Cross-application login, authentication and information synchronization method and system

Abstract

The invention provides a cross-application login, authentication and information synchronization method and system. The method comprises the following steps: synchronizing user information to a plurality of target applications at regular time by utilizing a timer; setting a unified authentication interface and sharing the authentication information of the user to provide a single sign-on function; and providing a password-free login function through an encryption algorithm based on the authentication information of the user. According to the method, multiple authentication protocols can be integrated, unified management and login functions are realized, and an information synchronization mode is provided, so that information leakage and hostile attack are avoided, and convenience and security are improved.

Description

Technical Field

[0001] The present application relates to the technical field of information security and network authentication, and in particular to a method and system for cross-application login, authentication, and information synchronization. Background Art

[0002] As enterprises continue to digitally transform, more and more organizations are adopting hybrid cloud architectures, combining traditional on-premises systems with cloud services. In modern enterprise and internet environments, users need to access multiple independent application systems, each of which may use different authentication mechanisms, such as CAS, OAuth, or LDAP.

[0003] Existing operational technologies mainly rely on authentication systems based on a single authentication protocol (such as CAS, OAuth, or LDAP), and implement access management for local or cloud applications by manually configuring user credentials and permissions. In a hybrid cloud environment, administrators usually use independently deployed identity management servers to handle authentication requests from different systems separately. However, multiple authentication protocols cannot achieve unified authentication across systems, resulting in users having to log in repeatedly between different systems. For example, after using a CAS-based system, users still need to re-authenticate when accessing an OAuth-based application, resulting in cumbersome and inefficient operations. Traditional synchronization methods often use timed batch processing, which cannot reflect changes in user status in real time and may cause confusion in permission management. The existing methods lack a unified authentication framework, resulting in complex cross-system authentication processes, cumbersome configuration, and difficult to guarantee security, making it difficult to meet the needs of modern enterprises for efficient and secure access.

[0004] Therefore, real-time cross-application login, authentication, and information synchronization have become urgent issues to be addressed.

[0005] Patent CN105187401A discloses a method for unified login across multiple systems, including: verifying the target user's login identity information in the current system; when the target user's login identity information is verified, determining whether the target user has permissions to multiple systems; if the target user does not have permissions to multiple systems, logging into the current system; if the target user has permissions to multiple systems, synchronizing the target user's login identity information to the multiple systems and logging into one of the multiple systems. This method only verifies the user's login identity information based on the current system and cannot dynamically adapt to the complex requirements of multiple authentication protocols, nor can it provide advanced functions to improve user experience and security management efficiency.

[0006] Based on this, the present application provides a cross-application login, authentication and information synchronization method and system to improve the existing technology. Summary of the Invention

[0007] The purpose of this application is to provide a cross-application login, authentication and information synchronization method and system, which can integrate multiple authentication protocols, realize unified management and login functions, and provide an information synchronization method to avoid information leakage and malicious attacks, thereby improving convenience and security.

[0008] The purpose of this application is achieved by the following technical solutions:

[0009] In a first aspect, the present application provides a cross-application login, authentication, and information synchronization method for predicting and regulating container service load, the method comprising:

[0010] Use timers to synchronize user information to multiple target applications;

[0011] Set up a unified authentication interface and share user authentication information to provide single sign-on functionality;

[0012] Based on the user's authentication information, an encryption algorithm is used to provide a password-free login function.

[0013] The beneficial effects of this technical solution are: setting up a unified authentication interface and sharing the user's authentication information, providing a single sign-on function, simplifying the user's login process between multiple applications, and significantly improving user experience and operational efficiency. Based on the user's authentication information, a password-free login function is provided through an encryption algorithm, which further reduces the trouble of users repeatedly entering credentials and enhances the convenience and security of login. This method achieves seamless cross-application authentication by integrating the comprehensive process of user information synchronization, unified authentication, and password-free login, reduces management complexity, and provides an efficient solution for identity management in the enterprise hybrid cloud environment. Overall, this method optimizes resource allocation and enhances the collaboration ability between systems through automated and integrated design, promoting the stable operation of multiple application systems in digital transformation. This method can integrate multiple authentication protocols, achieve unified management and login functions, and provide an information synchronization method to avoid information leakage and malicious attacks, thereby improving convenience and security.

[0014] In some optional implementations, the scheduled synchronization includes database synchronization, Excel synchronization, or LDAP polling synchronization;

[0015] Among them, the database synchronously uses JDBC to batch process user information and submit it to the target application;

[0016] Excel automatically parses user information and maps it to the target application;

[0017] LDAP polling synchronization periodically queries the LDAP directory to obtain user information and synchronizes it to the target application.

[0018] The beneficial effects of this technical solution are: by introducing multiple methods such as database synchronization, Excel synchronization or LDAP polling synchronization for scheduled synchronization, the flexibility and applicability of user information synchronization are significantly improved. Database synchronization uses JDBC batch processing technology to efficiently submit user information to the target application, reducing data transmission delays and resource consumption, and ensuring the efficiency of synchronization. Excel synchronization simplifies the data import process, reduces the workload of manual configuration, and improves the accuracy of data processing by automatically parsing user information and mapping it to the target application. LDAP polling synchronization regularly queries the LDAP directory to obtain user information and synchronizes it to the target application, ensuring data consistency in a distributed environment. This multi-channel synchronization strategy can adapt to different data sources and network conditions, enhancing the compatibility and robustness of the system. By integrating these synchronization methods, this method effectively reduces the synchronization difficulties caused by the diversity of data sources, provides a reliable data foundation for cross-application authentication, and thus improves the stability of the overall system and user access efficiency.

[0019] In some optional implementations, the LDAP polling synchronization adopts an intelligent throttling mechanism to dynamically adjust the synchronization frequency according to network conditions.

[0020] The beneficial effects of this technical solution are: using an intelligent throttling mechanism in LDAP polling synchronization, dynamically adjusting the synchronization frequency according to network conditions, significantly improving the stability and performance of the system in complex network environments. The intelligent throttling mechanism can perceive network load and latency in real time, and automatically reduce the synchronization frequency under high traffic or unstable network conditions to prevent server pressure or data loss caused by frequent queries, thereby ensuring the reliability of the synchronization process. This dynamic adjustment strategy effectively balances the timeliness of data updates with system resource utilization, reduces unnecessary network overhead, and performs particularly well in multi-node clusters or hybrid cloud environments. In addition, by optimizing the synchronization rhythm, the mechanism reduces the risk of synchronization interruptions caused by network fluctuations, providing a stronger guarantee for the real-time nature of user information. Ultimately, this method enhances the adaptability of LDAP synchronization, lays a solid foundation for the continuous operation of cross-application authentication, and improves the overall efficiency of the system and user experience.

[0021] In some optional implementations, setting a unified authentication interface and sharing user authentication information to provide a single sign-on function includes:

[0022] A unified authentication interface is set up using the RESTful design style. The unified authentication interface supports three authentication protocols: CAS, OAuth, and LDAP.

[0023] Receiving the user's authentication selection and authentication information using a receiving device;

[0024] Based on the user's authentication selection, the unified authentication interface automatically selects the corresponding authentication mechanism;

[0025] After successful authentication, a JWT token corresponding to the authentication information is generated and shared with multiple target applications to provide a single sign-on function. The single sign-on function ensures that the user only needs to log in once to access multiple target applications.

[0026] The beneficial effects of this technical solution are: by adopting the RESTful design style to set up a unified authentication interface, supporting three authentication protocols: CAS, OAuth and LDAP, the compatibility and scalability of the system are significantly enhanced. The unified authentication interface uses a receiving device to receive the user's authentication selection and authentication information, and automatically calls the corresponding authentication mechanism according to the user's selection, which simplifies the authentication process in a multi-protocol environment and improves operational flexibility. After successful authentication, a JWT token is generated and shared with multiple target applications to implement a single sign-on function, ensuring that users only need to log in once to access all related applications, greatly improving the user experience and reducing the complexity of repeated authentication. The stateless nature and standard interface specifications of the RESTful design also facilitate system integration and maintenance, reducing development costs. Overall, this method optimizes the efficiency of cross-system identity management through a unified authentication interface and single sign-on mechanism, enhances system interoperability, and provides an efficient and secure solution for application access in a hybrid cloud environment.

[0027] In some optional implementations, providing a password-free login function based on user authentication information through an encryption algorithm includes:

[0028] Check whether the user has registered the target application;

[0029] If the user has already registered the target app, no action is taken;

[0030] If the user has not registered the target application, the user registration is automatically completed through the authentication protocol;

[0031] Obtain the timestamp string corresponding to the preset time period and combine it with the user's authentication information to form time period authentication data;

[0032] The time period authentication data is encrypted using the AES-128-ECB encryption algorithm to generate an encrypted authentication credential, which is used for password-free login during a preset time period.

[0033] The beneficial effect of this technical solution is that it significantly improves the convenience and security of user login by providing a password-free login function based on the user's authentication information using an encryption algorithm. The method detects the user's registration status and automatically completes the registration through the authentication protocol if the user is not registered, thereby reducing the tedious steps of manual registration, and generates password-free login credentials through an encryption algorithm, simplifying the subsequent access process. The timestamp corresponding to the preset time period is obtained and combined with the user information, and the encrypted authentication credential is generated using the AES-128-ECB encryption algorithm to ensure the uniqueness and security of the credential within the valid time period and prevent unauthorized access. This dynamic timestamp combined with encryption strategy effectively reduces the risk of credential replay attacks, while eliminating the need for users to repeatedly enter passwords and optimizing the user experience. Overall, the method enhances the efficiency and security of identity management through automated registration and encrypted password-free login, providing a seamless solution for cross-application access.

[0034] In some optional embodiments, the method further comprises:

[0035] Checking whether the timestamp is within a preset time period;

[0036] If the timestamp is not within the preset time period, a time expiration error code is returned;

[0037] If the timestamp is within the preset time period, then use the checkUserDisable() function to check whether the user status is disabled;

[0038] If the user status is disabled, a status error code is returned;

[0039] If the user status is not disabled, do nothing.

[0040] The beneficial effect of this technical solution is that by checking whether the timestamp is within the preset time period and combining it with the user status check, the security and reliability of password-free login are significantly enhanced. The timestamp verification mechanism ensures that the encrypted authentication credentials are only valid within the validity period. If it exceeds the preset time period, a time expiration error code is returned, which effectively prevents the abuse of expired credentials and ensures system security. If the timestamp is valid, the checkUserDisable() function is further used to check whether the user status is disabled. If it is disabled, a status error code is returned, avoiding illegal access to disabled accounts, thereby improving the rigor of identity management. If the user status is normal, no additional operations are performed to maintain the smoothness of the process. This multi-level verification process reduces the risk of security vulnerabilities by combining time and status checks, ensuring the legitimacy and stability of password-free login. Ultimately, this method provides a more secure and controllable access mechanism for cross-application authentication, optimizes the user experience and enhances the overall security protection capabilities of the system.

[0041] In a second aspect, the present application provides a cross-application login, authentication, and information synchronization device, the device comprising a processor configured to implement the following steps:

[0042] An information synchronization module is used to synchronize user information to multiple target applications using a timer;

[0043] Single sign-on module, used to set up a unified authentication interface and share user authentication information to provide single sign-on functionality;

[0044] The password-free login module is used to provide password-free login function based on user authentication information through encryption algorithm.

[0045] In some optional implementations, the scheduled synchronization includes database synchronization, Excel synchronization, or LDAP polling synchronization;

[0046] Among them, the database synchronously uses JDBC to batch process user information and submit it to the target application;

[0047] Excel automatically parses user information and maps it to the target application;

[0048] LDAP polling synchronization periodically queries the LDAP directory to obtain user information and synchronizes it to the target application.

[0049] In some optional implementations, the LDAP polling synchronization adopts an intelligent throttling mechanism to dynamically adjust the synchronization frequency according to network conditions.

[0050] In some optional embodiments, the processor is configured to set up a unified authentication interface and share user authentication information to provide a single sign-on function in the following manner:

[0051] A unified authentication interface is set up using the RESTful design style. The unified authentication interface supports three authentication protocols: CAS, OAuth, and LDAP.

[0052] Receiving the user's authentication selection and authentication information using a receiving device;

[0053] Based on the user's authentication selection, the unified authentication interface automatically selects the corresponding authentication mechanism;

[0054] After successful authentication, a JWT token corresponding to the authentication information is generated and shared with multiple target applications to provide a single sign-on function. The single sign-on function ensures that the user only needs to log in once to access multiple target applications.

[0055] In some optional embodiments, the processor is configured to provide a password-free login function based on the user's authentication information through an encryption algorithm in the following manner:

[0056] Check whether the user has registered the target application;

[0057] If the user has already registered the target app, no action is taken;

[0058] If the user has not registered the target application, the user registration is automatically completed through the authentication protocol;

[0059] Obtain the timestamp string corresponding to the preset time period and combine it with the user's authentication information to form time period authentication data;

[0060] The time period authentication data is encrypted using the AES-128-ECB encryption algorithm to generate an encrypted authentication credential, which is used for password-free login during a preset time period.

[0061] In some optional implementations, the processor is further configured to:

[0062] Checking whether the timestamp is within a preset time period;

[0063] If the timestamp is not within the preset time period, a time expiration error code is returned;

[0064] If the timestamp is within the preset time period, then use the checkUserDisable() function to check whether the user status is disabled;

[0065] If the user status is disabled, a status error code is returned;

[0066] If the user status is not disabled, do nothing.

[0067] In a third aspect, the present application provides an electronic device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of any of the above methods when executing the computer program.

[0068] In a fourth aspect, the present application provides a cross-application login, authentication, and information synchronization system, the system comprising:

[0069] The above electronic equipment.

[0070] In a fifth aspect, the present application provides a chip, wherein the chip stores a computer program, and when the computer program is executed by a processor, the steps of any of the above methods are implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] The present application is further described below with reference to the accompanying drawings and implementation methods.

[0072] Figure 1A schematic diagram of a process of cross-application login, authentication and information synchronization provided by an embodiment of the present application is shown.

[0073] Figure 2 A flow chart of a single sign-on method provided in an embodiment of the present application is shown.

[0074] Figure 3 Shows a flowchart of a method for password-free login provided in an embodiment of the present application.

[0075] Figure 4 A structural block diagram of a cross-application login, authentication and information synchronization device provided in an embodiment of the present application is shown.

[0076] Figure 5 A structural framework diagram of an electronic device provided in an embodiment of the present application is shown.

[0077] Figure 6 A schematic structural diagram of a cross-application login, authentication, and information synchronization system provided in an embodiment of the present application is shown.

[0078] Figure 7 A schematic diagram of the structure of a program product provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0079] Below, the embodiments of the present application are further described in conjunction with the accompanying drawings and specific implementation methods. It should be noted that, under the premise of no conflict, the various embodiments or technical features described below can be arbitrarily combined to form a new implementation method.

[0080] In the embodiments of the present application, "at least one" refers to one or more, and "more" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: the existence of A alone, the existence of A and B at the same time, and the existence of B alone, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can represent: a, b, c, a and b, a and c, b and c, a and b and c, where a, b and c can be single or multiple. It is worth noting that "at least one" can also be interpreted as "one or more items".

[0081] It should also be noted that in the embodiments of this application, words such as "exemplary" or "for example" are used to indicate examples, illustrations, or descriptions. Any implementation or design scheme described as "exemplary" or "for example" in the embodiments of this application should not be interpreted as being preferred or advantageous over other implementations or designs. Rather, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0082] Method Example

[0083] See also Figure 1 , Figure 1 A schematic diagram of a process of cross-application login, authentication and information synchronization provided by an embodiment of the present application is shown.

[0084] The present application embodiment provides a method for cross-application login, authentication, and information synchronization to predict and regulate container service load, including:

[0085] Step S101: Synchronize user information to multiple target applications using a timer;

[0086] Step S102: Setting up a unified authentication interface and sharing user authentication information to provide a single sign-on function;

[0087] Step S103: Based on the user's authentication information, a password-free login function is provided through an encryption algorithm.

[0088] This unified authentication interface and shared user authentication information provide single sign-on, simplifying the login process across multiple applications and significantly improving user experience and operational efficiency. Password-free login is provided through an encryption algorithm based on user authentication information, further reducing the need for users to repeatedly enter their credentials and enhancing login convenience and security.

[0089] This approach integrates user information synchronization, unified authentication, and password-free login processes, achieving seamless cross-application authentication and reducing management complexity, providing an efficient solution for identity management in enterprise hybrid cloud environments. Overall, through automated and integrated design, this approach optimizes resource allocation, enhances inter-system collaboration, and promotes the stable operation of multiple application systems during digital transformation.

[0090] This method can integrate multiple authentication protocols, achieve unified management and login functions, and provide an information synchronization method to avoid information leakage and malicious attacks, thereby improving convenience and security.

[0091] In some optional embodiments, a timer, i.e., a scheduled task scheduler (e.g., based on Linux cron or Java ScheduledExecutorService), is deployed to control the execution cycle of user information synchronization. The timer is configured to set the synchronization interval, such as triggering once a day at a specific time or at regular intervals. The specific period is predefined based on application requirements. In the Kubernetes cluster, the timer function is encapsulated as a containerized service (e.g., using a separate Pod), and the synchronization policy and target application list are loaded through ConfigMap or environment variables.

[0092] Determine the source of synchronized user information (such as a local database, Excel file, or LDAP server) and the target applications (multiple distributed systems or microservices).

[0093] Create a synchronization task list that includes the target application's API endpoints, authentication credentials, and data mapping rules to ensure that each application receives the appropriate data format.

[0094] When the timer reaches the preset time, the synchronization task automatically starts. The scheduler calls the synchronization module to read the latest data from the user information source. Using an incremental update strategy, by comparing data timestamps or version numbers, only the user information that has changed since the last synchronization is extracted, reducing the amount of data transferred.

[0095] In some optional implementations, the scheduled synchronization includes database synchronization, Excel synchronization, or LDAP polling synchronization;

[0096] Among them, the database synchronously uses JDBC to batch process user information and submit it to the target application;

[0097] Excel automatically parses user information and maps it to the target application;

[0098] LDAP polling synchronization periodically queries the LDAP directory to obtain user information and synchronizes it to the target application.

[0099] Therefore, by introducing various scheduled synchronization methods, such as database synchronization, Excel synchronization, and LDAP polling synchronization, the flexibility and applicability of user information synchronization have been significantly improved. Database synchronization utilizes JDBC batch processing technology to efficiently submit user information to the target application, reducing data transmission delays and resource consumption, and ensuring efficient synchronization.

[0100] Excel synchronization simplifies the data import process, reduces manual configuration workload, and improves data processing accuracy by automatically parsing user information and mapping it to the target application. LDAP polling synchronization periodically queries the LDAP directory to obtain user information and synchronizes it to the target application, ensuring data consistency in a distributed environment. This multi-channel synchronization strategy can adapt to different data sources and network conditions, enhancing system compatibility and robustness. By integrating these synchronization methods, this approach effectively reduces synchronization challenges caused by diverse data sources, provides a reliable data foundation for cross-application authentication, and thus improves overall system stability and user access efficiency.

[0101] In the embodiment of the present application, database synchronization adopts high-performance JDBC batch processing technology, and submits a transaction every 200 records to ensure the efficiency and atomicity of data synchronization. Excel synchronization supports multiple template formats and can automatically parse user information and map it to the target system. LDAP polling synchronization is a mechanism that ensures that the target application is consistent with the user data stored in LDAP by regularly querying the LDAP directory server. Its operation process includes: first, the client uses the LDAP protocol (such as LDAPv3) to establish a secure connection with the LDAP server (such as OpenLDAP or Active Directory) through SSL / TLS encryption, and enters the administrator credentials to complete the binding; then, define the query scope and filtering conditions, such as filtering user objects based on organizational units or using filters (such as `(objectClass=user)`); the polling task is triggered at a preset interval by a timer control, and the client sends a search request to query the latest changes in user attributes (such as `uid`, `givenName`, `mail`). After the server returns the result, the client parses the data, performs incremental updates, and maps it to the target application. If there is a user name conflict, a suffix is ​​added to ensure uniqueness. At the same time, the number of successful entries and the reason for failure (such as connection timeout) are recorded in the log. If an exception occurs, the retry mechanism is triggered. An alarm is issued after the maximum number of retries is set to ensure the stability and efficiency of synchronization.

[0102] In some optional implementations, the LDAP polling synchronization adopts an intelligent throttling mechanism to dynamically adjust the synchronization frequency according to network conditions.

[0103] Therefore, we employ an intelligent throttling mechanism in LDAP polling synchronization, dynamically adjusting the synchronization frequency based on network conditions. This significantly improves system stability and performance in complex network environments. This intelligent throttling mechanism can sense network load and latency in real time, automatically reducing the synchronization frequency under high-traffic or unstable network conditions. This prevents server stress or data loss caused by frequent queries, thereby ensuring the reliability of the synchronization process.

[0104] This dynamic adjustment strategy effectively balances data update timeliness with system resource utilization, reducing unnecessary network overhead and performing particularly well in multi-node clusters or hybrid cloud environments. Furthermore, by optimizing the synchronization cadence, this mechanism reduces the risk of synchronization interruptions caused by network fluctuations, providing stronger guarantees for the real-time availability of user information. Ultimately, this approach enhances the adaptability of LDAP synchronization, lays a solid foundation for the continuous operation of cross-application authentication, and improves overall system efficiency and user experience.

[0105] In some optional implementations, LDAP polling synchronization uses an intelligent throttling mechanism to dynamically adjust the frequency based on network latency or bandwidth, use an exponential backoff algorithm to reduce queries during high load, and combine the `modifyTimestamp` attribute to achieve incremental synchronization.

[0106] In some optional embodiments, the user synchronization task is triggered by a timer, the synchronization period is configurable (such as performing LDAP polling every 10 minutes), or the intelligent throttling mechanism automatically extends the synchronization interval (from 10 minutes to 30 minutes) when the network delay exceeds 500ms, and initiates paging query (200 records per page) when more than 1,000 change records are detected.

[0107] See also Figure 2 , Figure 2 A flow chart of a single sign-on method provided in an embodiment of the present application is shown.

[0108] In some optional implementations, setting a unified authentication interface and sharing user authentication information to provide a single sign-on function includes:

[0109] Step S201: Setting a unified authentication interface using a RESTful design style. The unified authentication interface supports three authentication protocols: CAS, OAuth, and LDAP.

[0110] Step S202: Receive the user's authentication selection and authentication information using a receiving device;

[0111] Step S203: Based on the user's authentication selection, the unified authentication interface automatically selects the corresponding authentication mechanism;

[0112] Step S204: After successful authentication, a JWT token corresponding to the authentication information is generated and shared with multiple target applications to provide a single sign-on function. The single sign-on function ensures that the user only needs to log in once to access multiple target applications.

[0113] Therefore, by adopting a RESTful design style to establish a unified authentication interface, supporting CAS, OAuth, and LDAP authentication protocols, the system's compatibility and scalability are significantly enhanced. This unified authentication interface utilizes a receiving device to receive the user's authentication selection and information, automatically invoking the corresponding authentication mechanism based on the user's selection. This simplifies the authentication process in multi-protocol environments and increases operational flexibility. After successful authentication, a JWT token is generated and shared across multiple target applications, enabling single sign-on (SSO). This ensures that users only need to log in once to access all relevant applications, significantly improving the user experience and reducing the complexity of repeated authentication.

[0114] The stateless nature of RESTful design and its standardized interface specifications also facilitate system integration and maintenance, reducing development costs. Overall, this approach optimizes cross-system identity management efficiency through a unified authentication interface and single sign-on mechanism, enhancing system interoperability and providing an efficient and secure solution for application access in hybrid cloud environments.

[0115] In the embodiment of the present application, CAS (Central Authentication Service) is an open source single sign-on (SSO) protocol that aims to achieve the function of users logging in once and using multiple locations in multiple related application systems through centralized authentication.

[0116] OAuth (Open Authorization) is an authorization framework that allows third-party applications to access protected resources with user authorization without sharing user credentials. Its core is a token mechanism. After user authorization, the OAuth server issues an access token, which the third-party application uses to call resources (such as APIs).

[0117] LDAP (Lightweight Directory Access Protocol) is a lightweight directory access protocol used to access and maintain distributed directory information services, typically storing user, group, and permission data.

[0118] In some optional implementations, a unified multi-system authentication interface is implemented using a RESTful design style, using resource-oriented URIs (e.g., / auth / login) and stateless HTTP methods (e.g., POST), supporting CAS, OAuth, and LDAP protocols. The interface automatically selects the appropriate authentication mechanism based on the user request, generates and returns a JWT token, and ensures single sign-on across all systems. Security is ensured through HTTPS encryption and rate limiting.

[0119] See also Figure 3 , Figure 3A flow chart of a method for password-free login provided in an embodiment of the present application is shown.

[0120] In some optional implementations, providing a password-free login function based on user authentication information through an encryption algorithm includes:

[0121] Step S301: Detect whether the user has registered the target application;

[0122] Step S302: If the user has registered the target application, no operation is performed;

[0123] Step S303: If the user has not registered the target application, the user registration is automatically completed through the authentication protocol;

[0124] Step S304: obtaining a timestamp character string corresponding to a preset time period and combining it with the user's authentication information to form time period authentication data;

[0125] Step S305: Encrypt the time period authentication data using the AES-128-ECB encryption algorithm to generate an encrypted authentication credential, which is used for password-free login during a preset time period.

[0126] Therefore, by using an encryption algorithm based on the user's authentication information to provide a password-free login function, the convenience and security of user login are significantly improved. This method detects the user's registration status and automatically completes the registration through the authentication protocol if the user is not registered, reducing the tedious steps of manual registration. The encryption algorithm is used to generate a password-free login credential, simplifying the subsequent access process.

[0127] The timestamp corresponding to the preset time period is obtained and combined with user information. The encrypted authentication credential is generated using the AES-128-ECB encryption algorithm, ensuring the uniqueness and security of the credential within the validity period and preventing unauthorized access. This dynamic timestamp combined with encryption strategy effectively reduces the risk of credential replay attacks while eliminating the need for users to repeatedly enter passwords, thus optimizing the user experience. Overall, this approach enhances the efficiency and security of identity management through automated registration and encrypted, password-free login, providing a seamless solution for cross-application access.

[0128] In some optional implementations, the current system time is obtained and converted into a Unix timestamp, a dynamic time window of 5 minutes before and after is calculated, and it is combined with user information (such as a user name or user ID) into structured data (such as a string "username:ID:timestampRange" or JSON format), and UTF-8 encoding is performed and a salt value is optionally added to enhance security. The combined data is then used as input to generate an encrypted authentication credential using the AES-128-ECB encryption algorithm; upon subsequent login, the system decrypts the credential and verifies whether the timestamp is within ±5 minutes. If valid, the verification is passed, thereby achieving the convenience and security of password-free login.

[0129] In some optional embodiments, the method further comprises:

[0130] Checking whether the timestamp is within a preset time period;

[0131] If the timestamp is not within the preset time period, a time expiration error code is returned;

[0132] If the timestamp is within the preset time period, then use the checkUserDisable() function to check whether the user status is disabled;

[0133] If the user status is disabled, a status error code is returned;

[0134] If the user status is not disabled, do nothing.

[0135] Therefore, by verifying whether the timestamp is within the preset time period and combining it with a user status check, the security and reliability of password-free login are significantly enhanced. The timestamp verification mechanism ensures that the encrypted authentication credentials are valid only within the validity period. If the preset time period is exceeded, a time expiration error code is returned, effectively preventing the abuse of expired credentials and ensuring system security. If the timestamp is valid, the checkUserDisable() function is further used to verify whether the user status is disabled. If disabled, a status error code is returned, preventing illegal access to disabled accounts and thus improving the rigor of identity management. If the user status is normal, no additional operations are performed, maintaining the smoothness of the process. This multi-level verification process, by combining time and status checks, reduces the risk of security vulnerabilities and ensures the legitimacy and stability of password-free login. Ultimately, this method provides a more secure and controllable access mechanism for cross-application authentication, optimizes the user experience, and enhances the overall security protection capabilities of the system.

[0136] Device embodiment

[0137] See also Figure 4 , Figure 4A structural block diagram of a cross-application login, authentication and information synchronization device provided in an embodiment of the present application is shown.

[0138] The embodiment of the present application also provides a cross-application login, authentication and information synchronization device, the specific implementation of which is consistent with the implementation and technical effects recorded in the above method embodiment, and some contents will not be repeated here.

[0139] The present application provides a cross-application login, authentication, and information synchronization device, the device including a processor configured to implement the following steps:

[0140] The information synchronization module 101 is used to synchronize user information to multiple target applications using a timer;

[0141] A single sign-on module 102 is used to set up a unified authentication interface and share user authentication information to provide a single sign-on function;

[0142] The password-free login module 103 is used to provide a password-free login function based on the user's authentication information through an encryption algorithm.

[0143] In some optional implementations, the scheduled synchronization includes database synchronization, Excel synchronization, or LDAP polling synchronization;

[0144] Among them, the database synchronously uses JDBC to batch process user information and submit it to the target application;

[0145] Excel automatically parses user information and maps it to the target application;

[0146] LDAP polling synchronization periodically queries the LDAP directory to obtain user information and synchronizes it to the target application.

[0147] In some optional implementations, the LDAP polling synchronization adopts an intelligent throttling mechanism to dynamically adjust the synchronization frequency according to network conditions.

[0148] In some optional embodiments, the processor is configured to set up a unified authentication interface and share user authentication information to provide a single sign-on function in the following manner:

[0149] A unified authentication interface is set up using the RESTful design style. The unified authentication interface supports three authentication protocols: CAS, OAuth, and LDAP.

[0150] Receiving the user's authentication selection and authentication information using a receiving device;

[0151] Based on the user's authentication selection, the unified authentication interface automatically selects the corresponding authentication mechanism;

[0152] After successful authentication, a JWT token corresponding to the authentication information is generated and shared with multiple target applications to provide a single sign-on function. The single sign-on function ensures that the user only needs to log in once to access multiple target applications.

[0153] In some optional embodiments, the processor is configured to provide a password-free login function based on the user's authentication information through an encryption algorithm in the following manner:

[0154] Check whether the user has registered the target application;

[0155] If the user has already registered the target app, no action is taken;

[0156] If the user has not registered the target application, the user registration is automatically completed through the authentication protocol;

[0157] Obtain the timestamp string corresponding to the preset time period and combine it with the user's authentication information to form time period authentication data;

[0158] The time period authentication data is encrypted using the AES-128-ECB encryption algorithm to generate an encrypted authentication credential, which is used for password-free login during a preset time period.

[0159] In some optional implementations, the processor is further configured to:

[0160] Checking whether the timestamp is within a preset time period;

[0161] If the timestamp is not within the preset time period, a time expiration error code is returned;

[0162] If the timestamp is within the preset time period, then use the checkUserDisable() function to check whether the user status is disabled;

[0163] If the user status is disabled, a status error code is returned;

[0164] If the user status is not disabled, do nothing.

[0165] Device Example

[0166] An embodiment of the present application also provides an electronic device, which includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of any of the above methods are implemented. The specific implementation method is consistent with the implementation method and the technical effect achieved in the above method embodiment, and some contents will not be repeated here.

[0167] See 5, Figure 5 A structural framework diagram of an electronic device provided in an embodiment of the present application is shown.

[0168] The electronic device includes at least one memory 210, at least one processor 220, and a bus 230 connecting different platform systems.

[0169] The memory 210 may include a readable medium in the form of a volatile memory, such as a random access memory (RAM) 211 and / or a cache memory 212 , and may further include a read-only memory (ROM) 213 .

[0170] The memory 210 also stores a computer program, which can be executed by the processor 220, so that the processor 220 implements the steps of any of the above methods.

[0171] The memory 210 may also include a utility 214 having at least one program module 215, such program module 215 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0172] Accordingly, the processor 220 may execute the aforementioned computer program and the utility 214 .

[0173] The processor 220 may be implemented as one or more application specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field programmable gate arrays (FPGAs), or other electronic components.

[0174] Bus 230 may represent one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor, or a local bus using any of a variety of bus architectures.

[0175] The electronic device may also communicate with one or more external devices 240, such as a keyboard, pointing device, Bluetooth device, etc., and may also communicate with one or more devices capable of interacting with the electronic device, and / or any device that enables the electronic device to communicate with one or more other computing devices (e.g., a router, modem, etc.). Such communication may be performed via input / output interface 250. Furthermore, the electronic device may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via network adapter 260. The network adapter 260 may communicate with other modules of the electronic device via bus 230. It should be understood that, although not shown in the figures, other hardware and / or software modules may be used in conjunction with the electronic device, including but not limited to microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage platforms.

[0176] System Example

[0177] See also Figure 6 , Figure 6 A schematic structural diagram of a cross-application login, authentication, and information synchronization system provided in an embodiment of the present application is shown.

[0178] The present application also provides a cross-application login, authentication, and information synchronization system, which includes:

[0179] The above electronic equipment.

[0180] Media Examples

[0181] An embodiment of the present application also provides a chip, which stores a computer program. When the computer program is executed by a processor, the steps of any of the above methods are implemented. The specific implementation method is consistent with the implementation method and the technical effect achieved in the above method embodiment, and some contents will not be repeated here.

[0182] See also Figure 7 , Figure 7 A schematic diagram of the structure of a program product provided in an embodiment of the present application is shown.

[0183] The program product is used to implement any of the above methods. The program product can use a portable compact disc read-only memory (CD-ROM) and include program code, and can be run on a terminal device, such as a personal computer. However, the program product of the present invention is not limited to this. In the embodiment of the present application, the readable storage medium can be any tangible medium that contains or stores a program, and the program can be used by or in combination with an instruction execution system, device or device. The program product can use any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0184] The chip may include a data signal propagated in baseband or as part of a carrier wave, which carries readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. The readable storage medium may also be any readable medium that can send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, device, or component. The program code contained on the readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical cable, RF, or any suitable combination of the foregoing. The program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C, Python, or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user computing device, as a standalone software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. Where a remote computing device is involved, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0185] This application is explained from the perspectives of purpose of use, effectiveness, progress and novelty, and has complied with the functional enhancement and use requirements emphasized by the Patent Law. The above description and drawings of this application are only preferred embodiments of this application and are not intended to limit this application. Therefore, all structures, devices, features, etc. that are similar or identical to those of this application, that is, all equivalent replacements or modifications made in accordance with the scope of the patent application of this application, should fall within the scope of protection of the patent application of this application.

Claims

1. A cross-application login, authentication and information synchronization method, characterized in that: Predicting and regulating container service load, the method includes: Use timers to synchronize user information to multiple target applications; Set up a unified authentication interface and share user authentication information to provide single sign-on functionality; Based on the user's authentication information, an encryption algorithm is used to provide a password-free login function.

2. The cross-application login, authentication and information synchronization method according to claim 1, characterized in that: The scheduled synchronization includes database synchronization, Excel synchronization or LDAP polling synchronization; Among them, the database synchronously uses JDBC to batch process user information and submit it to the target application; Excel automatically parses user information and maps it to the target application; LDAP polling synchronization periodically queries the LDAP directory to obtain user information and synchronizes it to the target application.

3. The cross-application login, authentication and information synchronization method according to claim 2, characterized in that: The LDAP polling synchronization adopts an intelligent throttling mechanism to dynamically adjust the synchronization frequency according to the network conditions.

4. The cross-application login, authentication and information synchronization method according to claim 1, characterized in that: The provision of a unified authentication interface and sharing of user authentication information to provide a single sign-on function includes: A unified authentication interface is set up using the RESTful design style. The unified authentication interface supports three authentication protocols: CAS, OAuth, and LDAP. Receiving the user's authentication selection and authentication information using a receiving device; Based on the user's authentication selection, the unified authentication interface automatically selects the corresponding authentication mechanism; After successful authentication, a JWT token corresponding to the authentication information is generated and shared with multiple target applications to provide a single sign-on function. The single sign-on function ensures that the user only needs to log in once to access multiple target applications.

5. The cross-application login, authentication and information synchronization method according to claim 1, characterized in that: The password-free login function is provided based on the user's authentication information through an encryption algorithm, including: Check whether the user has registered the target application; If the user has already registered the target app, no action is taken; If the user has not registered the target application, the user registration is automatically completed through the authentication protocol; Obtain the timestamp string corresponding to the preset time period and combine it with the user's authentication information to form time period authentication data; The time period authentication data is encrypted using the AES-128-ECB encryption algorithm to generate an encrypted authentication credential, which is used for password-free login during a preset time period.

6. The cross-application login, authentication and information synchronization method according to claim 5, characterized in that: The method further comprises: Checking whether the timestamp is within a preset time period; If the timestamp is not within the preset time period, a time expiration error code is returned; If the timestamp is within the preset time period, then use the checkUserDisable() function to check whether the user status is disabled; If the user status is disabled, a status error code is returned; If the user status is not disabled, do nothing.

7. A cross-application login, authentication and information synchronization device, characterized in that: The cross-application login, authentication and information synchronization device includes: An information synchronization module is used to synchronize user information to multiple target applications using a timer; Single sign-on module, used to set up a unified authentication interface and share user authentication information to provide single sign-on functionality; The password-free login module is used to provide password-free login function based on user authentication information through encryption algorithm.

8. An electronic device, characterized in that: The electronic device includes a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the steps of implementing the method according to any one of claims 1 to 6.

9. A cross-application login, authentication and information synchronization system, characterized in that: The cross-application login, authentication and information synchronization system includes: The electronic device according to claim 8.

10. A chip, characterized in that: The chip stores a computer program, and when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images