Automatic control method and system for user login
By working collaboratively across the control, server, and application sides, and using unified authentication credentials for user authentication and login control, the system solves security and user experience issues across multiple application systems, achieves seamless user verification and login, reduces the risk of sensitive information leakage, and improves both user experience and security.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-29
- Publication Date
- 2026-03-27
AI Technical Summary
Traditional account and password authentication methods suffer from poor security, duplicate logins, and poor user experience across multiple application systems, and cannot effectively solve the problems of secure user identity authentication and user behavior security after login.
By working collaboratively between the control end, server end, and application end, user identity authentication and login control are performed using unified authentication credentials. Authentication credentials are only transmitted between the control end and the server end. The client end and the application end do not store authentication information. The server end stores user information and performs verification and mapping relationship management.
It enables seamless user authentication and login across multiple applications, reduces the risk of authentication credential leakage, improves user experience, and achieves security auditing of user behavior through data forwarding and detection.
Smart Images
Figure CN121750331A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of secure login technology, and in particular relates to a method for automatically controlling user login across multiple applications and a system for implementing the method. Background Technology
[0002] As enterprises become increasingly information-driven and system-integrated, their critical business resources face immense pressure from access from internal departments, branch offices, visitors, and remote workers. The need for unified user authentication and access control across multiple application systems is becoming increasingly prominent. Traditional account and password authentication methods suffer from problems such as poor security, duplicate logins, and poor user experience, making them vulnerable to attacks that could lead to data theft or corruption, or even business interruptions, malicious code, and information leaks.
[0003] Single Sign-On (SSO) is a popular solution for enterprise business integration. It's defined as allowing users to access all trusted applications by logging in only once. However, traditional SSO technology only solves the problem of unified user login; it fails to provide secure user authentication or address the security of user behavior after login. Summary of the Invention
[0004] In view of the above background, the present invention aims to provide a method for unified control of user authentication and secure login across multiple applications, as well as a system for implementing the method.
[0005] On the one hand, an automatic control method for user login is first proposed, including: in response to a first application access request from an authorized client, the control terminal obtains the authentication credentials of the authorized client from the server, adds the authentication credentials to the first application access request, and sends it to the first application; the first application sends the received authentication credentials to the server for verification through the control terminal; after successful verification, the server returns the corresponding first user information to the first application for login; after successful login, the first application responds to the access request and establishes a connection with the authorized client; the control terminal forwards and detects the interaction data between the authorized client and the first application.
[0006] Preferably, authorized clients include those who log in to the server using the master account and master password assigned to them by the server and remain online. The server maintains a mapping relationship between the master account and authorized applications. The mapping relationship includes the master account, authorized applications, and the user information corresponding to the applications. The user information includes the username and password for logging into the authorized applications.
[0007] Furthermore, the server generates authentication credentials for authorized clients. This includes encrypting the authorized client's IP address, the main account, the generation time, and the validity period into a string when the first application is determined to be an authorized application of the main account. This string is then used as the authentication credential. The control end adds the authentication credential string to the request header of the first application's access request to access the first application. The first application extracts the authentication credential from this access request and initiates verification with the server.
[0008] The server verifies the authentication credentials, and verification is successful only if all of the following conditions are met: the client IP of the access request matches the authentication credentials, the main account in the authentication credentials is online, the application that sent the authentication credentials verification request is an authorized application of the main account, and the authentication credentials are within the validity period.
[0009] Preferably, each access request from an authorized client to the first application carries authentication credentials, and the first application only responds to access requests whose authentication credentials are verified; and the first application initiates verification of the authentication credentials for all access requests, or periodically initiates verification of the authentication credentials for access requests.
[0010] After the server verifies the authentication credentials sent by the first application, it injects a web script into the login page of the first application through the control terminal. The web script obtains the first user information and the corresponding login control of the first application from the server. The login control recognizes the user information input box on the login page of the first application and fills the obtained first user information into the user information input box to initiate the login.
[0011] Furthermore, the authorized client initiates a second application access request. The control terminal obtains authentication credentials from the server based on the client's IP address, adds the authentication credentials to the second application access request, and sends it to the second application. The second application sends the received authentication credentials to the server for verification. After successful verification, the server returns the corresponding second user information to the second application for login.
[0012] On the other hand, an automatic control system for user login is also proposed, which includes: The client is used to send a login request to the main account to obtain authorization, and to send an access request to the application. The server maintains the mapping relationship between the main account and authorized applications, generates authentication credentials for authorized clients, and verifies the authentication credentials sent by the application. The mapping relationship includes the main account, authorized applications, and their user information, wherein the user information includes the username and password for logging into the authorized application. The control unit is used to handle data forwarding and detection between the client, application, and server. On the application side, it is used to respond to access requests from clients.
[0013] Preferably, the above-mentioned user login automatic control system operation process includes the following steps: The client logs into the server using the master account and master password assigned to it by the server and stays online, becoming an authorized client; the server uses the encrypted string obtained by encrypting the authorized client's IP, master account, generation time and validity period as the authentication credential. An authorized client initiates an access request to the application through the control terminal. The control terminal obtains the authentication credentials of the authorized client from the server and adds the authentication credentials to the application access request before sending it to the application. The application sends the received authentication credentials to the server for verification. After successful verification, the server returns the corresponding user information to the application for login. After successful login, the application responds to the access request and establishes a connection with the client. The control terminal forwards and detects data between the authorized client and the application terminal; Subsequent application access requests from authorized clients will all carry authentication credentials for verification by the server. The server verifies the authentication credentials only if all of the following conditions are met: the IP address of the authorized client requesting the access matches the authentication credentials; the main account in the authentication credentials is online; the application sending the authentication credentials verification request is an authorized application of the main account; and the authentication credentials are within their validity period.
[0014] The technical solution of the present invention as described above has at least the following beneficial effects: authentication credentials are transmitted only between the control end and the server end, and neither the client nor the application end stores authentication information, which minimizes the risk of exposure of authentication credentials. At the same time, user information is only stored on the server end, which helps to reduce the possibility of leakage of sensitive information. Through the mapping relationship between the client and the application end, it is possible to control the client to only access authorized applications and realize the sharing of authentication credentials among multiple application ends, thereby achieving automated and seamless user authentication and login between different applications and improving user experience. Furthermore, the interaction data between the client and the application end is forwarded and detected by the control end, which is conducive to realizing the security audit of user behavior. Attached Figure Description
[0015] Figure 1 This is a schematic diagram of the overall workflow of an embodiment of an automatic control method for user login according to the present invention; Figure 2 This is a schematic diagram of a user authentication process, representing an embodiment of an automatic control method for user login according to the present invention. Figure 3 This is a schematic diagram of a user login process, representing an embodiment of an automatic control method for user login according to the present invention. Figure 4This is a schematic diagram of the module composition of an embodiment of an automatic user login control system according to the present invention; Figure 5 This is a data flow diagram illustrating an embodiment of an automatic user login control system according to the present invention. Detailed Implementation
[0016] The present application will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the scope of the application. Furthermore, it should be noted that, for ease of description, only the parts relevant to the application are shown in the accompanying drawings.
[0017] The technical solution of the present invention includes an automatic control method and system for user login. On the one hand, it reduces the security risks of user login by utilizing a unified authentication entry point; on the other hand, it improves user experience and efficiency by reducing manual input of account passwords and repeated login operations of associated applications; and at the same time, it realizes security detection and auditing of user access data.
[0018] The automatic control technology for user login proposed in this invention involves the client, server, and application all interacting with the control terminal. All data between the client, server, and application is forwarded and processed by the control terminal. The control terminal can be a network forwarding or network security device with gateway functionality, such as a switch or firewall. The application terminal can be a content-providing web server, data server, or terminal computer. The client can be software installed on the user's computer, a browser on the user's computer, software on a mobile device, a computer device, or the mobile device itself. This invention does not limit the specific implementation of these features.
[0019] like Figure 1 As shown, an embodiment of an automatic control method for user login specifically includes the following steps: S101. In response to the client's application access request, the control terminal obtains authentication credentials from the server.
[0020] The client can initiate an access request by entering the target application's URL. Since the client's application access request must be forwarded through the control terminal, the control terminal can obtain information such as the client's IP, the target application's IP or URL from the client's access request. The control terminal then obtains authentication credentials from the server based on the obtained client and target application information.
[0021] The server responds to the request from the control server by generating authentication credentials based on the client information and returning them to the control server. As a preferred implementation, the authentication credentials can be a string obtained by encrypting the client information.
[0022] S102. The control terminal forwards the access request and authentication credentials to the application terminal.
[0023] After receiving the authentication credentials returned by the server, the control end appends the string used as the authentication credentials to the client access request intercepted in S101, and then forwards the request to the application.
[0024] S103. The application sends the authentication credentials to the server for verification in order to obtain user information.
[0025] After receiving the access request and authentication request forwarded by the control server, the application extracts the authentication credentials and sends them to the server for verification. The server compares the authentication credentials sent by the application with the authentication credentials previously generated for the client. If they match, the verification passes; otherwise, the verification fails.
[0026] It should be noted that the application only extracts the string representing the authentication credential and does not need to explicitly define the content of the authentication credential. The verification of the authentication credential content is entirely performed by the server, and the authentication credential is encrypted, which effectively reduces the risk of authentication credential leakage.
[0027] If the authentication credentials of the application are verified, the corresponding user information stored on the server is retrieved based on the application information. For example, if the server has the application ID and its corresponding username and password stored in advance, the corresponding username and password will be retrieved based on the application ID after the authentication credentials of the application are verified, and the user information will be returned to the application.
[0028] S104. Log in to the application using user information and respond to the client's access request.
[0029] After receiving the user information returned by the server, the application performs a login operation, and after successful login, it responds with content based on the client access request forwarded by the control terminal.
[0030] As a preferred implementation, since data interaction between the client and the application needs to be forwarded through the control terminal, the control terminal can perform real-time security checks on the data and generate access logs for security auditing.
[0031] When the client accesses other applications, it can repeat steps S101 to S104, which will not be elaborated here.
[0032] As described above, the technical solution of this invention involves authentication credentials being transmitted only between the control terminal and the server terminal. Neither the client nor the application terminal stores authentication information, which minimizes the risk of authentication credentials being exposed. At the same time, user information is only stored on the server terminal, which helps reduce the possibility of sensitive information leakage. It enables authentication credentials to be shared among multiple application terminals, thereby achieving automated user verification between different applications and improving user experience. Furthermore, the interaction data between the client and the application terminal is forwarded and detected by the control terminal, which is beneficial for achieving security auditing of user behavior.
[0033] like Figure 2 As shown, in steps S101-S104, the following technical solutions are further proposed for the user authentication process of the automatic control method embodiment for user login.
[0034] S201. The client logs into the server and stays online.
[0035] As a preferred implementation, the server maintains a mapping relationship between the main account and authorized applications. This mapping relationship includes the main account, authorized applications, and their user information. The user information includes the username and password for logging into the authorized application. The main account is a unique identifier registered on the server or assigned by the server for the same user. Users on the client can log in to the server using the main account and password to establish and maintain a connection between the client and the server. At this time, the server can mark the current client as an authorized client. When the client logs off, the client's authorization is terminated.
[0036] The authorized applications mentioned here refer to all associated applications that the current main account is authorized to access. Each application has a corresponding username and password, which are either created by the user in advance in the corresponding application or automatically created by the server according to preset rules.
[0037] Before initiating an application access request, the client must first log in to the server using the main account and password. This doesn't mean that application access cannot be initiated without logging in with the main account; it simply means that logging in with the main account first shortens the authentication and login process.
[0038] S202. The control terminal obtains authentication credentials from the server based on the client's IP address.
[0039] When a client initiates an access request to the first application, its client IP, target application, and other data are obtained by the control terminal. The control terminal can then obtain the client's authentication credentials from the server based on the client information.
[0040] As a preferred implementation, if the server receives the authentication credential retrieval request from the control terminal and finds that the client IP is not online when querying the mapping relationship, the control terminal will redirect the client's request to the main account login interface.
[0041] S203. The server generates authentication credentials for the client and returns them to the control terminal.
[0042] When the server determines that the client is an authorized client, it generates authentication credentials for the client. This includes first determining whether the target application of the access request belongs to the authorized application of the main account. If it is an authorized application, the server encrypts the authorized client IP, main account, generation time and validity period to obtain a string, and uses this string as the authentication credential and returns it to the control end. If the target application is not an authorized application, the authentication process ends.
[0043] As a preferred implementation, each access request from the authorized client to the application carries authentication credentials, and the application only responds to access requests whose authentication credentials are verified. Alternatively, the application can initiate verification of the authentication credentials for all access requests, or periodically initiate verification of the authentication credentials for access requests.
[0044] As described above, in the technical solution of this embodiment of the invention, authentication credentials are transmitted only between the control end and the server end, and neither the client end nor the application end stores authentication information. This minimizes the risk of exposure of authentication credentials, and user information is only stored on the server end, which helps to reduce the possibility of leakage of sensitive information. Through the mapping relationship between the client end and the application end, it is possible to control the client to only access authorized applications.
[0045] like Figure 3 As shown, based on steps S101-S104 and S201-S203, the following technical solutions are further proposed for the user login process of the automatic control method embodiment for user login.
[0046] S301. In response to successful authentication of credentials, the control terminal injects the web page script into the application's login page.
[0047] Corresponding to the user authentication process in S201-S203, in this embodiment, the server verifies the authentication credentials sent by the application. Verification is successful only when all of the following conditions are met: the client IP of the access request is consistent with the authentication credentials; the main account in the authentication credentials is online; the application that sent the authentication credentials verification request is an authorized application of the main account; and the authentication credentials are within their validity period.
[0048] The server-side pre-sets a web script to obtain user information and login control information from the server. After the server verifies the application's authentication credentials, the web script is injected into the application's login page through the control end.
[0049] S302. The web page script retrieves user information and the corresponding login control from the server.
[0050] After the server verifies the application's authentication credentials, it retrieves the corresponding web script and login controls based on the application information, and obtains the application login username and password based on the client's main account information. All information is then returned to the control server. The control server first injects the web script into the application's login page, and the web script retrieves the corresponding login controls, application login username, and password from the server.
[0051] S303. The login control identifies user information, fills it into the corresponding input box on the application login page, and initiates the login process.
[0052] The specific implementation steps can be as follows: the webpage script is executed automatically, calling the login control to recognize the input boxes on the application's login page, and automatically filling in the username and password returned from the server into the input boxes to initiate login. It should be noted that the above-mentioned account auto-fill technology is not limited to the scope of this invention's embodiments; those skilled in the art can implement it using different code as needed, which will not be elaborated upon here.
[0053] like Figure 4 As shown, an embodiment of an automatic control system for user login implements the user authentication and login automatic control as described above. The system specifically includes the following modules: The client is used to send a login request to the main account to obtain authorization, and to send an access request to the application. The server-side is used to maintain the mapping relationship between the main account and authorized applications, generate authentication credentials for authorized clients, and verify the authentication credentials sent by the application. The mapping relationship includes the main account, authorized applications, and their user information, with the user information including the username and password for logging into the authorized application. The control unit is used to handle data forwarding and detection between the client, application, and server. On the application side, it is used to respond to access requests from clients.
[0054] like Figure 5 As shown, the above-mentioned user login automatic control system controls the user login process, including: The client logs into the server using the master account and master password assigned to it by the server and stays online, becoming an authorized client; the server uses the encrypted string obtained by encrypting the authorized client's IP, master account, generation time and validity period as the authentication credential. An authorized client initiates an access request to the first application through the control terminal. The control terminal obtains the authentication credentials of the authorized client from the server and adds the authentication credentials to the application access request before sending it to the first application. The first application sends the received authentication credentials to the server for verification. After successful verification, the server returns the corresponding user information to the first application for login. After successful login, the application responds to the access request and establishes a connection with the client. The control terminal forwards and detects data between the authorized client and the first application; All subsequent application access requests from authorized clients will carry authentication credentials for verification by the server. The server verifies the authentication credentials only if all of the following conditions are met: the IP address of the authorized client requesting the access matches the authentication credentials; the main account in the authentication credentials is online; the application sending the authentication credentials verification request is an authorized application of the main account; and the authentication credentials are valid.
[0055] Furthermore, the authorized client initiates a second application access request. The control terminal obtains authentication credentials from the server based on the client's IP address, adds the authentication credentials to the second application access request, and sends it to the second application. The second application sends the received authentication credentials to the server for verification. After successful verification, the server returns the corresponding second user information to the second application for login.
[0056] In a preferred implementation, after the server verifies the authentication credentials sent by the first application or the second application, it injects a web page script into the login page of the first application or the second application through the control terminal. The web page script obtains the user information and corresponding login control from the server. The login control recognizes the user information input box on the application login page and fills the obtained user information into the user information input box to initiate login.
[0057] As described above, in the technical solution of this embodiment of the invention, authentication credentials are transmitted only between the control end and the server end. Neither the client nor the application end stores authentication information, which minimizes the risk of exposure of authentication credentials. At the same time, user information is only stored on the server end, which helps to reduce the possibility of leakage of sensitive information. Through the mapping relationship between the client and the application end, it is possible to control the client to only access authorized applications and realize the sharing of authentication credentials among multiple application ends, thereby achieving automated and seamless user authentication and login between different applications and improving user experience. Furthermore, the interaction data between the client and the application end is forwarded and detected by the control end, which is conducive to realizing the security audit of user behavior.
[0058] Those skilled in the art will understand that all or part of the steps in the methods of the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc.
[0059] The description of the disclosed embodiments above enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles disclosed herein.
Claims
1. An automatic control method for user login, characterized in that, include: In response to a first application access request from an authorized client, the control terminal obtains the authentication credentials of the authorized client from the server, adds the authentication credentials to the first application access request, and sends it to the first application. The first application sends the received authentication credentials to the server for verification through the control terminal. After the server verifies the credentials, it returns the corresponding first user information to the first application for login. After successful login, the first application responds to the first application access request and establishes a connection with the authorized client. The control terminal forwards and detects data between the authorized client and the first application.
2. The automatic control method for user login according to claim 1, characterized in that, The authorized client includes the client logging into the server using the master account and master password assigned to it by the server and staying online.
3. The automatic control method for user login according to claim 2, characterized in that, The server maintains a mapping relationship between the main account and authorized applications. The mapping relationship includes the main account, authorized applications and their user information. The user information includes the username and password for logging into the authorized application. The server generates authentication credentials for authorized clients. When the first application belongs to the authorized application of the main account, the server encrypts the authorized client's IP address, main account, generation time, and validity period to obtain a string, which is then used as the authentication credential.
4. The automatic control method for user login according to claim 3, characterized in that, The control terminal adds the string of authentication credentials to the request header of the first application's access request to access the first application. The first application extracts the authentication credentials from the access request and initiates verification with the server.
5. The automatic control method for user login according to claim 4, characterized in that, Every access request from an authorized client to the first application carries authentication credentials. The first application will only respond to access requests whose authentication credentials are verified. In addition, the first application initiates verification of the authentication credentials for all access requests, or periodically initiates verification of the authentication credentials for access requests.
6. The automatic control method for user login according to claim 4, characterized in that, An authorized client initiates a second application access request. The control terminal obtains authentication credentials from the server based on the client's IP address, adds the authentication credentials to the second application access request, and sends it to the second application. The second application sends the received authentication credentials to the server for verification. After successful verification, the server returns the corresponding second user information to the second application for login.
7. An automatic control method for user login according to any one of claims 1-6, characterized in that, The server verifies the authentication credentials, and verification is successful only if all of the following conditions are met: the client IP of the access request matches the authentication credentials, the main account in the authentication credentials is online, the application that sent the authentication credentials verification request is an authorized application of the main account, and the authentication credentials are within the validity period.
8. The automatic control method for user login according to claim 1, characterized in that, After the server verifies the authentication credentials sent by the first application, it injects a web script into the login page of the first application through the control terminal. The web script obtains the first user information and the corresponding login control of the first application from the server. The login control recognizes the user information input box on the login page of the first application and fills the obtained first user information into the user information input box to initiate the login.
9. An automatic control system for user login, implementing the automatic control method for user login as described in any one of claims 1-8, characterized in that, The system includes: The client is used to send a login request to the main account to obtain authorization, and to send an access request to the application. The server maintains the mapping relationship between the main account and authorized applications, generates authentication credentials for authorized clients, and verifies the authentication credentials sent by the application. The mapping relationship includes the main account, authorized applications, and their user information, wherein the user information includes the username and password for logging into the authorized application. The control unit is used to handle data forwarding and detection between the client, application, and server. On the application side, it is used to respond to access requests from clients.
10. An automatic control system for user login according to claim 8, characterized in that, This system automatically controls the user login process, including: The client logs into the server using the master account and master password assigned to it by the server and stays online, becoming an authorized client; the server uses the encrypted string obtained by encrypting the authorized client's IP, master account, generation time and validity period as the authentication credential. An authorized client initiates an access request to the application through the control terminal. The control terminal obtains the authentication credentials of the authorized client from the server and adds the authentication credentials to the application access request before sending it to the application. The application sends the received authentication credentials to the server for verification. After successful verification, the server returns the corresponding user information to the application for login. After successful login, the application responds to the access request and establishes a connection with the client. The control terminal forwards and detects data between the authorized client and the application terminal; Subsequent application access requests from authorized clients will all carry authentication credentials for verification by the server. The server verifies the authentication credentials only if all of the following conditions are met: the IP address of the authorized client requesting the access matches the authentication credentials; the main account in the authentication credentials is online; the application sending the authentication credentials verification request is an authorized application of the main account; and the authentication credentials are within their validity period.