CN104065616A - Single sign-on method and system - Google Patents

Abstract

The invention discloses a single-sign-on method and system, which are used to solve the problems in the single-sign-on scheme provided by the prior art that a client must be triggered to open a browser for single-sign-on. The method includes: the first application sends a login request including the automatic login authorization information to the middleware set in the user terminal; after receiving the login request, the middleware obtains the shared key agreed with the authentication server, and according to the shared key and the specified information, after verifying that the automatic login authorization information is correct, the login credential is obtained; the middleware provides the login credential to the first application; the first application sends the login credential to the application server; wherein: the login credential is used to indicate that the user terminal has successfully Obtain authentication from the authentication server.

Description

Single sign-on method and system

technical field

The invention relates to the field of data services, in particular to a single sign-on method and system.

Background technique

"Single sign-on" is a very common business login form on the Internet at present. It allows users to authenticate once and log in multiple times, so as to avoid users from repeatedly entering passwords, thereby improving users' experience in using services. For example, when the client accesses application server 1 for the first time, because the client has not logged into any application server at this time, it will be directed to the authentication server to log in; according to the login information provided by the client, the authentication server will Validation, if it passes the validation, it can return an authentication credential——ticket to the client; when the client accesses other application servers, such as application server 2, it will bring this ticket with it as it has passed Authentication credentials; after receiving an access request with a tichket, other application servers will send the ticket to the authentication server for verification to check the legitimacy of the ticket; if the verification is passed, the client can log in without having to log in again Next visit the application server 2.

The current single sign-on solution is mostly oriented to Web applications, that is, it needs to use the browser's redirection mechanism and session management mechanism to maintain the user's login status and transfer it between different services. Such a solution is difficult to support cross-client and browser single sign-on Click login. Specifically, the following two types of requirements are difficult to meet with the above solutions provided by the prior art:

The first category of requirements: After the user successfully logs in with the client, he opens a service page on the browser, and can automatically log in successfully as the user of the client;

The second type of requirement: After the user successfully logs in with a browser, run a local client, and the client can automatically log in successfully.

Aiming at the first type of requirements, currently there is a technology that proposes a single sign-on solution from the client to the browser as shown in FIG. 1 . The realization process of this scheme mainly includes the following steps:

First, after receiving the login instruction input by the user, the client successfully logs in to the authentication server and obtains the authentication credentials (such as the ticket mentioned above) fed back by the authentication server;

After the client detects the access command generated by the user clicking the application link provided by the client, it generates an identity certificate and constructs a URL containing the identity certificate according to the authentication credentials fed back by the authentication server;

The client calls the browser to make the browser send an access request to the application server according to the generated URL containing the identity certificate;

Then, the application server requests the authentication server to verify the identity credentials contained in the access request;

The authentication server verifies the identity certificate, and after verifying that the client has successfully logged in, feeds back the verification result to the application server;

Finally, the application server sends the information of the logged-in page to the browser for display according to the verification result.

The above-mentioned process shown in Figure 1 mainly has two defects:

1. It must be triggered by the user to open the browser by starting the client, and does not support the user to manually open the browser for single sign-on;

2. It cannot meet the second type of needs mentioned above.

Contents of the invention

The embodiment of the present invention provides a single sign-on method and system to solve the problem that the single sign-on solution provided by the prior art must be triggered to open the browser for single sign-on by starting the client, and does not support the above-mentioned The second category of needs.

Embodiments of the present invention adopt the following technical solutions:

A single sign-on method that includes:

The first application set in the user terminal obtains the automatic login authorization information; and sends a login request including the automatic login authorization information to the middleware set in the user terminal; wherein: the automatic login authorization information is used by the authentication server The shared key and the specified information are generated by performing the operation of calculating the summary; after the middleware receives the login request, it obtains the shared key agreed with the authentication server, and according to the shared key and the specified information, after verifying that the automatic login authorization information in the login request is correct, obtain a login credential; wherein: the login credential is used to indicate that the user terminal has successfully obtained the authentication of the authentication server; the middleware will log in The credentials are provided to the first application; the first application sends the login credentials to the application server.

A single sign-on system, including a first application and middleware set in a user terminal, wherein:

The first application is configured to obtain automatic login authorization information; and send a login request containing the automatic login authorization information to the middleware; and obtain a login credential provided by the middleware, and send the login credential to the application server; wherein: the automatic login authorization information is generated by the authentication server using the shared key and specified information to perform the operation of calculating the summary;

The middleware is configured to obtain the shared key agreed with the authentication server after receiving the login request, and verify the login request according to the shared key and the specified information After the automatic login authorization information is correct, the login credential is obtained and provided to the first application; wherein: the login credential is used to indicate that the user terminal has successfully obtained the authentication of the authentication server.

The beneficial effects of the embodiments of the present invention are as follows:

By setting middleware that can obtain the SSO authorization information provided by the authentication server to the user terminal that has successfully authenticated, no matter whether the user terminal accesses the application server through a browser or a client, it can obtain SSO authorization based on the middleware information, and the single sign-on of the user terminal is successfully implemented. This satisfies the second type of requirement mentioned above in the background technology, and solves the problem that the single sign-on solution provided by the prior art must be triggered to open the browser for single sign-on by starting the client, and does not support the above-mentioned problems of the second category of needs mentioned above.

Description of drawings

Fig. 1 is the single sign-on solution from the client to the browser in the prior art;

FIG. 2 is a schematic flowchart of a single sign-on method provided by an embodiment of the present invention;

Fig. 3 is a schematic diagram of the system structure for realizing Embodiment 1 and Embodiment 2;

Fig. 4 is the specific implementation flowchart schematic diagram of embodiment 1;

FIG. 5 is a schematic diagram of a specific implementation flow of Embodiment 2.

Detailed ways

In order to solve the problem that the single sign-on solution provided by the prior art must be triggered to open the browser for single sign-on by starting the client, and does not support the second type of requirements mentioned above, the embodiment of the present invention provides a A new type of single sign-on solution. This solution sets middleware that can obtain the SSO authorization information provided by the authentication server to the successfully authenticated user terminal, so that no matter whether the user terminal uses a browser or a client to access the application server, the SSO can be obtained based on the middleware. Authorization information, and successfully realize the single sign-on of the user terminal.

The embodiments of the present invention will be described below in conjunction with the accompanying drawings. It should be understood that the embodiments described here are only used to illustrate and explain the present invention, and are not intended to limit the present invention. And, in the case of no conflict, the features in the embodiments and the series of embodiments in this description can be combined with each other.

First, an embodiment of the present invention provides a single sign-on method as shown in FIG. 2 . The method mainly includes the following steps:

Step 21, the first application set in the user terminal obtains automatic login authorization information;

Different from the prior art, in the embodiment of the present invention, when the first application wants to access a certain server, it needs to obtain the automatic login authorization information first. The automatic login authorization information is generally generated by the authentication server using the shared key and specified information to perform the operation of calculating the digest. The first application may, but is not limited to, obtain the automatic login authorization information in one of the following two ways:

Way 1: The first application reads the automatic login authorization information preset in the storage space from the storage space of the user terminal. For example, the automatic login authorization information may be stored in the storage space of the user terminal when factory settings are performed on the user terminal.

Mode 2: the first application sends a service request to the application server; and receives automatic login authorization information fed back by the application server according to the service request. Among them: the specific implementation process of the automatic login authorization information fed back by the application server according to the service request can be as follows:

First, after receiving the service request, the application server sends an authentication request including the application server's identification to the authentication server;

Then, the authentication server receives the authentication request, and judges whether the identification of the application server included in the authentication request exists in the pre-stored identification set; wherein: the identification set is composed of the identifications of the application servers that are allowed to be accessed;

Finally, when the judgment result is yes, the authentication server sends the automatic login authorization information to the application server; the application server forwards the automatic login authorization information sent by the authentication server to the user terminal, so that the first application obtains the automatic login authorization information.

The advantage of adopting the second method above is that the first application can be controlled to only have the permission to access the pre-set application server that is allowed to be accessed. Since the preset application servers that are allowed to be accessed are often verified legal application servers, the second method can avoid the leakage of user information caused by the first application accessing the illegal application server to a certain extent, thereby improving The legitimacy of the entire single sign-on scheme.

Step 22, the first application sends a login request including the obtained automatic login authorization information to the middleware set in the user terminal;

Wherein: the middleware mentioned here may be a software module set in the user terminal, or a physical module realized by combining software and hardware. And the physical module can be set inside the user terminal, and can also be placed outside the user terminal. When it is placed outside the user terminal, it can be connected to the user terminal and perform information interaction with the user terminal.

Step 23, after receiving the login request, the middleware obtains the shared key agreed with the authentication server;

Among them: a specific implementation process for the middleware to obtain the shared key agreed with the authentication server is as follows:

First, the middleware obtains the middleware login credential sent by the authentication server; wherein: the middleware login credential is sent after the authentication server verifies that the user verification information sent by the second application in the user terminal is correct;

Then, the middleware sends the middleware login credentials to the authentication server;

Finally, the middleware receives the shared key sent by the authentication server after verifying that the middleware login credentials are correct. Alternatively, after verifying that the middleware login credential is correct, the authentication server may also send shared key generation information to the middleware, and the middleware generates a shared key according to the shared key generation information.

Alternatively, the middleware may directly generate the shared key according to a key generation algorithm pre-agreed with the authentication server.

In step 24, the middleware verifies whether the automatic login authorization information in the login request is correct according to the obtained shared key and the specified information mentioned above. end the process;

Step 25, the middleware obtains the login credentials;

The login credential is used to indicate that the user terminal has successfully been authenticated by the authentication server.

For example, in a specific implementation of the method provided by the embodiment of the present invention, the shared key K and a counter C can be set in both the middleware and the authentication server. After the middleware receives the login request from the first application, it can use the counter to randomly generate a random number R (that is, the challenge value) and return it to the first application, and the first application sends R to the authentication server; the authentication server uses the shared key K and R calculate the summary H1, and return H1 as the automatic login authorization information to the first application, and the first application returns the H1 to the middleware; the middleware uses K to verify H1, and if K is verified to be correct, the middleware uses The shared keys K and C and other information (for the details of other information described here, refer to Embodiment 1 below) calculate the digest H2, and use the generated H2 as a login credential.

In addition, the login credential may also be provided by the authentication server to the user terminal successfully authenticated by the authentication server, and stored in the user terminal.

Alternatively, the login credential may also be generated by the middleware according to the single sign-on authorization information provided by the authentication server. Wherein: the single sign-on authorization information indicates that the user terminal has been successfully authenticated by the authentication server. For this way of obtaining login credentials, if the middleware has already obtained and stored the SSO authorization information before receiving the login request sent by the first application, the middleware can, after receiving the login request, Obtain SSO authorization information directly from its own storage space and use it as login credentials. And if the middleware has not obtained the SSO authorization information when receiving the login request, the middleware can use the login request as a trigger condition to send user verification information (usually user name and password) to the authentication server, and obtain The SSO authorization information provided by the authentication server after verifying that the user authentication information is correct.

Step 26, the middleware provides the login credentials to the first application;

Step 27, the first application sends the login credential to the application server, and the process ends.

In the embodiment of the present invention, the specified information used by the authentication server to generate the automatic login authorization information may be the challenge value sent by the first application. In this scenario, the above method may further include the following two steps before step 21:

Step 1: After receiving the login identity request sent by the first application, the middleware randomly generates a challenge value;

Step 2: The middleware sends an identity response containing the generated challenge value to the first application, so that the first application sends the challenge value to the authentication server.

In the embodiment of the present invention, the above-mentioned first application may be a browser, or other applications other than the browser. The difference from the prior art is that after adopting the solution provided by the embodiment of the present invention, no matter what type of application, when it wants to log in to the application server, it will send automatic login authorization information and a login request to the middleware to obtain login credentials. This satisfies the second type of requirement mentioned above in the background technology, and solves the problem that the single sign-on solution provided by the prior art must be triggered to open the browser for single sign-on by starting the client, and does not support the above-mentioned problems of the second category of needs mentioned above.

In the embodiment of the present invention, the first application may be a browser, and the second application may be other applications other than the browser; or the second application may be the browser, and the first application may be other applications other than the browser. Specifically, when the second application is a browser and the first application is a non-browser client, the second type of requirements described in the background art can be met.

Taking two specific embodiments as examples below, the practical application of the solutions provided by the embodiments of the present invention will be described in detail.

Example 1

Embodiment 1 is used to implement the single sign-on process from the client to the browser, that is, after the user successfully logs in on the client, he opens a service page on the browser, and can automatically log in successfully as the user of the client.

A schematic structural diagram of a system for implementing Embodiment 1 is shown in FIG. 3 , including a user terminal, an application server, and an authentication server. Wherein: the user terminal includes multiple applications, and these applications include browser and non-browser applications. Specifically, non-browser applications are represented by "client" and "Web application" in FIG. 3 .

Based on the system shown in FIG. 3 , the specific implementation process of Embodiment 1 will be specifically described below. The process includes the following steps as shown in Figure 4:

Step 41, after the user terminal successfully passes the authentication of the authentication server, obtain the user key K returned by the authentication server to the user terminal, and store K in the middleware provided in the user terminal;

Specifically, the user terminal can display the user authentication information input interface on the display screen after receiving the client operation instruction input by the user; certified. After the user verification information is confirmed to be correct through the verification by the authentication server, the user terminal can obtain the K fed back by the authentication server.

Step 42, the user terminal sends an access request to the application server after receiving the application server access instruction input by the user into the browser;

For example, after receiving the domain name of the application server entered by the user into the browser, the user terminal sends an access request to the corresponding application server according to the domain name.

Step 43, the application server redirects the browser to the authentication server;

Step 44, the authentication server returns authentication page information to the browser, wherein: the authentication page information includes not only the content displayed in the browser window, but also scripts (such as javascript scripts) run locally by the browser;

Step 45, the browser triggers sending a login identity request to the local middleware listening port by calling the javascript script;

Step 46, the middleware judges whether the user terminal has successfully passed the authentication of the authentication server, if the judgment result is yes, the middleware returns the user's identity response (including the user identifier and challenge value) to the browser, and proceeds to step 47, Otherwise, the middleware returns a notification message that the user terminal is not logged in to the browser, and ends the single sign-on process;

Generally, the middleware can judge whether the user terminal has successfully passed the authentication of the authentication server according to whether it stores the K sent by the authentication server.

In addition, the above challenge value may be, but not limited to, a random number generated by the middleware.

Optionally, the user's identity response returned by the middleware to the browser may also contain some additional information (such as the system time of the user terminal sent by the browser to the authentication server, the URL of the page visited by the browser, or some fixed character strings wait).

Step 47, the browser sends the user ID and challenge value returned by the middleware to the authentication server to request automatic login authorization;

Step 48: The authentication server determines the user key K corresponding to the user ID sent by the browser from the correspondence between the user ID and the user key stored in itself, and uses K to verify the challenge value and other additional information sent by the browser. (such as the system time of the user terminal sent by the browser to the authentication server, the URL of the page visited by the browser or some fixed strings, etc.) calculate the summary, generate automatic login authorization information, and return the generated automatic login authorization information to the browser device;

Step 49, the browser triggers sending an identity credential acquisition request to the middleware by calling a javascript script, and the request carries automatic login authorization information;

Step 410, the middleware uses the K stored in itself to verify the correctness of the automatic login authorization information, and if correct, generates a login credential;

Wherein: the generated login credential includes the single sign-on authorization information provided by the authentication server to the user terminal.

For example, since K is the information sent by the authentication server to the successfully authenticated user terminal, K can indicate that the user terminal can perform single sign-on, so K can be regarded as the single sign-on authorization information provided by the authentication server to the user terminal. Alternatively, the authentication server may also provide other information as SSO authorization information after successfully authenticating the user terminal.

Step 411, the middleware returns the login credentials to the browser;

Step 412, the browser sends the login credential to the authentication server, and the authentication server generates the identity credential after verifying that the login credential is correct, and redirects the browser to the application server; when redirecting to the application server, the browser sends the The above identity credentials provided by the authentication server to the browser;

Optionally, the authentication server may also directly send the generated identity certificate to the application server when redirecting the browser to the application server.

Step 413, the application server queries the authentication server for the correctness of the obtained identity certificate;

Step 414, after the application server finds that the identity credential is correct, it returns to the browser the information of the logged-in page displayed to the user terminal that has successfully logged in.

Through the above steps, since a middleware that can obtain and store the single sign-on authorization information provided by the authentication server to the successfully authenticated user terminal is set in the user terminal, after the user successfully authenticates the user terminal by using the client, When using the browser to access the application server later, the single sign-on of the user terminal can be successfully realized according to the single sign-on authorization information stored in the middleware.

Example 2

The schematic structural diagram of the system for implementing Embodiment 2 is still shown in FIG. 3 , including a user terminal, an application server, and an authentication server.

Based on the system shown in FIG. 3 , the specific implementation process of Embodiment 2 will be specifically described below. The process includes the following steps as shown in Figure 5:

Step 51, the user terminal receives the user verification information input by the user into the browser, and uses the user verification information to obtain authentication from the authentication server;

Step 52, the browser requests the middleware login credentials from the authentication server;

In Embodiment 2, the browser may request the middleware login credentials from the authentication server by sending a service request to the application server.

Step 53, the authentication server returns the middleware login credentials to the browser;

If the browser requests the middleware login credential by sending a service request to the application server, the application server may send an authentication request containing the application server's identity to the authentication server after receiving the service request;

After receiving the authentication request, the authentication server judges whether the identification of the application server contained in the authentication request exists in the pre-stored identification set; wherein: the identification set is composed of the identifications of the application servers that are allowed to be accessed;

If the judgment result is yes, the authentication server sends automatic login authorization information to the application server; wherein: the automatic login authorization information may be generated by the authentication server using the user key and specified information to perform the operation of calculating the summary;

After receiving the automatic login authorization information sent by the authentication server, the application server sends the automatic login authorization information and the middleware login credential to the user terminal, so that the first application obtains the automatic login authorization information and the middleware credential.

Step 54, the browser invokes the middleware through a local method, and sends the middleware login credentials to the middleware;

For example, when middleware is installed in the user terminal, the middleware can register the local application protocol (such as: sso://), and when the browser page in the user terminal calls the middleware, it can assemble the URL according to the calling parameter param (such as sso://param), and redirect the browser to this URL, then the browser can find the middleware process registered with the protocol according to the local application protocol (such as sso//), and call the process, so as to realize the intermediate file calls.

Step 55, the middleware sends an authentication request to the authentication server, and the authentication request carries middleware login credentials;

Step 56, the authentication server checks the correctness of the middleware login credentials;

Step 57: After verifying that the middleware login credentials are correct, the authentication server returns an authentication response to the middleware, and at the same time, the two parties negotiate to generate a shared user key, which can be used as the authentication server to provide to the user terminal that has successfully authenticated Single sign-on authorization information;

Step 58, after the client receives the enabling instruction input by the user, it sends a login request requesting the login credential to the middleware by calling the middleware credential acquisition interface;

If the browser also obtains the automatic login authorization information, the browser also sends the automatic login authorization information to the middleware.

Step 59, the middleware locally calculates and generates a login credential according to the user key and returns it to the client;

Optionally, if the middleware receives the automatic login authorization information sent by the browser, the middleware will verify that the automatic login authorization information is correct according to the user key and specified information, and then generate a login credential and return it to the client.

Step 510, the client sends an authentication request to the application server, and the authentication request carries the login credentials returned by the middleware;

Generally, in order for the authentication server to identify the user to whom the login credential belongs, the authentication request sent by the client may also carry a user identifier.

Step 511, the application server requests the authentication server to verify the login credential carried in the authentication request sent by the client, and receives a notification message sent by the authentication server after verifying that the login credential is correct;

Assuming that the authentication request also carries a user ID, the application server will also send the user ID to the authentication server. After receiving the user ID and login credentials, the authentication server searches for the user key corresponding to the received user ID in the pre-stored correspondence between the user ID and the user key; and compares the found user key with the Whether the user key parsed from the login credentials is consistent; if the comparison result is consistent, it is determined that the login credentials are correct; otherwise, it is determined that the login credentials are incorrect.

In step 512, the application server returns information indicating successful login to the client.

Through the above steps included in Embodiment 2, after the user successfully implements the authentication of the user terminal by using the browser, when subsequently using the client to access the application server, the user can successfully implement the authentication of the user terminal according to the SSO authorization information stored in the middleware. sign in. This also satisfies the second type of requirement mentioned above in the background technology, thereby solving the problem that the single sign-on solution provided by the prior art must be triggered to open the browser for single sign-on by starting the client, and does not support Problems with the second category of needs mentioned above.

It is worth noting that, whether it is the middleware in Embodiment 1 or Embodiment 2, it can have the function of sending user verification information to the authentication server, so as to obtain the single sign-on authorization information provided by the authentication server to the successfully authenticated user terminal . Therefore, even if the middleware has not obtained the SSO authorization information when the browser (or client) requests the login credentials from the middleware, the middleware can also use the message sent by the browser (or client) to request the login credentials As a trigger condition, send user verification information to the authentication server, so as to obtain the single sign-on authorization information provided by the authentication server to the successfully authenticated user terminal, and provide login credentials to the browser (or client) based on the single sign-on authorization information .

Based on the same inventive concept as the single sign-on method described above, the embodiment of the present invention also provides a single sign-on system to solve the problem that the single sign-on solution provided by the prior art must be triggered by starting the client Open the browser for single sign-on, and the problem of not supporting the second type of requirements mentioned above. The system mainly includes a first application and middleware set in the user terminal, wherein: the functions of the first application and middleware are as follows:

The first application is used to obtain automatic login authorization information; and send a login request including the obtained automatic login authorization information to the middleware; and obtain the login credentials provided by the middleware, and send the login credentials to the application server; wherein: automatic login The authorization information is generated by the authentication server using the shared secret key and the specified information to perform the operation of calculating the summary;

The middleware is used to obtain the shared key agreed with the authentication server after receiving the login request, and after verifying that the automatic login authorization information in the login request is correct according to the shared key and specified information, obtain the login credential and Provided to the first application; wherein: the login credential is used to indicate that the user terminal has successfully obtained the authentication of the authentication server.

Optionally, the first application may specifically be used for:

From the storage space of the user terminal, read the automatic login authorization information preset in the storage space; or

Sending a service request to the application server; and obtaining automatic login authorization information fed back by the application server according to the service request.

Among them: the process of the application server feeding back the automatic login authorization information according to the business request specifically includes:

After receiving the service request, the application server sends an authentication request including the application server's identification to the authentication server;

The authentication server receives the authentication request, and judges whether the identification of the application server included in the authentication request exists in the pre-stored identification set; wherein: the identification set is composed of the identifications of the application servers that are allowed to be accessed;

The authentication server sends automatic login authorization information to the application server when the judgment result is yes;

The application server forwards the automatic login authorization information sent by the authentication server to the user terminal, so that the first application obtains the automatic login authorization information.

Optionally, the specified information used by the authentication server to generate the automatic login authorization information is the challenge value sent by the first application. In such a scenario, the middleware can also be used to: before obtaining the automatic login authorization information, randomly generate a challenge value after receiving the login identity request sent by the first application; send the identity identifier containing the challenge value to the first application response; then the first application is also used to send the challenge value to the authentication server.

Optionally, the middleware provided by the embodiment of the present invention may be specifically used to: obtain the middleware login credential sent by the authentication server, wherein: the middleware login credential is the certificate sent by the second application in the user terminal verified by the authentication server Sent after the user verification information is correct; send the middleware login credentials to the authentication server; and receive the shared key sent by the authentication server after verifying that the middleware login credentials are correct; or verify that the middleware login credentials are correct according to the authentication server The shared key generation information sent later generates a shared key. Alternatively, the middleware may be specifically configured to: generate a shared key according to a key generation algorithm pre-agreed with the authentication server.

Optionally, the first application may be a browser, and the second application may be other applications other than the browser; or the second application may be a browser, and the first application may be other applications other than the browser. Alternatively, both the first application and the second application may be browsers; or both the first application and the second application may be other applications other than the browser.

Those skilled in the art should understand that the embodiments of the present invention may be provided as methods, systems, or computer program products. Accordingly, the present invention can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It should be understood that each procedure and/or block in the flowchart and/or block diagram, and combinations of procedures and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions may be provided to a general purpose computer, special purpose computer, embedded processor, or processor of other programmable data processing equipment to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing equipment produce a Means for realizing the functions specified in one or more steps of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions The device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions can also be loaded onto a computer or other programmable data processing device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby The instructions provide steps for implementing the functions specified in the flow chart flow or flows and/or block diagram block or blocks.

While preferred embodiments of the invention have been described, additional changes and modifications to these embodiments can be made by those skilled in the art once the basic inventive concept is appreciated. Therefore, it is intended that the appended claims be construed to cover the preferred embodiment as well as all changes and modifications which fall within the scope of the invention.

Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalent technologies, the present invention also intends to include these modifications and variations.

Claims (12)

1. A single sign-on method, characterized in that, comprising: The first application set in the user terminal obtains the automatic login authorization information, and sends a login request containing the automatic login authorization information to the middleware set in the user terminal, wherein: the automatic login authorization information is used by the authentication server Generated by performing the operation of calculating the summary of the shared key and specified information; After receiving the login request, the middleware obtains the shared key agreed with the authentication server, and verifies that the automatic login authorization information in the login request is correct according to the shared key and the specified information After that, the login credential is obtained, wherein: the login credential is used to indicate that the user terminal has successfully obtained the authentication of the authentication server; the middleware provides login credentials to the first application; The first application sends the login credentials to the application server. 2. The method according to claim 1, wherein the first application obtains the automatic login authorization information, which specifically includes: The first application reads the automatic login authorization information preset in the storage space from the storage space of the user terminal; or The first application sends a service request to the application server; After receiving the service request, the application server sends an authentication request containing the application server's identification to the authentication server; The authentication server receives the authentication request, and judges whether the identification of the application server included in the authentication request exists in the pre-stored identification set; wherein: the identification set is composed of the identifications of the application servers that are allowed to be accessed; The authentication server sends automatic login authorization information to the application server when the judgment result is yes; The application server forwards the automatic login authorization information sent by the authentication server to the user terminal, so that the first application obtains the automatic login authorization information. 3. The method according to claim 1, wherein the specified information used by the authentication server to generate the automatic login authorization information is the challenge value sent by the first application; Before the first app obtains the automatic login authorization information, it also includes: The middleware randomly generates the challenge value after receiving the login identity request sent by the first application; The middleware sends an identity response containing the challenge value to the first application, so that the first application sends the challenge value to the authentication server. 4. The method according to claim 1, wherein the middleware obtains the shared key agreed with the authentication server, specifically comprising: The middleware obtains the middleware login credential sent by the authentication server, wherein: the middleware login credential is sent after the authentication server verifies that the user verification information sent by the second application in the user terminal is correct; the middleware sends the middleware login credentials to an authentication server; and receiving the shared key sent by the authentication server after verifying that the middleware login credentials are correct; or generating the shared key according to the shared key generation information sent by the authentication server after verifying that the middleware login credentials are correct key. 5. The method according to claim 4, wherein the first application is a browser, and the second application is other applications other than browsers; or The second application is a browser, and the first application is other applications other than the browser. 6. The method according to claim 1, wherein the middleware obtains the shared key agreed with the authentication server, specifically comprising: The middleware generates a shared key according to the key generation algorithm pre-agreed with the authentication server. 7. A single sign-on system, characterized in that it includes a first application and middleware disposed in a user terminal, wherein: The first application is configured to obtain automatic login authorization information; and send a login request containing the automatic login authorization information to the middleware; and obtain a login credential provided by the middleware, and send the login credential to the application server; wherein: the automatic login authorization information is generated by the authentication server using the shared key and specified information to perform the operation of calculating the summary; The middleware is configured to obtain the shared key agreed with the authentication server after receiving the login request, and verify the login request according to the shared key and the specified information After the automatic login authorization information is correct, the login credential is obtained and provided to the first application; wherein: the login credential is used to indicate that the user terminal has successfully obtained the authentication of the authentication server. 8. The system according to claim 7, wherein the first application is specifically used for: From the storage space of the user terminal, read the automatic login authorization information preset in the storage space; or Sending a service request to the application server; and obtaining automatic login authorization information fed back by the application server according to the service request; Wherein: the process of the application server feeding back the automatic login authorization information according to the service request specifically includes: After receiving the service request, the application server sends an authentication request containing the identity of the application server to the authentication server; the authentication server receives the authentication request, and judges whether the identity of the application server contained in the authentication request exists in the pre-stored identity set Among them: the identity set is composed of the identity of the application server that is allowed to be accessed; the authentication server sends the automatic login authorization information to the application server when the judgment result is yes; the application server forwards the automatic login authorization information sent by the authentication server to all The user terminal, so that the first application obtains automatic login authorization information. 9. The system according to claim 7, wherein the designated information used by the authentication server to generate the automatic login authorization information is the challenge value sent by the first application; The middleware is also used for: before obtaining the automatic login authorization information, after receiving the login identity request sent by the first application, randomly generating the challenge value; sending the identity request containing the challenge value to the first application identify the response; then The first application is further configured to send the challenge value to an authentication server. 10. The system according to claim 7, wherein the middleware is specifically used for: Obtaining the middleware login credential sent by the authentication server, wherein: the middleware login credential is sent after the authentication server verifies that the user verification information sent by the second application in the user terminal is correct; the middleware sends the middleware login credentials to an authentication server; and receiving the shared key sent by the authentication server after verifying that the middleware login credentials are correct; or generating the shared key according to the shared key generation information sent by the authentication server after verifying that the middleware login credentials are correct key. 11. The system according to claim 10, wherein the first application is a browser, and the second application is an application other than a browser; or The second application is a browser, and the first application is other applications other than the browser. 12. The system according to claim 7, wherein the middleware is specifically configured to: generate a shared key according to a key generation algorithm pre-agreed with the authentication server.