TW201824887A - System for using authentication server to implement free login in server group and method thereof - Google Patents

Abstract

A system for using an authentication server to implement free login in a server group and a method thereof are provided. By connecting to an authentication server to inquire whether a client is certified by a business server when the client connects to the business server, serving the client by the business server if the client is certified, re-directing the client to connect to the authentication server by the business server for completing certification if the client is not certified, and re-directing the client to connect to the business server by the authentication server for reconnecting the client and the business, the system and the method can reducing the complexity and loading of single sign-on, and can achieve the effect of improving authentication efficiency.

Description

System and method for implementing login-free system in authentication group by authentication server

A system and method for single sign-on multi-server, in particular, a system and method for implementing login-free in a servo group by an authentication server.

Single Sign-on (SSO) is a mechanism for users to access multiple servers. Users only need to authenticate once on one server, and they can freely shuttle between other servers. Repeat the input of the certification data for the certification operation.

The single sign-on mechanism reduces the cumbersome procedures required to log in to different servers, especially when using devices such as smart phones or tablets that are not convenient for key input, which reduces input time and therefore improves work efficiency. . But the single sign-on mechanism is not easy to implement. At present, the implementation methods provided by various manufacturers are not the same. For example, some manufacturers use cookies to record user authentication information, so as to provide authentication information for each server. Some vendors use session sharing technology to allow each server to share authentication information, so as to achieve single sign-on.

However, the above two ways of implementing single sign-on can be called mature products, but they are all flawed. A cookie is a client mechanism. The content of the record mainly includes the name, value, expiration time, path, and domain. The combination of the path and the domain constitutes the scope of the cookie, so it must be in the same scope (domain). A cookie can be used to implement single sign-on; session is a server mechanism. When a client accesses a server, the server creates a unique session identification (SSID) for the client. The client and the server will always transmit the signal of maintaining the status of the communication period identifier during the process of transmitting the data, so that the communication period identification code is always valid, so although the session method can be used to implement a single point across different domains. Login, but the single sign-on technology using session is more complicated, and the server needs to use additional resources to record and process the client's data. Therefore, the single sign-on technology using session will increase the burden of developing the server, and also Increase the load of the server while it is running.

In summary, it can be seen that the prior art single-point login technology has long been complicated to develop and has a large operational load. Therefore, it is necessary to propose an improved technical means to solve this problem.

In view of the prior art, there is a problem that the development complexity of the single sign-on technology is high and the running load is large, and the present invention discloses a system and method for implementing the login-free system in the servo group by the authentication server, wherein:

The invention discloses that the authentication server implements the login-free system in the servo group, and at least includes: a client; an authentication server, configured to determine whether the client passes the authentication; and a service server, configured to receive the client to transmit Request the target and connect to the authentication server to check whether the client passes the authentication. When the client fails the authentication, the service server redirects the client to the authentication server. When the client has passed the authentication, the service The server provides a service corresponding to the client's request target. The client is further configured to transmit the authentication data to the authentication server after being redirected to the authentication server, so that the authentication server determines that the client passes the authentication according to the authentication data. , redirect the client to the service server.

The method disclosed in the present invention is that the authentication server implements the login-free method in the servo group, and the steps include at least: the client transmits the request target to the service server; and the service server connects to the authentication server to query whether the client passes the authentication. When the client fails the authentication, the service server redirects the client to the authentication server; the client transmits the authentication data to the authentication server; the authentication server determines that the client passes the authentication and then redirects to the client according to the authentication data. Connect to the service server; when the client has been authenticated, the service server provides the client with the service corresponding to the request target.

The system and method disclosed in the present invention are as above, and the difference from the prior art is that the present invention connects to the authentication server to query whether the client has passed the authentication when the client is connected to the service server, if , the service server service client, if not, the service server redirects the client to the authentication server to complete the authentication, and the authentication server redirects the client back to the service server, so that the client re-services with the service server. Connected to solve the problems of the prior art, and can achieve the technical effect of improving the efficiency of certification.

The features and embodiments of the present invention will be described in detail below with reference to the drawings and embodiments, which are sufficient to enable those skilled in the art to fully understand the technical means to which the present invention solves the technical problems, and The achievable effects of the present invention.

When the client requests a service from a plurality of different service servers, the service server allows the service server to connect to the authentication server according to the identification data contained in the request transmitted by the client to determine whether the client is already in the authentication server. The login is completed, so that the client only needs to log in when connecting to the first service server, and there is no need to log in to other service servers after being logged in again.

In the following, the system operation of the present invention will be described with reference to the system architecture diagram of the present invention in which the authentication server implements the login-free system in the servo group. As shown in "FIG. 1", the system of the present invention includes a client 110, an authentication server 120, and a service server 130.

The client 110 has identification data. The identification data of the client 110 is data that can identify different clients 110, and is usually arbitrarily arranged by any number of characters, numbers or symbols, including but not limited to the network address of the client 110, and the client 110. The MAC address, the serial number of the client 110, the serial number of the hardware component set in the client 110, the identification code provided by the authentication server 120 to the client 110, the account number of the client 110 logging in to the authentication server 120, and the like.

The client 110 is responsible for transmitting the request target to the service server 130 and is responsible for receiving the service result corresponding to the request target transmitted by the service server 130. In general, the request target transmitted by the client 110 includes the identification data possessed by the client 110 and the path of the target (such as a web page or file, etc.) that the client 110 wants to download.

The client 110 is also responsible for connecting to the authentication server 120 based on the redirect message provided by the service server 130 when redirected to the authentication server 120 by the service server 130, and then transmitting the authentication data to the authentication server 120. Authentication server 120. The authentication data provided by the present invention is data that can identify the user identity of the client 110, including but not limited to an account password, a digital signature, and the like.

In addition, the client 110 is also responsible for re-connecting to the service server 130 according to the redirect message provided by the authentication server 120 when the authenticated server 120 is redirected to the service server 130, and may also transmit the original to the service. The path of the server 130 to be downloaded is transmitted to the service server 130 again to obtain the service of the service server 130.

The authentication server 120 is responsible for receiving the query request transmitted by the service server 130, and determining whether the client 110 passes the authentication according to the received query request. The authentication server 120 is also responsible for generating a corresponding response message according to whether the client 110 passes the authentication result, and transmits the generated response message back to the service server 130 that issues the query request. The response message generated by the authentication server 120 may indicate that the client 110 has passed the authentication or the client 110 has not passed the authentication.

In general, the authentication server 120 may record the identification data of the client 110 in the authentication client list when the client 110 passes the authentication, and after searching for the query request, try to search for the client in the query request in the authentication client list. Identification data of terminal 110. When the authentication server 120 successfully searches the authentication client list for the identification data of the client 110, the authentication server 120 can determine that the client 110 has passed the authentication; and if the authentication server 120 cannot find the client in the authentication client list. The identification information of 110, the authentication server 120 can determine that the client 110 has not passed the authentication. The present invention does not limit the manner in which the authentication server 120 stores the authentication client list. For example, the authentication client list may be recorded in the file by the authentication server 120, or recorded in the memory, or may be authenticated by the server. 120 is recorded in a table in the database.

In addition, the authentication server 120 can search for the identification data of the client 110 from the list of authenticated clients, in addition to searching the identification data of the client 110 in the authentication client list to determine whether the client 110 passes the authentication. Then, whether the client 110 has passed the authentication according to whether the identification data of the client 110 has been recorded in the authentication client list exceeds the expiration date, and whether the identification data of the client is recorded in the authentication client list has exceeded the validity. The deadline is to generate a response message indicating that the client 110 has passed the authentication or failed the authentication. That is, the authentication server 120 may first determine whether the authentication client list includes the identification data of the client 110, and if yes, continue to determine the authentication client list according to the time data corresponding to the identification data of the client 110 in the authentication client list. Whether the identification data of the recorded client 110 exceeds the expiration date, if not, the authentication server 120 may generate a response message indicating that the client 110 has passed the verification, and if the authentication client list does not include the identification information of the client 110, or If the identification data of the client 110 recorded in the authentication client list has exceeded the expiration date, the authentication server 120 may generate a response message indicating that the client 110 has not passed the verification. However, the manner in which the authentication server 120 determines whether the client 110 passes the verification is not limited to the above.

The authentication server 120 is also responsible for redirecting the client 110 back to redirecting the client 110 to the service server 130 of the authentication server 120, causing the client 110 to reconnect with the previously connected service server 130. The authentication server 120 can generate a redirect message and transmit it to the client 110, so that the client 110 reconnects to the original client 110 to transmit the service server 130 of the request target according to the redirect message provided by the authentication server 120.

The service server 130 is responsible for receiving the request target transmitted by the client 110, and when receiving the request target transmitted by the client 110, connects to the authentication server 120 to query whether the client 110 that issued the request target passes the authentication, and receives the request. The response message sent by the authentication server 120. When the response message received by the service server 130 indicates that the client 110 that issued the request target has passed the authentication, the service server 130 can provide the service corresponding to the request target by the client 110 according to the request target issued by the client 110. The service result is returned; when the response message received by the service server 130 indicates that the client 110 that issued the request target fails the authentication, the service server 130 can redirect the client 110 to the authentication server 120 for authentication. The service server 130 can generate a redirect message and transmit it to the client 110, so that the client 110 authenticates the server 120 according to the redirect message provided by the service server 130.

In addition, after the client 110 is redirected to the service server 130 by the authentication server 120, so that the client 110 and the service server 130 are reconnected, the service server 130 can be reconnected to the authentication server 120 to query the authenticated server. The device 120 redirects to whether the client 110 of the service server 130 has passed the authentication.

Next, an operational system and method of the present invention will be described with reference to an embodiment. Referring to FIG. 2, a flow chart of a method for authenticating a server to implement login-free in a servo group is provided. In this embodiment, the client 110 is assumed to be a smart phone, but the present invention is not limited thereto. In the present invention, the client 110 may also be a tablet computer, a notebook computer, or the like.

When the client 110 connects to the service server 130 and issues a request target to request service from the service server 130 (step 210), if the service server 130 belongs to a server in the server group using the present invention, the service The server 130 can be wired to the authentication server 120 to query whether the client 110 has passed the authentication (step 220). In this embodiment, assuming that the identification data of the client 110 is a network address, the service server 130 may obtain the identification data of the client 110 from the packet containing the request target transmitted by the client 110, and generate the client including the client. The query request of the identification data of 110 and the generated query request are transmitted to the authentication server 120. After receiving the query request transmitted by the service server 130, the authentication server 120 may try to search the white list (authenticated client list) managed by the authentication server 120 for the client 110 included in the received query request. Identify the data and generate a corresponding response message based on the search results. If the authentication server 120 successfully searches the whitelist for the identification data of the client 110 included in the query request, the authentication server 120 may generate a response message indicating that the client 110 has passed the authentication; and if the authentication server 120 If the identification data of the client 110 included in the query request cannot be found in the white list, the authentication server 120 may generate a response message indicating that the client 110 has not passed the authentication.

Then, the authentication server 120 can transmit the generated response message to the service server 130 that issues the query request, and the service server 130 can determine, according to the response message sent by the authentication server 120, whether the client 110 that issued the request target passes the authentication. .

If the result queried by the service server 130 indicates that the client 110 that issued the request target has passed the authentication, that is, the response message received by the service server 130 indicates that the client 110 that issued the request target has passed the authentication, the service server 130 may provide a service corresponding to the request target by the client 110 in accordance with the request target issued by the client 110 (step 290).

In this embodiment, if the client 110 is the server group to which the first limited service server 130 belongs, the result queried by the service server 130 will indicate that the client 110 has not passed the authentication, that is, the service server 130. The received response message indicates that the client 110 that issued the request target has not passed the authentication, and the service server 130 can redirect the client 110 to the authentication server 120 (step 240).

When the client 110 is redirected by the service server 130 to the authentication server 120, the client 110 can connect to the authentication server 120 according to the redirect message generated by the service server 130, and simultaneously transmit the client 110 to the service. The path of the target requested by the server 130 is given to the authentication server. After being connected to the client 110, the authentication server 120 can store the path of the target that the client 110 originally transmitted to the service server 130 and transmit the request for providing the authentication data to the client 110. After receiving the request for providing the authentication material transmitted by the authentication server 120, the client 110 may transmit the authentication data to the authentication server 120 (step 250). In this embodiment, it is assumed that the authentication server 120 can transmit a form for inputting an account password to the client 110, and the client 110 can transmit the account password of the user corresponding to the client 110 to the authentication server 120.

After the authentication server 120 receives the authentication data transmitted by the client 110, the authentication server 120 can determine whether the client 110 passes the authentication according to the authentication data received from the client 110 (step 260). In this embodiment, if the authentication data received by the authentication server 120 is an account password, the authentication server 120 can compare the pre-stored account data with the received authentication data, and if the account data does not match the authentication data, The authentication server 120 can determine that the client 110 has not passed the authentication, and the authentication server 120 can request the client 110 that has not passed the authentication to provide the authentication data again, or refuse or interrupt the connection of the client 110 that has not passed the authentication. There is no authenticated client 110 authentication service.

If the account information is consistent with the authentication data, the authentication server 120 can determine that the client 110 passes the authentication, and writes the identification data of the authenticated client 110 into the managed whitelist. In addition, the authentication server 120 can also The authenticated client 110 is redirected to the service server 130 that redirects the client 110 to the authentication server 120 (step 280). In this embodiment, the authentication server 120 may generate a redirect message containing the path of the previously stored target of the client 110 originally requested by the service server 130, and transmit the message to the authenticated client 110 such that the client 110 The redirect message provided by the authentication server 120 is connected to the service server 130 that the client 110 originally transmitted the request target.

While the client 110 is redirected to the service server 130 to connect with the service server 130, the client 110 may also transmit the request target originally transmitted to the service server 130 according to the redirect message provided by the authentication server 120. It is transmitted to the service server 130 again. After the service server 130 is connected to the client 110, that is, after receiving the request target transmitted by the client 110 again, the service server 110 can directly provide the service corresponding to the request target and return the service result (step 290). In this embodiment, it is assumed that the redirect message provided by the authentication server 120 to the client includes a message that the client 110 has passed the authentication, so that the client 110 connects to the service server 130 according to the redirect message provided by the authentication server 120. After that, the service server 130 can obtain the message that the client 110 has passed the authentication, and can provide the service corresponding to the client 110 according to the request target included in the redirect message.

In fact, after receiving the request target transmitted by the client 110 again, the service server 130 may again connect to the authentication server 120 to query whether the client 110 passes the authentication (step 220). In this embodiment, since the client 110 has passed the authentication, the authentication server 120 can query the identification data of the client 110 in the white list, or generate a response message indicating that the client 110 has passed the authentication and return the service. The server 130 causes the service server 130 to determine that the client 110 has passed the authentication and provides a service corresponding to the request target transmitted by the client 110 to the client 110 (step 290).

Thereafter, when the client 110 connects to the service server 131 and issues another request target to request service from the service server 131 (step 210), if the service server 131 and the service server 130 belong to the same server group. After the service server 131 is connected to the authentication server 120 to query whether the client 110 passes the authentication (step 220), the authentication server 120 can query the identification data of the client 110 in the white list, and then authenticate the server. 120 may generate a response message indicating that the client 110 has passed the authentication, and transmit the generated response message back to the service server 130. After receiving the response message indicating that the client 110 has passed the authentication, the service server 130 may provide the service corresponding to the request target transmitted by the client 110 to the client 110 (step 290).

Thus, with the present invention, when the client 110 is connected to a different service server 130/131 in the same server group, only one authentication is required when connecting to the service server 130/131 for the first time, after which Login is no longer required when connecting to different business servers. At the same time, the time and labor costs of developing the login function of the service server 130/131 are also reduced by the present invention. Although the present invention is only authenticated through the easily-identified authentication data of the client 110, it is not as rigorous as the existing single-point login scheme, but when the client 110 requests a specific service from the service server 130/131, the service server 130/131 It is only necessary to search the identification data of the client 110 in the authentication client list (white list) through the authentication server 120, which has higher authentication efficiency than the existing single sign-on solution, and also simplifies the authentication complexity, and operates the client. The user of 110 can obtain the content to be browsed more quickly and conveniently. That is to say, in a service environment that does not require a particularly strict environment, such as an enterprise, the present invention has a better user experience than the existing single sign-on solution.

In the above embodiment, when the service server 130 or the service server 131 is connected to the authentication server 120 to query whether the client 110 passes the authentication (step 220), the authentication server 120 is not included in the identification data of the client 110. In addition to generating a response message indicating that the client 110 has not passed the authentication when recorded in the managed whitelist, if the identification data of the client 110 is recorded in the whitelist managed by the authentication server 120, the authentication server 120 may further It is judged whether the time when the identification data of the client 110 is recorded in the white list has exceeded the expiration date. The authentication server 120 can calculate whether the time difference between the time recorded in the white list and the identification data of the client 110 and the current time exceeds a predetermined value to determine whether the time when the identification data of the client 110 is recorded in the white list has exceeded the effective time. The time limit can also be compared to the current time in the whitelist together with the identification data of the client 110. When the time difference between the time recorded in the white list and the identification data of the client 110 and the current time exceeds a predetermined value or the time in the white list is recorded together with the identification data of the client 110 is earlier than the current time, indicating the client The identification data of 110 is recorded in the white list for more than the expiration date, and the authentication server 120 can generate a response message indicating that the client 110 has not passed the authentication, so that the service server 130/service server 131 can determine that the client 110 is not Passing the authentication; and when the time difference between the time recorded in the white list and the identification data of the client 110 and the current time does not exceed the predetermined value or the time in the white list is recorded together with the identification data of the client 110 is not earlier than the current time The time indicates that the time when the identification data of the client 110 is recorded in the white list has not exceeded the expiration date, and the authentication server 120 can generate a response message indicating that the client 110 has passed the authentication, so that the service server 130/service server 131 can It is judged that the client 110 has passed the authentication.

In summary, it can be seen that the difference between the present invention and the prior art is that when the client connects to the service server, the service server connects to the authentication server to query whether the client has passed the authentication, and if so, the service servo Service client, if not, the service server redirects the client to the authentication server to complete the authentication, and the authentication server redirects the client back to the service server, enabling the client to reconnect with the service server. The method can solve the problem that the development of the single sign-on technology in the prior art has high complexity and large running load, thereby achieving the technical effect of improving the authentication efficiency.

Furthermore, the method for implementing the login-free authentication in the servo group by the authentication server can be implemented in hardware, software or a combination of hardware and software.

While the embodiments of the present invention have been described above, the above description is not intended to limit the scope of the invention. Any modification of the form and details of the practice of the present invention, which is a matter of ordinary skill in the art to which the present invention pertains, is a patent protection of the present invention. range. The scope of the invention is to be determined by the scope of the appended claims.

110‧‧‧Client

120‧‧‧Authentication server

130, 131‧‧‧Business Server

Step 210‧‧‧ The client transmits the request target to the service server

Step 220‧‧‧ The service server is connected to the authentication server to check whether the client is authenticated.

Step 240‧‧‧Business Server Redirects Client Connection to Authentication Server

Step 250‧‧‧ The client transmits the authentication data to the authentication server

Step 260‧‧‧ The authentication server determines whether the client is authenticated based on the authentication data.

Step 280‧‧‧ Authentication server redirects the client to the service server

Step 290‧‧‧ The service server provides the client with the service corresponding to the request target

FIG. 1 is a schematic diagram of a system architecture for implementing an authentication-free server to implement login-free in a servo group according to the present invention. FIG. 2 is a flow chart of a method for implementing an authentication-free server to implement login-free in a servo group according to the present invention.

Claims (10)

A method for implementing login-free authentication in a server group by using an authentication server, the method comprising at least the following steps: a client transmitting a request target to a service server; the service server is connected to an authentication server to query the client Whether the terminal passes the authentication; when the client fails the authentication, the service server redirects the client to the authentication server; the client transmits an authentication data to the authentication server; the authentication server is configured according to the The authentication data determines that the client is redirected to the service server after passing the authentication; and when the client has passed the authentication, the service server provides the service corresponding to the request target of the client. As described in claim 1, the authentication server implements a login-free method in the server group, wherein the service server is connected to an authentication server to query whether the client passes the authentication step, and the authentication is further included. The server generates a corresponding response message according to whether the identification data of the client is recorded in an authentication client list, and transmits the response message to the service server. As described in claim 2, the authentication server implements a login-free method in the server group, wherein the authentication server generates a corresponding one according to whether the identification data of the client is recorded in the authentication client list. The step of responding to the message further includes: after the authentication server determines that the identification data of the client has been recorded in the authentication client list, according to whether the identification data of the client has been recorded in the authentication client list for more than one expiration date Generate this response message. The method for implementing the login-free method in the server group by the authentication server according to the first aspect of the patent application, wherein the method further comprises the step of determining, by the authentication server, the step of authenticating the client according to the authentication data. The authentication server records the identification information of the client in a list of authenticated clients. The method for implementing the login-free method in the server group by the authentication server according to the first aspect of the patent application scope, wherein the method is after the step of redirecting the client to the service server by the authentication server, The step of connecting the service server to the authentication server to query whether the client has passed the authentication is included. A system for implementing a login-free authentication in a server group, the system comprising: at least one client; an authentication server for determining whether the client is authenticated; and a service server for receiving the The client transmits a request target and connects to the authentication server to query whether the client passes the authentication. When the client fails the authentication, the service server redirects the client to the authentication server. The service server provides the service corresponding to the request target of the client when the client has been authenticated; wherein the client is further configured to transmit an authentication data after being redirected to the authentication server To the authentication server, the authentication server determines, according to the authentication data, that the client passes the authentication, and then redirects the client to the service server. As described in claim 6, the authentication server implements a login-free system in the server group, wherein the authentication server determines whether the identification data of the client is recorded in an authentication client list. Whether the client passes the authentication, generates a corresponding response message, and transmits the response message to the service server. As described in claim 7, the authentication server implements a login-free system in the server group, wherein the authentication server is further configured to determine whether the identification data of the client has been recorded in the authentication client list. The validity period is judged whether the client has passed the authentication and the response message is generated. As described in claim 6, the authentication server implements a login-free system in the server group, wherein the authentication server is further configured to record the identification information of the client in an authentication client list. As described in claim 6, the authentication server implements a login-free system in the server group, wherein the service server is further configured to connect the client redirected by the authentication server to the service. After the server, connect to the authentication server again to check whether the client has passed the authentication.