time the token will be renewed, and the default renewal period is one day, that is, the token update time is renewed from 2022-10-25 16:21:04 to 2022-10-26 16:21:04. It should be noted that token renewal does not need to notify the shore server, which is a process optimization to improve user login efficiency.

[0126] Step 7: Application 1 login success. After the user's session check success (single sign-on, token check, etc.), at this time the application 1 can be normal login.

[0127] Step 8: Application 1 login session expired, request update. If the session expired, it means that the user's behavior is the first time to login or login for a long time, at this time it is necessary to update the token. Because the marine geological vessel may be at sea operations, at this time the session update needs to rely on satellite. In addition, the key update process mentioned earlier, the login server on the ship saves the public key corresponding to the application ID. The request update package contains the following information: application ID, user UID, user's MAC address, user's IP address, random number, token update time, digital signature. Random number is randomly generated based on time, and digital signature is md5sum (application ID + user UID + user's MAC address + random number + token update time). These information will be encrypted using the allocated asymmetric encryption public key, and sent to the shore-based login server through the satellite.

[0128] Step 9: Update the session information of application 1. After the shore-based login server receives the information, it will use the asymmetric encryption private key to decrypt, and if the decryption fails, it will refuse to update the session information. After successful decryption, the shore-based server will recalculate the digital signature, array signature = md5sum (application ID + user UID + user's MAC address + random number + token update time), if the calculated digital signature and the transmitted digital signature are inconsistent, the session information will be refused to update. If consistent, it proves that the application ID and user UID need to update the session.

[0129] Step 10: Check the login status of other applications on the shore. After the shore-based login server obtains the user's session information, it will check the login status of the application. Because according to the data security requirements, the application can only log in to one system at the same time (for example, if the application OA is online, if the laboratory system is logged in, the OA system will automatically offline). Here to check whether online is achieved by checking whether currently online. At the same time, it will also check whether the user's MAC address is a registered MAC address. A batch of MAC addresses will be registered in advance on the ship, and only the registered MAC address is allowed to log in to the system.

[0130] Step 11: Log out other applications. If multiple applications are found to be online, the login server on the shore initiatively logs out other applications and modifies the session data state of the application. For example, if the user is online in application 2 and initiatively requests to log in application 1, application 2 is notified to log out the current user state, and the session data of application 2, such as the last logout time, whether online or not, and the like, are modified and updated in the database.

[0131] Step 12: Reply to update the session information of application 1. The shore server calculates the latest token update time based on the current time, and generally, the token update time = current time + N days, where N is generally 2 and can be configured. Then, a random number is regenerated, and a digital signature is calculated, where the digital signature = md5sum (application ID + user UID + user MAC address + random number + token update time), and then sent to the login server on the ship through the satellite server.

[0132] Step 13: Update the session information of application 1. After receiving the information, the login server on the ship decrypts using the public key of asymmetric encryption, and if the decryption fails, the user login is rejected. If the decryption is successful, the ship server recalculates the digital signature, where the digital signature = md5sum (application ID + user UID + user MAC address + random number + token update time), and if the calculated digital signature is inconsistent with the transmitted digital signature, the login is rejected. If consistent, the session is directly updated.

[0133] Step 14: Application 1 login session is not expired, and the login is allowed. After the session is successfully updated, application 1 is directly notified to allow the user to log in.

[0134] Step 15: Application 1 login is successful. After the user's session check is successful (single sign-on, token check, and the like), application 1 can be normally logged in.

[0135] Referring to Figure 8 The embodiment of the present application provides a single sign-on system, comprising a user terminal, a first server and a second server.

[0136] The user terminal, the first server and the second server are used to execute the single sign-on method.

[0137] Referring to Figure 9 The embodiment of the present application provides another single sign-on system, and further, the system further comprises a third server.

[0138] The user terminal is further configured to request the first server to update the public key of the asymmetric encryption, and request the second server to update the private key of the asymmetric encryption.

[0139] The first server is further configured to request the third server to update the public key of the asymmetric encryption, save the newly generated public key, and return a message to the user terminal that the public key has been updated.

[0140] The second server is further configured to request the third server to update the private key of the asymmetric encryption, save the newly generated private key, and return a message to the user terminal that the private key has been updated.

[0141] The third server is configured to generate the public key and the private key of the asymmetric encryption according to the application identifier in the login information to be encrypted, return the newly generated public key to the first server, and return the newly generated private key to the second server.

[0142] The specific implementation of the single sign-on system is basically the same as the specific embodiments of the single sign-on method described above, and will not be repeated here.

[0143] The embodiments of the present application also provide an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor implements the single sign-on method when executing the computer program. Specifically, the electronic device can be a user terminal or a server. The embodiments of the present application take the computer device as an example, and the specific implementation is as follows:

[0144] As shown in FIG. 10, Figure 10 The computer device 1000 can include RF (Radio Frequency) circuit 1010, memory 1020 including one or more computer readable storage media, input unit 1030, display unit 1040, sensor 1050, audio circuit 1060, short distance wireless transmission module 1070, processor 1080 including one or more processing cores, and power supply 1090, etc. Those skilled in the art can understand that the device structure shown in FIG. 10 does not constitute a limitation on the electronic device, and can include more or less components than the figure, or combine certain components, or different component arrangements. Figure 10 The device structure shown in FIG. 10 does not constitute a limitation on the electronic device, and can include more or less components than the figure, or combine certain components, or different component arrangements.

[0145] The RF circuit 1010 can be used for transmitting and receiving signals in information or communication processes. In particular, the RF circuit 1010 receives downlink information from a base station and delivers the information to the one or more processors 1080 for processing. In addition, the RF circuit 1010 transmits uplink data to the base station. Generally, the RF circuit 1010 includes, but is not limited to, an antenna, at least one amplifier, a tuner, one or more oscillators, a user identity module (SIM) card, a transceiver, a coupler, a low noise amplifier (LNA), a duplexer, etc. In addition, the RF circuit 1010 can communicate with the network and other devices through wireless communication. The wireless communication can use any communication standard or protocol, including but not limited to GSM (Global System for Mobile communication), GPRS (General Packet Radio Service), CDMA (Code Division Multiple Access), WCDMA (Wideband Code Division Multiple Access), LTE (Long Term Evolution), Bluetooth, WLAN (Wireless Local Area Network), Wi-Fi, Zigbee, NFC (Near Field Communication), etc.

[0146] The memory 1020 can be used to store software programs and modules. The processor 1080 performs various functions and data processing by running the software programs and modules stored in the memory 1020. The memory 1020 can mainly include a program storage area and a data storage area. The program storage area can store operating systems, application programs required for at least one function (such as a sound play function, an image play function, etc.), etc. The data storage area can store data created according to the use of the device 1000 (such as audio data, a phone book, etc.), etc. In addition, the memory 1020 can include a high-speed random access memory, and can further include a non-volatile memory such as at least one disk storage device, a flash memory device, or other volatile solid state memory device. Accordingly, the memory 1020 can further include a memory controller to provide access to the memory 1020 for the processor 1080 and the input unit 1030. Although Figure 10 Although the RF circuit 1010 is shown, it can be understood that it does not necessarily constitute the device 1000, and can be omitted as needed without changing the essence of the application.

[0147] The input unit 1030 can be used to receive input digital or character information, and generate keyboard, mouse, joystick, optical or trackball signal input related to user settings and function control. Specifically, the input unit 1030 can include a touch-sensitive surface 1031 and other input devices 1032. The touch-sensitive surface 1031, also known as a touch display screen or touchpad, can collect user touch operations (such as user operations using fingers, styluses, etc. on or near the touch-sensitive surface 1031) on or near it, and drive the corresponding connection device according to the pre-set program. Optionally, the touch-sensitive surface 1031 can include two parts of touch detection device and touch controller. Among them, the touch detection device detects the touch position of the user and detects the signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, and converts it into touch coordinates and sends it to the processor 1080, and can receive the command from the processor 1080 and execute it. In addition, the touch-sensitive surface 1031 can be implemented in various types such as resistive, capacitive, infrared and surface acoustic wave. In addition to the touch-sensitive surface 1031, the input unit 1030 can also include other input devices 1032. Specifically, the other input devices 1032 can include one or more of a physical keyboard, function keys (such as volume control buttons, on-off buttons, etc.), trackballs, mice, joysticks, etc.

[0148] The display unit 1040 can be used to display information input by the user or information provided to the user and various graphical user interfaces of the control 1000, which can be composed of graphics, text, icons, video and any combination thereof. The display unit 1040 can include a display panel 1041, which can be configured in the form of an LCD (Liquid Crystal Display), an OLED (Organic Light-Emitting Diode), etc. Further, the touch-sensitive surface 1031 can be overlaid on the display panel 1041, and when the touch-sensitive surface 1031 detects a touch operation on or near it, it is transmitted to the processor 1080 to determine the type of touch event, and then the processor 1080 provides corresponding visual output on the display panel 1041 according to the type of touch event. Although in the Figure 10 In some embodiments, the touch-sensitive surface 1031 and the display panel 1041 can be integrated to realize input and output functions.

[0149] The computer device 1000 can further include at least one sensor 1050, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor can include an ambient light sensor and a proximity sensor, where the ambient light sensor can adjust the brightness of the display panel 1041 according to the brightness of ambient light, and the proximity sensor can turn off the display panel 1041 and / or the backlight when the device 1000 is moved to the ear. As one of the motion sensors, the gravity acceleration sensor can detect the magnitude of acceleration in each direction (generally three axes), and when at rest, the gravity acceleration sensor can detect the magnitude and direction of gravity, which can be used for identifying the application of the mobile phone posture (such as the switching of the horizontal and vertical screens, the related games, the magnetometer posture calibration), the vibration identification related function (such as the pedometer, the knock), and the like. As for the gyroscope, the barometer, the hygrometer, the thermometer, the infrared sensor, and other sensors that can also be configured to the device 1000, they will not be described here.

[0150] The audio circuit 1060, the speaker 1061, and the microphone 1062 can provide an audio interface between the user and the device 1000. The audio circuit 1060 can convert the received audio data into an electrical signal, transmit the electrical signal to the speaker 1061, and convert the electrical signal into a sound signal output by the speaker 1061. On the other hand, the microphone 1062 converts the collected sound signal into an electrical signal, which is received by the audio circuit 1060 and converted into audio data. The audio data is output to the processor 1080 for processing, and then transmitted to another control device via the RF circuit 1010, or output to the memory 1020 for further processing. The audio circuit 1060 can also include a jack for providing communication between an external earphone and the device 1000.

[0151] The short-distance wireless transmission module 1070 can be a WIFI (wireless fidelity) module, a Bluetooth module, or an infrared module, etc. The device 1000 can transmit information with the wireless transmission module provided on the opponent device through the short-distance wireless transmission module 1070.

[0152] The processor 1080 is the control center of the device 1000, which connects each part of the control device through various interfaces and lines, executes various functions of the device 1000 and processes data by running or executing the software programs and / or modules stored in the memory 1020, and calling the data stored in the memory 1020, thereby monitoring the control device as a whole. Optionally, the processor 1080 can include one or more processing cores; optionally, the processor 1080 can integrate an application processor and a modem processor, where the application processor mainly processes the operating system, the user interface, and the application program, and the modem processor mainly processes wireless communication. It can be understood that the above-mentioned modem processor can also not be integrated into the processor 1050.

[0153] The device 1000 also includes a power supply 1090, such as a battery, for powering various components of the device 1000. Preferably, the power supply 1090 is configured to deliver power to the processor 1080 via the power management system. Additionally or alternatively, the power supply 1090 can be configured to deliver power to the processor 1080 via a power management system other than the power management system. The power supply 1090 can also be configured to receive power from an external source, such as an AC adapter or DC power supply, via an input power port. The power supply 1090 can also include one or more DC or AC power sources, recharging systems, power failure detection circuitry, power conversion or inverter circuitry, power status indicators, and any other components associated with the generation, management, and distribution of power in support of the other components of the device 1000.

[0154] Although not shown, the device 1000 can also include a camera, a Bluetooth module, and the like, which are not described herein. The embodiments of the present application also provide a computer readable storage medium, which stores a computer program. The computer program is executed by a processor to implement the single sign-on method.

[0155] The embodiments of the present application also provide a computer readable storage medium, which stores a computer program. The computer program is executed by a processor to implement the single sign-on method.

[0156] The memory, as a non-transitory computer readable storage medium, can be used to store non-transitory software programs and non-transitory computer executable programs. In addition, the memory can include a high-speed random access memory, and can also include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state memory device. In some embodiments, the memory can optionally include a memory disposed remotely from the processor, and these remote memories can be connected to the processor through a network. Examples of the network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0157] The embodiments of the present application also disclose a computer program product or a computer program, which includes computer instructions stored in a computer readable storage medium. The processor of the electronic device can read the computer instructions from the computer readable storage medium, and the processor executes the computer instructions to enable the electronic device to perform the method shown in the embodiments of the present application. Figure 2 The embodiments of the present application also disclose a computer program product or a computer program, which includes computer instructions stored in a computer readable storage medium. The processor of the electronic device can read the computer instructions from the computer readable storage medium, and the processor executes the computer instructions to enable the electronic device to perform the method shown in the embodiments of the present application.

[0158] In some alternative embodiments, the function / operations described in the block diagrams can not occur in the order described in the operational illustrations. For example, two blocks shown in succession can in fact be executed substantially concurrently or the blocks can sometimes be executed in the reverse order, depending upon the functionality / operations involved. Also, although the embodiments presented in the flow diagrams are shown as a sequence of operations, it is to be understood that the logical flow is merely illustrative of alternative embodiments. The disclosed methods are not limited to the order of operations presented herein. Alternative embodiments can be contemplated where the order of operations is changed, and where sub operations described as part of a larger operation are executed in a different order, or are executed concurrently.

[0159] Further, although the present application has been described in the context of functional modules, it is to be understood that one or more of the functions and / or features described can be integrated in a single physical device and / or software module, or one or more functions and / or features can be implemented in separate physical devices or software modules. It will also be appreciated that detailed discussion of the actual implementation of each module is not necessary to an understanding of the present application. Rather, the actual implementation of the modules, in light of the attributes, functions, and internal relationships of the various functional modules disclosed herein, will be apparent to one of ordinary skill in the art, given the benefit of this disclosure. Accordingly, the present application is not limited to the specific embodiments illustrated herein, but is capable of being practiced with variations other than those specifically described. It is also noted that the specific conceptual aspects disclosed are merely illustrative and not intended to limit the scope of the present application, which is defined by the appended claims and their equivalents.

[0160] If the functions are implemented in software function units and sold or used as independent products, they can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product, and the computer software product is stored in a storage medium, and includes several instructions for making an electronic device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various program code storage media.

[0161] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0162] More specific examples of computer-readable media (a non-exhaustive list) include: electrical connections (electronic devices) having one or more wires, portable computer disk drives (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which the program can be printed, because the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory.

[0163] It should be understood that various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0164] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0165] Although the embodiments of the present application have been shown and described, it will be appreciated by those skilled in the art that changes, modifications, alternatives and variations to these embodiments can be made without departing from the principles and spirit of the application, the scope of which is defined by the claims and their equivalents.

[0166] The above is a specific description of the preferred embodiments of the present application, but the present application is not limited to the described embodiments, and those skilled in the art can make various equivalent modifications or replacements without departing from the spirit of the present application, and these equivalent modifications or replacements are all included in the scope defined by the claims of the present application.

Claims

1. A single sign-on method, characterized in that, include: The system obtains login information through a user terminal and initiates a login session for a target application on a first server based on the login information; wherein, the login information includes a user account; The first server checks whether the user account's login session for the target application has expired; If the account has not expired, the first server checks whether the user account is already logged into the first application on the first server. If so, the first server logs the user account out of the first application and then sends a login permission message to the user terminal. The user terminal then logs into the target application after receiving the login permission message. If the user account is not logged into the first application on the first server, the first server sends a login permission message to the user terminal. The user terminal then logs into the target application after receiving the login permission message. If the login session has expired, the first server requests an update from the second server to the second server. The second server updates the login session and checks whether the user account is already logged into the second application on the second server. If so, the second server logs the user account out of the second application, and then the second server returns an updated login session to the first server. The first server receives the updated login session, updates it, and then returns a login permission message to the user terminal. After receiving the login permission message, the user terminal logs into the target application. If the user is not logged into the second application on the second server, the second server returns an updated login session to the first server, the first server receives the updated login session, updates it, and then returns a login permission message to the user terminal. After receiving the login permission message, the user terminal logs into the target application.

2. The single sign-on method according to claim 1, characterized in that, Before obtaining login information through the user terminal, the method further includes: The user terminal requests an update to the public and private keys for asymmetric encryption.

3. The single sign-on method according to claim 2, characterized in that, The step of requesting an update to the public and private keys of asymmetric encryption via the user terminal includes: The user terminal requests an update to the public key of asymmetric encryption from the first server, and then the first server requests an update to the public key of asymmetric encryption from the third server. The user terminal requests an update to the private key for asymmetric encryption from the second server, and then the second server requests an update to the private key for asymmetric encryption from the third server. The third server generates the corresponding asymmetric encryption public and private keys based on the application identifier in the requested encrypted login information. The newly generated public key is returned to the first server by the third server, the first server saves the newly generated public key, and returns a message that the public key has been updated to the user terminal. The newly generated private key is returned to the second server by the third server, the second server saves the newly generated private key, and returns a message that the private key has been updated to the user terminal.

4. The single sign-on method according to claim 3, characterized in that, The step of requesting an update to the asymmetric encryption public key from the third server via the first server includes: requesting an update to the asymmetric encryption public key from the third server via the TCP protocol within a local area network through the first server. The step of requesting an update to the asymmetric encryption private key from the third server via the second server includes: requesting an update to the asymmetric encryption private key from the third server via the TCP protocol within the local area network through the second server. The step of returning the newly generated public key to the first server through the third server includes: returning the newly generated public key to the first server through the third server within the local area network via the TCP protocol; The step of returning the newly generated private key to the second server through the third server includes: returning the newly generated private key to the second server through the third server within the local area network via the TCP protocol.

5. A single sign-on method according to claim 1, characterized in that, The step of checking whether the user account's login session for the target application has expired via the first server includes: The first server checks whether the current time exceeds the token update deadline for the user account. If so, it determines that the user account's login session for the target application has expired; if not, it determines that the user account's login session for the target application has not expired.

6. A single sign-on method according to claim 5, characterized in that, The method further includes: If the number of times the user terminal logs into the target application within a set time period reaches a preset threshold, the first server extends the token update deadline before the token update deadline.

7. A single sign-on method according to claim 1, characterized in that, The step of requesting an update to the login session from the second server via the first server includes: sending a request message to a satellite via the first server; receiving the request message via the satellite and forwarding the request message to the second server; and updating the login session via the second server. The step of returning the updated login session to the first server through the second server includes: returning the updated login session to the satellite through the second server; receiving the updated login session through the satellite and returning the updated login session to the first server.

8. A single sign-on system, characterized in that, include: User terminal, first server, and second server; The user terminal, the first server, and the second server are used to execute a single sign-on method as described in any one of claims 1 to 7.

9. A single sign-on system according to claim 8, characterized in that, The system also includes a third server; The user terminal is also used to request the first server to update the public key of asymmetric encryption; and to request the second server to update the private key of asymmetric encryption. The first server is also configured to request the third server to update the public key for asymmetric encryption; Save the newly generated public key and return a message that the public key has been updated to the user terminal; The second server is also configured to request an update to the asymmetric encryption private key from the third server; save the newly generated private key; and return a message to the user terminal that the private key has been updated. The third server is used to generate a corresponding asymmetric encryption public key and private key based on the application identifier in the login information requested for encryption; and return the newly generated public key to the first server. The newly generated private key is returned to the second server.

10. An electronic device, characterized in that, Including the processor and memory; The memory is used to store programs; The processor executes the program to implement a single sign-on method as described in any one of claims 1 to 7.

Images