Cross-Platform Single Sign-On via Access Token and Device Binding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies fail to achieve single sign-on across client applications on mobile terminals and web applications, as cookies cannot be directly sent from browsers to application programs.
Innovation Solution
A login method that involves sending an access token to a browser, creating relationships between access tokens and user information, and using device information to facilitate single sign-on between client applications and web applications, including obtaining and verifying device details and IP addresses to ensure secure login operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If cookie-based single sign-on is used across multiple websites, then web application login consistency is achieved, but client application login consistency cannot be achieved because browsers cannot send cookies directly to application programs
Solution Approach 1:
The patent introduces a URL as an intermediary carrier to transfer authentication information from browsers to client applications. The server generates a URL containing encoded user information that the browser can pass to the client application, which then submits to the server for verification, enabling cross-platform single sign-on without direct cookie access
Solution Approach 2:
The patent transforms the authentication mechanism by changing the data format and transmission parameters. Instead of using cookies directly, the system encodes user information into URL parameters, changes the transmission medium from browser-cookie to URL-string, and modifies the verification process to accept URL-based authentication data
2Reliability
If device information and IP address verification are added to ensure secure login, then login security is improved, but login process complexity increases
Solution Approach 1:
The patent performs device information collection and IP address verification in advance during the authentication process. The server obtains device type, operating system, and IP address information before final authentication, pre-validates these parameters against stored records, and only then completes the login, ensuring security while streamlining the final user interaction
Solution Approach 2:
The patent implements feedback mechanisms where the server compares current device information and IP address against previously stored authentication data. The system provides feedback by verifying whether the current device matches the authenticated device, and adjusts the authentication flow accordingly - either completing login or requesting additional verification
Data Source
AI summary
The present disclosure provides a login method for a client application and a corresponding server. The method includes: sending an access token to a browser of a terminal and creating a corresponding relationship between the access token and user information of a user after the user has successfully logged into a web application via the browser of the terminal; receiving a relationship creating request from the browser and creating a corresponding relationship between device information of the terminal and the access token in accordance with the relationship creating request, wherein the relationship creating request includes the device information of the terminal and the access token; receiving a login request of a client application, the login request including the device information of the terminal that operates the client application; determining the access token corresponding to the device information of the terminal that operates the client application based on the created corresponding relationship between the device information and the access token; and determining the user information which corresponds to the access token based on the created corresponding relationship between the access token and the user information, and performing a login operation of the client application program based on the user information. The technical scheme of the present disclosure can achieve login without re-inputting information such as a user name and a password when a client application is to be logged in after a web application in a terminal has successfully been logged in.