CN101997685B - Single sign-on method, single sign-on system, and related equipment - Google Patents

Abstract

The invention provides a single sign-on method, single sign-on system and associated equipment, aims at solving the problem of the prior art which gives illegal users the chance to personate the legal user to view the destination page. The method comprises the following steps: a client treatment unit sends a registration request to a web service unit, the web service unit determines the unique uniform resource locator (URL) which is corresponded to the destination page URL within the registration request and sends a registration response which comprises the local URL to the client treatment unit, the client treatment unit sends a logon request which comprises an identification information and the local URL to a shared server after receiving the registration response, a single sign-on device indicates a web browser to send a request message for accessing the local URL to the web service unit according to the indication sent by the shared server which successfully checks the user identification according to the identification information in the registration request and the web service unit indicates the web browser to access the corresponding destination page URL according to the request message.

Description

Single sign-on method, single sign-on system, and related equipment

technical field

The present application relates to the technical field of computer networks, and in particular to a single sign-on method, a single sign-on device, a login-free server and a single sign-on system.

Background technique

With the rapid development of information technology and network technology, there are more and more various network application systems, such as network mailboxes, professional forums, bulletin board systems (BBS, Bulletin Board System) and so on. Before using each of the network application systems, the user must log in according to the user name and password agreed in advance. For this reason, the user must remember the user name and password required to log in to each network system. For the user, the operation is very inconvenient .

In order to solve the above problems, single sign-on (SSO, Single Sign-on) technology came into being. SSO technology can provide convenience for users to access multiple network application systems. When users log in to the first network application system, they will be guided by the client to the free login server to log in; The client authenticates the login information such as the authentication information obtained after encrypting the user's password), and returns to the user an authentication credential ticket if the authentication is passed; After receiving the user's access request, it will verify the legitimacy of the ticket in the Binlog server according to the ticket. If the ticket is legal, the user can directly access other application systems without logging in again.

Accompanying drawing 1 is a schematic diagram of a user logging in to a network application system for the first time and performing verification on a free login server.

Step 101, step 102, the user sends a single sign-on request message to the free log-on server through the client terminal and the web browser, which includes the Uniform Resource Locator (URL) of the target webpage ( URL, Uniform Resource Locator), wherein the first signature information is obtained by the client after encrypting the UID, password and URL of the target webpage;

Step 103: After receiving the single sign-on request, the free login server finds the password corresponding to the UID according to the UID contained in the single sign-on request, and according to the encryption method predetermined with the client in advance, encrypts the UID, the found password and the single sign-on request. Click the URL of the target web page included in the login request to encrypt, obtain the second signature information, and compare the first signature information with the second signature information, and when the two are consistent, assign a ticket to the user, and enter step 104;

Step 104, sending the allocated ticket to the web browser, instructing the web browser to jump to the URL of the target web page contained in the single sign-on request message;

Step 105, the page browser sends a request message to the target application system, and the message includes the URL and ticket of the requested target web page;

Step 106, the network application system corresponding to the target webpage performs identity verification on the ticket;

In step 107, the target network application system returns the requested page content of the target web page to the user after successful authentication in step 106.

If the SSO request message sent in the above step 102 is intercepted by other malicious users using hacker software, then other users can send a request to the free login server and pretend to be the user to access the target network application system after the verification is successful.

In order to avoid the above problems, the Bindeng server determines the valid time of the ticket when issuing the ticket to the user, for example, 5 minutes, etc. After the valid time is exceeded, the page content of the target application system cannot be requested by using the ticket. However, even if a short ticket validity time is set, it is still difficult to prevent a malicious user from impersonating a legitimate user to access the target network application system within a short period of time.

Contents of the invention

The embodiment of the present application provides a single sign-on method, which is used to solve the problem that an illegal user pretends to be a legitimate user to access a target page in the existing single sign-on technology.

Correspondingly, the embodiment of the present application also provides a single sign-on device, a free login server, and a single sign-on system.

The technical scheme provided by the embodiments of the present application is as follows:

A single sign-on method that includes:

The client processing unit in the single sign-on device sends a registration request to the webpage service unit;

The webpage service unit determines the local URL uniquely corresponding to the target webpage URL included in the registration request, stores the correspondence between the local URL and the target webpage URL, and sends a registration response containing the local URL to the client processing unit;

After receiving the registration response, the client processing unit sends a login request including verification information and the local URL to the free login server;

The single sign-on device receives an instruction sent by the free login server based on the verification information in the login request after the user's identity is successfully authenticated, and instructs the web browser in the single sign-on device to send a request message for accessing the local URL to the web service unit;

According to the request message, the web page service unit instructs the web browser to access the corresponding target page URL when determining that the corresponding relationship between the requested local URL and the target page URL is stored.

A single sign-on method that includes:

After receiving the login request from the single sign-on device, the free login server searches for the password corresponding to the user ID included in the login request, and

Obtain server-side authentication information based on the user ID, the password found, and the local URL included in the login request, and

After determining that the authentication information contained in the login request is consistent with the server-side authentication information, instruct the web browser in the single sign-on device to access the local URL, wherein the local URL is unique to the URL of the target page to be accessed by the user correspond.

A single sign-on device comprising:

The client processing unit is configured to send a registration request to the webpage service unit, and after receiving the corresponding registration response, send a login request including the verification information and the local URL contained in the registration response to the free login server;

The webpage service unit is used to receive the registration request, determine the local URL uniquely corresponding to the target webpage URL contained in the registration request, and store the correspondence between the local URL and the target webpage URL, and send a message containing the local URL to the client processing unit. registration response, and according to the webpage access request sent by the webpage browser in the single sign-on device, when it is determined that the corresponding relationship between the local URL in the webpage request and the target page URL is stored, instruct the webpage browser to access the corresponding The target page URL.

A free login server, comprising:

a receiving unit, configured to receive a login request from the single sign-on device;

A search unit, configured to find the password corresponding to the user ID included in the login request;

The determination unit is used to obtain server-side verification information according to the method agreed with the single sign-on device, according to the user ID and local URL included in the login request, and the password found by the search unit;

a judging unit, configured to judge whether the server-side verification information obtained by the determining unit is consistent with the verification information included in the login request;

The indication unit is used to indicate that the web browser in the single sign-on device requests the local URL contained in the login request when the judging unit determines that the server-side verification information is consistent with the verification information contained in the login request, wherein the The local URL uniquely corresponds to the URL of the target page that the user wants to visit.

A single sign-on system, including a single sign-on device and a free login server, wherein,

The single sign-on device is used to determine the local URL uniquely corresponding to the target URL, send a login request including verification information and the local URL to the free login server, and determine that the free login server has stored the URL according to the instructions of the free login server. When indicating the corresponding relationship between the requested local URL and the target page URL, send a request message for accessing the target page URL to the web server that provides the page corresponding to the target URL on the network side;

The free login server is configured to receive the login request, and instruct the single sign-on device to access the URL contained in the login request after successfully authenticating the user according to the verification information contained in the login request.

In the embodiment of this application, the client no longer carries the URL of the target web page in the login request message, but carries a predetermined local URL uniquely corresponding to the URL of the target web page. The web browser requests the local URL contained in the login request, and the local web server located on the same computer as the client, when judging the corresponding relationship between the local URL requested by the web browser and the target page, instructs the web browser to request The corresponding target page avoids the problem that the illegal user pretends to be a legitimate user to access the target page caused by the login request carrying the URL of the target webpage being obtained by the illegal user.

Description of drawings

FIG. 1 is a schematic diagram of a verification process in an existing single sign-on technology;

Fig. 2 is the flow chart of the main realization principle of the embodiment of the present application;

FIG. 3 is a flowchart of a single sign-on method proposed in Embodiment 1 of the present application;

FIG. 4 is a flow chart of the single sign-on method proposed in Embodiment 2 of the present application;

FIG. 5 is a flow chart of the single sign-on method proposed in Embodiment 3 of the present application;

FIG. 6 is a schematic structural diagram of a single sign-on device proposed in an embodiment of the present application;

FIG. 7 is a schematic structural diagram of the free login server proposed by the embodiment of the present application.

Detailed ways

In the existing single sign-on scheme, when the login request message sent by the single sign-on client to the free login server, which carries the user identification UID, signature information, and the URL of the target web page to be accessed, is intercepted by the illegal user, the illegal user will After impersonating the user to request verification from the free login server, the authentication credential ticket can be obtained, so that the target page can be accessed, so there is a security risk.

The embodiment of the present application proposes that the login request message no longer carries the URL of the target web page, but carries a predetermined local URL uniquely corresponding to the URL of the target web page, and the free login server will instruct the user who sent the login request message to jump to Go to the local URL, so that legitimate users can obtain the target web page URL according to the corresponding relationship between the pre-stored local URL and the target web page URL, and access the target web page through the target web page URL; Therefore, the target page cannot be accessed further, thereby avoiding the above-mentioned security problems of the existing single sign-on technology.

The main realization principles, specific implementation methods and corresponding beneficial effects that can be achieved of the technical solutions of the embodiments of the present application will be described in detail below in conjunction with each accompanying drawing.

As shown in Figure 2, the main implementation principle flow of the embodiment of the present application is as follows:

Step 10, before the single sign-on device sends a login request to the free login server, determine the local URL uniquely corresponding to the target webpage, and store the local URL and The corresponding relationship of the URL of the target web page;

Step 20, the single sign-on device sends a login request message to the free login server, and the login request message includes verification information and the local URL determined in step 10;

Step 30: According to the verification information contained in the login request message, the free login server instructs the web browser in the single sign-on device to send access to the local URL contained in the login request message to the webpage service unit in the single sign-on device after the verification is successful. request message;

Step 40, when the web page service unit determines the stored correspondence between the local URL requested by the web browser and the URL of the target page, instruct the web browser to access the corresponding target page.

In the following, an embodiment will be introduced in detail based on the above-mentioned invention principles of the present application to elaborate and illustrate the main implementation principles of the method of the present application.

Embodiment one,

Please refer to accompanying drawing 3, it is the flowchart of the single sign-on method proposed in this embodiment, the single sign-on system includes the single sign-on device on the user side and the free login server on the network side, wherein the single sign-on device includes the client End processing unit, web service unit and web browser, wherein the client processing unit is used to receive user name input by the user, password, target page URL that needs to be logged in, and send a login request to the free login server; the client processing unit can It is an independent software product, or it can be a software product in the form of a browser that is improved on the basis of an existing browser. The webpage service unit can be realized by the existing webpage server, and the webpage server is a general designation for providing the local webpage URL and responding to the URL access request of the web browser, such as the Apache series products widely used on the UNIX platform; A browser is a general term for software products used to access specified URLs according to instructions from users or other applications, such as Microsoft's Internet Explorer series of products. Before the user performs single sign-on, the user shall register the user ID and the corresponding password in the free login server through the client processing unit in advance.

Step 301, after the user enters the user ID, the corresponding password, and the URL of the target webpage that needs to be logged into the client processing unit of the single sign-on device, the client processing unit sends a request to the webpage service unit located in the same single sign-on device as itself. Send a registration request including the URL of the target web page, for example, the URL of the target web page is http://www.targetweb.com/item_detail=23445 ;

Step 302: After receiving the registration request, the web page service unit determines the local URL uniquely corresponding to the target web page URL included in the registration request according to predetermined rules, for example, the rule for determining the local URL is " http://127.0.0.1:8808 /auth?sid= "+identification uniquely corresponding to the URL of the target web page contained in the registration request, the local URL determined for the above URL of the target web page http://www.targetweb.com/item_detail=23445 is http://127.0 .0.1:8808/auth? sid=123456 ; and store the corresponding relationship between the above-mentioned target web page URL and the determined local URL in itself;

Step 303, the web page service unit sends a registration response including the local URL determined in step 302 to the client processing unit;

Step 304, after the client processing unit receives the registration response sent by the webpage service unit, it obtains the local URL from the registration response, and according to the method agreed with the free login server in advance, according to the user ID, password, and registration response entered by the user. local URL to determine the first authentication information, for example, the client processing unit first obtains a character string including the local URL, user ID, and password, and uses the encryption method agreed upon with the free login server in advance, such as the MD5 algorithm, to obtain In order to improve the security of the verification information, the hash inversion of the encrypted character string can also be obtained, and the obtained hash inversion can be used as the first verification information. In order to further improve the security of the verification information, the verification information is different every time you log in to the same target webpage. When determining the verification information, not only the local URL, user ID, password, but also the current time can be added on this basis. information.

Step 305, after the client processing unit determines the first verification information, it sends a login request including the user ID, the first verification information and the local URL contained in the registration response to the free login server;

Step 306: After receiving the login request sent by the client processing unit in step 305, the free login server searches for the password corresponding to the user ID contained in the login request stored in advance, and determines the password according to the pre-agreed agreement with the client processing unit. The method of verifying information, such as MD5 algorithm, etc., obtains the second verification information according to the user identification, the password found, and the local URL contained in the login request;

In step 307, the free login server compares the first verification information contained in the login request sent by the client processing unit in the single sign-on device in step 305 with the second verification information determined in step 306, and the first verification When the information is consistent with the second verification information, it is determined that the verification is successful and enters step 308, otherwise it is determined that the verification fails, the login request is discarded or the login failure information is returned;

In step 308, after successful verification, the free login server instructs the web browser in the single sign-on device on the user side to access the local URL included in the login request received in step 306. Similar to the prior art, when the free login server instructs the web browser to access the local URL contained in the login request after successful verification, the authentication credential may be carried in the indication message. A specific carrying manner may be that the authentication credential is used as a parameter of the local URL included in the login request, and the local URL carrying the parameter is indicated to the web browser. In order to improve security, the authentication credentials can also be encrypted according to the encryption method agreed with the web server. For example, the local URL carrying the encrypted authentication credentials is "http://127.0.0.1/dosth?sid=123456&ticket=JDFU324o329jdcvjcv0374023842-- 8324-83207230432084", the newly added part after the ticket "JDFU324o329jdcvjcv0374023842--8324-83207230432084" is the encrypted authentication credential;

Step 309, the web browser in the single sign-on device sends a request message for accessing the above-mentioned local URL to the web service unit in the same single sign-on device according to the instruction of the free login server in step 308;

Step 310: After receiving the request message for accessing the local URL sent by the web browser, the web service unit in the single sign-on device judges whether there is a link between the local URL stored in itself and the URL of the target page. The target page URL corresponding to the local URL in the access request message. If it exists, it means that the local URL contained in the login request in step 305 is pre-determined through the registration process, that is, the login request is sent by the client processing unit in the single sign-on device, and enters step 311; otherwise, no follow-up deal with;

Step 311, the webpage service unit instructs the webpage browser to send an access request message to the webpage server corresponding to the URL of the target webpage. The web page service unit may carry an authentication credential in the indication message, and the authentication credential is obtained after decrypting the local URL carried in the access request message of the web browser in step 310 according to an encryption method pre-determined with the free login server.

During the registration interaction process from step 301 to step 303, since the client processing unit and the webpage service unit are located in the same single sign-on device, messages during the interaction process will not be obtained by other illegal users in the network.

In this embodiment, the webpage service unit may also be independent from the single sign-on device, for example, one or a group of servers is separately set up outside the single sign-on device. As long as the communication security between the web service unit and the single sign-on device is ensured, for example, the web service unit and the single sign-on device are connected through a dedicated line, etc., the security of the single sign-on process can be improved.

In this embodiment, before the user sends a login request to the free login server, the local URL corresponding to the URL of the target page requested by the user is determined in advance. What is carried in the login request is no longer the URL of the target page, but the local URL. The message was intercepted by other illegal users. Since the computer used by the illegal user does not have the URL of the target page corresponding to the local URL, the illegal user cannot pretend to be the user to visit the URL of the target page after successful verification, thus avoiding the login request being illegal User interception may cause illegal users to pretend to be legitimate users to log in to the target page.

Embodiment two,

In Embodiment 1, the first verification information is determined by the client processing unit in the single sign-on device. In this embodiment, the function of determining the first verification information is realized by the web page service unit in the single sign-on device. The registration request sent by the client processing unit to the webpage service unit should not only include the URL of the target webpage, but also include the user ID and password input by the user. After the webpage service unit determines the first verification information, it will inform the client of the first verification information. The processing unit, the client processing unit carries the first verification information in the login request sent to the free login server, please refer to Figure 4 for the specific process.

Step 401, after the user enters the user ID, the corresponding password, and the URL of the target webpage to be logged into the client processing unit in the single sign-on device, the client processing unit sends a message containing A registration request for the URL of the target web page, the user ID entered by the user, and the password corresponding to the user ID, for example, the URL of the target web page is http://www.targetweb.com/item_detail=23445;

Step 402, after the web page service unit receives the registration request, according to predetermined rules, determine the local URL uniquely corresponding to the target web page URL included in the registration request, for example, the determined local URL is http://127.0.0.1:8808/ auth? sid=123456; and save the corresponding relationship between the URL of the target web page and the determined local URL;

Step 403: After determining the local URL corresponding to the target webpage URL, the webpage service unit determines the first verification information according to the user ID, password, and local URL included in the registration response according to the method agreed with the free login server in advance. , go to step 404;

Step 404, the webpage service unit sends a registration response to the client, and the registration response includes the local URL determined in step 403 and the first verification information;

Step 405, after receiving the registration response, the client processing unit sends a login request to the free login server on the network side, where the login request includes the user ID input by the user, and the local URL and first verification information included in the registration response;

Step 406: After receiving the login request from the client processing unit in the single sign-on device in step 405, the free login server obtains the user ID from the login request, and finds the user ID from the stored correspondence between the user ID and the password. The password corresponding to the user ID, and according to the method for determining the verification information agreed with the webpage service unit in the single sign-on device in advance, according to the user ID, the found password and the URL contained in the login request, determine the second verification information;

Step 407, the free login server compares the first verification information contained in the login request sent by the client processing unit in the single sign-on device in step 405 with the second verification information determined in step 406, and if the two are consistent , determine that the verification is successful, and enter step 408, otherwise, discard the login request or inform the user that the verification has failed;

In step 408, after successful verification, the free login server instructs the web browser in the user-side single sign-on device to access the local URL contained in the login request received in step 406. Similar to step 308, the free login server can send the authentication credentials to As a parameter of the local URL contained in the login request;

Step 409, the web browser sends a request message to access the above-mentioned local URL to the web service unit in the same single sign-on device according to the instructions of the free login server in step 408;

Step 410: After receiving the request message for accessing the local URL sent by the web browser, the web service unit in the single sign-on device judges whether there is an URL of the target page corresponding to the local URL in the sent access request message. If it exists, it means that the local URL included in the login request in step 405 is pre-determined through the registration process, that is, the login request is sent by the client processing unit in the single sign-on device, and enters step 411; otherwise, no follow-up deal with;

Step 411, the webpage service unit instructs the webpage browser to send an access request message to the webpage server corresponding to the URL of the target webpage. The webpage service unit may carry an authentication credential in the indication message, and the authentication credential is obtained by decrypting the local URL carried in the access request message of the web browser in step 410 according to an encryption method pre-determined with the free login server.

Similarly, in this embodiment, the webpage service unit may also be independent from the single sign-on device, for example, one or a group of servers is separately set up outside the single sign-on device. As long as the communication security between the web service unit and the single sign-on device is ensured, for example, the web service unit and the single sign-on device are connected through a dedicated line, etc., the security of the single sign-on process can be improved.

Embodiment three,

In Embodiment 1 or Embodiment 2, the first verification information or the second verification information is determined by the client processing unit, the webpage service unit or the free login server according to the agreed method, according to the user ID, password, and local URL, In this embodiment, the determination of the verification information is not only based on the above three types of information, but also includes the time information when determining the first verification information, so that even if the same computer is used to access the same target web page at different times, the determined verification information It is also different, so as to prevent other illegal users using the same computer from pretending to be legitimate users to visit the target webpage. Please refer to the accompanying drawing 5 for the specific process.

Step 501, after the user enters the user ID, the corresponding password, and the URL of the target webpage to be logged into the client processing unit in the single sign-on device, the client processing unit sends a message containing A registration request for the URL of the target web page, the user ID entered by the user, and the password corresponding to the user ID, for example, the URL of the target web page is http://www.targetweb.com/item_detail=23445;

Step 502, after the web page service unit receives the registration request, according to predetermined rules, determine the local URL uniquely corresponding to the target web page URL included in the registration request, for example, the determined local URL is http://127.0.0.1:8808/ auth? sid=123456; and save the corresponding relationship between the URL of the target web page and the determined local URL;

Step 503: After determining the local URL corresponding to the URL of the target webpage, the webpage service unit determines according to the method agreed with the free login server in advance, according to the user ID, password, local URL included in the registration response and the current time information input by the user. First verification information, enter step 504;

Step 504, the webpage service unit sends a registration response to the client, and the registration response includes the local URL determined in step 503, the first verification information, and the time information when the webpage service unit determines the first verification information;

Step 505. After receiving the registration response, the client processing unit sends a login request to the free login server on the network side. The login request includes the user ID input by the user, and the local URL, first verification information, and time included in the registration response. information;

Step 506: After receiving the login request sent by the client processing unit in the single sign-on device in step 505, the free login server obtains the user ID from the login request, and finds the user ID from the stored correspondence between the user ID and the password. The password corresponding to the user ID, and according to the method of determining the verification information pre-agreed with the webpage service unit in the single sign-on device, according to the user ID, the password found, the URL and time information contained in the login request, determine the second verify message;

Step 507, the free login server compares the first verification information contained in the login request sent by the client processing unit in the single sign-on device in step 505 with the second verification information determined in step 506, and if the two are consistent , determine that the verification is successful, and enter step 508, otherwise, discard the login request or inform the user that the verification has failed;

In step 508, after successful verification, the free login server instructs the web browser in the user-side single sign-on device to access the local URL contained in the request login request received in step 506. Similar to step 308, the free login server can pass the authentication Credentials as parameters to the URL of the webpage included in the login request;

Step 509, the web browser sends a request message for accessing the local URL to the web service unit in the same single sign-on device according to the instructions of the free login server in step 508;

Step 510: After receiving the request message for accessing the local URL sent by the web browser, the web service unit in the single sign-on device judges whether there is an Send the target page URL corresponding to the local URL in the access request message. If it exists, it means that the local URL included in the login request in step 505 is pre-determined through the registration process, that is, the login request is sent by the client processing unit in the single sign-on device, and enters step 511; otherwise, no follow-up deal with;

Step 511, the webpage service unit instructs the webpage browser to send an access request message to the webpage server corresponding to the URL of the target webpage. The web page service unit may carry an authentication credential in the indication message, and the authentication credential is obtained after decrypting the local URL carried in the access request message of the web browser in step 510 according to an encryption method pre-determined with the free login server.

Among them, in order to improve security, the password contained in the registration request sent by the client processing unit in the single sign-on device in step 501 can be the password entered by the client processing unit according to the encryption method agreed with the free login server. obtained after encryption; similarly, the password found by the free login server based on the user ID contained in the login request is obtained after encrypting the password entered by the user when registering with the free login server according to the agreed encryption method.

In step 503, the web page service unit in the single sign-on device determines the first verification information according to the user ID, password, local URL contained in the registration response, and current time information input by the user. The process of verifying information is similar: the webpage service unit first obtains the string containing the local URL, user ID, password and current time, and encrypts the obtained string according to the encryption method agreed with the Bindlog server in advance, such as the MD5 algorithm , in order to improve the security of the verification information, the reverse hash of the encrypted character string may also be obtained, and the obtained reverse hash may be used as the first verification information.

In the above step 506, the free login server obtains the second verification information according to the user ID, the found password, the local URL included in the login request and the time information in a method similar to that of determining the first verification information in step 503.

Similar to Embodiment 1, in step 503, the function of the webpage service unit to determine the first verification information may also be implemented by the client processing unit in the same single sign-on device.

Similar to Embodiment 1, in order to ensure the security of authentication credential transmission, the free login server encrypts the authentication credential assigned to the user according to the encryption method pre-agreed with the webpage service unit in the single sign-on device after the verification is successful, If the encrypted authentication credential is carried in the instruction message instructing the web browser in the single sign-on device to access the local URL, for example, the encrypted authentication credential is used as a parameter of the requested local URL, and the webpage service unit determines that the When there is a corresponding relationship between the local URL requested by the web browser and the URL of the target page, the encrypted authentication credentials carried in the web page request message sent by the web browser are decrypted according to the agreed encryption method, and the target page URL instructing the web browser to access The instruction message on the page carries the decrypted authentication credentials.

In step 510, after the web page service unit determines that the login request is sent by the client processing unit located in the same single sign-on device as the web browser, it can also clear the correspondence between the local URL and the target page URL, so that Save storage space.

Correspondingly, please refer to FIG. 6 , which is a schematic structural diagram of a single sign-on device proposed in this application. The single sign-on device includes a client processing unit 601, a web page service unit 602 and a web browser 603, wherein,

The client processing unit 601 is configured to send a registration request to the web page service unit 602, and send a login request including the verification information and the local URL included in the registration response to the free login server on the network side after receiving the corresponding registration response;

The web page service unit 602 is configured to receive a registration request, determine a local URL uniquely corresponding to the target web page URL included in the registration request, store the correspondence between the local URL and the target web page URL, and send a message containing the URL to the client processing unit 601. The registration response of the local URL, and the request message for visiting the webpage sent according to the webpage browser 603, when determining the corresponding relationship between the local URL and the target page URL stored in the webpage request message, instruct the webpage browser 603 to access the corresponding target page URL;

The web browser 603 is configured to send a request message to the web server 602 for accessing the web page containing the local URL according to the instruction sent by the free login server on the network side based on the verification information in the login request after the user identity verification is successful, and according to the web page According to the instruction of the service unit 602, an access request message is sent to the webpage server corresponding to the target URL.

The above-mentioned single sign-on device can be located in the same computer of the user, and its components can also be located independently of each other in multiple computers or devices with data processing functions.

Correspondingly, this application also provides a free login server on the network side. Please refer to FIG.

The receiving unit 701 is configured to receive the login request sent by the above-mentioned single sign-on device;

A search unit 702, configured to search for a password corresponding to the user ID contained in the login request;

The determination unit 703 is configured to obtain server-side verification information according to the method agreed with the single sign-on device, according to the user ID and local URL included in the login request, and the password found by the search unit;

A judging unit 704, configured to judge whether the server-side verification information obtained by the determining unit 703 is consistent with the verification information contained in the login request;

The indicating unit 705 is configured to indicate that the web browser in the single sign-on device requests the local URL contained in the login request when the judging unit 704 determines that the server-side verification information is consistent with the verification information contained in the login request, wherein The local URL uniquely corresponds to the URL of the target page to be accessed by the user.

For the convenience of description, when describing the above system, functions are divided into various units and described separately. Of course, when implementing the present application, the functions of each unit can be realized in one or more pieces of software and/or hardware.

Obviously, those skilled in the art can make various changes and modifications to the application without departing from the spirit and scope of the application. In this way, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalent technologies, the present application is also intended to include these modifications and variations.

Claims (14)

1. A single sign-on method, characterized in that, comprising: The client processing unit in the single sign-on device sends a registration request to the webpage service unit; The webpage service unit determines the local URL uniquely corresponding to the target webpage URL included in the registration request, stores the correspondence between the local URL and the target webpage URL, and sends a registration response containing the local URL to the client processing unit; After receiving the registration response, the client processing unit sends a login request including verification information and the local URL to the free login server; The single sign-on device receives an instruction sent by the free login server based on the verification information in the login request after the user's identity is successfully authenticated, and instructs the web browser in the single sign-on device to send a request message for accessing the local URL to the web service unit; According to the request message, the web page service unit instructs the web browser to access the corresponding target page URL when determining that the corresponding relationship between the requested local URL and the target page URL is stored. 2. The method according to claim 1, wherein the verification information is that after the client processing unit receives the registration response, according to the method agreed with the free login server in advance, according to the user ID, password, and determined by the local URL included in the registration response. 3. The method according to claim 1, wherein the verification information is that after the webpage service unit receives the registration request, according to the method agreed with the free login server, according to the determined local URL uniquely corresponding to the target webpage , determined by the user ID and password included in the registration request; After determining the verification information, the web page service unit includes the verification information in the registration response and sends it to the client. 4. The method according to claim 3, wherein the webpage service unit determines verification information according to the local URL, the user ID and password contained in the registration request, and current time information; The registration response sent by the webpage service unit to the client also includes the time information; The login request sent by the client processing unit to the free login server also includes the time information; The free login server performs verification according to the verification information contained in the login request, including: The free login server looks up the password corresponding to the user ID contained in the login request, and According to the user ID, the found password, the local URL and time information included in the login request, obtain server-side authentication information, and Determine whether the authentication information included in the login request is consistent with the obtained server-side authentication information, and if they are consistent, determine that the authentication is successful; otherwise, the authentication fails. 5. The method according to claim 4, wherein the webpage service unit obtains verification information according to the method agreed with the free login server, according to the local URL, the user ID and password included in the registration request, and the current time information, specifically include: The web page service unit obtains a character string comprising the local URL, user ID, password, and current time information, and Encrypt the obtained character string according to the encryption method agreed with the Binance server, and Obtain the hash inversion of the encrypted string; The web page service unit uses the calculated hash inversion as verification information. 6. The method according to any one of claims 1 to 3, wherein the free login server verifies the identity of the user according to the verification information contained in the login request, specifically including: The free login server looks up the password corresponding to the user ID contained in the login request, and Obtain server-side authentication information based on the user ID, the found password, and the local URL contained in the login request, and Determine whether the authentication information included in the login request is consistent with the obtained server-side authentication information, and if they are consistent, determine that the authentication is successful; otherwise, the authentication fails. 7. The method according to claim 1, wherein the password contained in the registration request is obtained by the client processing unit after encrypting the password input by the user according to the encryption method agreed with the free login server; The password found by the free login server based on the user ID contained in the login request is obtained by encrypting the password entered by the user when registering with the free login server according to the agreed encryption method. 8. The method according to claim 1, wherein after the free login server successfully authenticates the user, instructing the web browser in the single sign-on device to request a local URL, it also includes: The encryption method agreed by the web service unit, encrypting the authentication credentials assigned to the user, and carrying the encrypted authentication credentials in the instruction message instructing the web browser in the single sign-on device to access the local URL; and After the webpage service unit determines the corresponding relationship between the local URL accessed by the webpage browser and the URL of the target page, it also includes: decrypting the encrypted authentication credentials carried in the request message for accessing the webpage sent by the webpage browser, and The decrypted authentication credential is carried in the indication message instructing the web browser to access the corresponding target page URL. 9. The method according to any one of claims 1 to 3, wherein the web service unit determines the correspondence between the local URL and the target page URL stored in the web browser and instructs the web browser to After visiting the corresponding target page URL, it also includes: The web page service unit clears the stored correspondence between the local URL and the target page URL. 10. The method according to claim 1, wherein the web page service unit and the client processing unit are located in the same single sign-on device, or the web page service unit is independent of the single sign-on device. 11. A single sign-on method, characterized in that, comprising: After receiving the login request from the single sign-on device, the free login server searches for the password corresponding to the user ID included in the login request, and Obtain server-side authentication information based on the user ID, the password found, and the local URL included in the login request, and After determining that the authentication information contained in the login request is consistent with the server-side authentication information, instruct the web browser in the single sign-on device to access the local URL, wherein the local URL is unique to the URL of the target page to be accessed by the user correspond. 12. A single sign-on device, characterized in that it comprises: The client processing unit is configured to send a registration request to the webpage service unit, and after receiving the corresponding registration response, send a login request including the verification information and the local URL contained in the registration response to the free login server; The webpage service unit is used to receive the registration request, determine the local URL uniquely corresponding to the target webpage URL contained in the registration request, and store the correspondence between the local URL and the target webpage URL, and send a message containing the local URL to the client processing unit. registration response, and according to the webpage access request sent by the webpage browser in the single sign-on device, when it is determined that the corresponding relationship between the local URL in the webpage request and the target page URL is stored, instruct the webpage browser to access the corresponding The target page URL. 13. A free login server, comprising: a receiving unit, configured to receive a login request from the single sign-on device; A search unit, configured to find the password corresponding to the user ID included in the login request; The determination unit is used to obtain server-side verification information according to the method agreed with the single sign-on device, according to the user ID and local URL included in the login request, and the password found by the search unit; a judging unit, configured to judge whether the server-side verification information obtained by the determining unit is consistent with the verification information included in the login request; An instructing unit, configured to instruct the web browser in the single sign-on device to access the local URL contained in the login request when the judging unit determines that the server-side verification information is consistent with the verification information contained in the login request, wherein the local The URL uniquely corresponds to the URL of the target page that the user wants to visit. 14. A single sign-on system, characterized in that it includes a single sign-on device and a free login server, wherein, The single sign-on device is used to determine the local URL uniquely corresponding to the target URL, send a login request including verification information and the local URL to the free login server, and determine that the free login server has stored the URL according to the instructions of the free login server. When indicating the corresponding relationship between the requested local URL and the target page URL, send a request message for accessing the target page URL to the web server that provides the page corresponding to the target URL on the network side; The free login server is configured to receive the login request, and instruct the single sign-on device to access the URL contained in the login request after successfully authenticating the user according to the verification information contained in the login request.

Images