TWI389534B - Single sign-on system and method and computer readable medium thereof - Google Patents

Description

Single sign-on system and method and computer readable media

The present invention relates to a login method, and in particular to a cross-region single sign-on method and system.

Generally, when logging in to different web servers, the user usually has to repeatedly enter a personal account and password to log in. Referring to Figure 1, after logging in to the server of the Taiwanese domain, if the user wants to log in to the server of the mainland domain, the user must log in again. Moreover, the user needs to have an identification code for logging in to the Taiwan domain and an identification code for logging in to the mainland domain. If you do not log in to the mainland domain ID, you will not be able to access the server of the mainland domain.

In other words, in a single sign-on environment for multinational companies, not only does the employee who crosses the company identity have a single identifier, but the employee needs to obtain a single login authorization between different domains to use the resources of different domains. It is quite inconvenient to use.

Therefore, the present invention provides a cross-regional single sign-on method and system, so that a user only needs to authenticate once on a domain authentication server, and can use network resources of different domains.

Based on the above, the embodiment of the present invention discloses a single sign-on method, which is applicable to a single sign-on system, where the single sign-on system includes at least a first verification server and a second verification server, the first verification. The server and the second verification server are respectively connected to the at least one first network server and the second network server, and the first verification server and the first network server belong to a first network The domain, and the second authentication server and the second network server belong to a second network domain.

The single login method includes the following steps: performing a verification operation on a user according to a predefined user authentication data to determine whether the user passes the verification, and when the verification is correct, allowing the user to log in to the first verification server. The device generates a license according to a working phase to determine whether a first link command is received.

When the first link command is received, a link URL parameter is generated, and the login URL parameter is added to the first verification server, and the login URL parameter and the user authentication data are added to the link identifier parameter. The license is transmitted to the first web server to allow the user to log in to the first web server to determine whether a second link command is received.

Receiving the second connection command, transmitting the license to the second network server via the second verification server, and obtaining, by the second network server, the login URL parameter in the license According to the login URL parameter, using the first verification server and verifying the user on the second network server according to the user authentication data included in the license, and when the user is successfully authenticated When the user is allowed to log in to the second web server.

The embodiment of the invention further discloses a single sign-on system, comprising a first verification server, a first network server, a second verification server and a second network server.

The first verification server is configured to perform a verification operation on the user according to a predefined user authentication data to determine whether the user passes the verification, and when the verification is correct, the user is allowed to log in, and according to the work The stage generates a license to determine whether a first link command is received. When the first link command is received, a link URL parameter is generated, and the login URL parameter is added to the first authentication server. And adding the login URL parameter and the user authentication data to the license.

The first network server is coupled to the first authentication server for obtaining the license from the first network server to allow the user to log in.

The second verification server is coupled to the first verification server, and is configured to obtain the license when the first verification server receives a second connection command.

The second network server is coupled to the second verification server, configured to obtain the login URL parameter in the license from the second verification server, and use the first verification server according to the login URL parameter And authenticating the user to the second network server according to the user authentication data included in the license, and allowing the user to log in to the second network server when the user verification succeeds Device.

The first authentication server and the first network server belong to a first network domain, and the second authentication server and the second network server belong to a second network domain.

The embodiment of the invention further discloses a computer readable medium for storing a computer program to be loaded into a computer system and causing the computer system to perform a single login method, which is suitable for a single login system, The single sign-on system includes at least a first verification server and a second verification server, the first verification server and the second verification server respectively and at least a first network server and a second network The server is connected, the first verification server and the first network server belong to a first network domain, and the second verification server and the second network server belong to a second network domain. Includes the following steps: Performing a verification operation on the user according to the predefined user authentication data to determine whether the user passes the verification, and when the verification is correct, the user is allowed to log in to the first verification server, and one session is generated according to a working phase. A license to determine whether a first link command has been received.

When the first link command is received, a link URL parameter is generated, and the login URL parameter is added to the first verification server, and the login URL parameter and the user authentication data are added to the link identifier parameter. The license is transmitted to the first web server to allow the user to log in to the first web server to determine whether a second link command is received.

Receiving the second connection command, transmitting the license to the second network server via the second verification server, and obtaining, by the second network server, the login URL parameter in the license According to the login URL parameter, using the first verification server and verifying the user on the second network server according to the user authentication data included in the license, and when the user is successfully authenticated When the user is allowed to log in to the second web server.

In order to make the objects, features, and advantages of the present invention more comprehensible, the preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. The present specification provides various embodiments to illustrate the technical features of various embodiments of the present invention. The arrangement of the various elements in the embodiments is for illustrative purposes and is not intended to limit the invention. The overlapping portions of the drawings in the embodiments are for the purpose of simplifying the description and are not intended to be related to the different embodiments.

The embodiment of the invention discloses a single login method and system across regions.

The cross-regional single sign-on method and system in the embodiment of the present invention solves the problem of identifying the identity of employees of multinational enterprises, and the problem of synchronizing data with the single-login server of each domain, so that each user only needs to be adjacent You can use resources from different regional domains by logging in once on the domain's domain authentication server.

FIG. 2 is a schematic diagram showing the architecture of a single sign-on system according to an embodiment of the present invention.

The single sign-on system of the embodiment of the present invention includes a first verification server 2100, a second verification server 2200 and a user interface 2300, and the first verification server 2100 and the second verification server 2200 respectively and a plurality of networks. The path servers 2110~2130 and the database 2150 and the plurality of network servers 2210~2230 are connected to the database 2250. The first verification server 2100 and the network server 2110~2130 belong to the first domain (for example, the domain of Taiwan area), and the second verification server 2200 and the network server 2210~2230 belong to the second domain ( For example, the mainland area domain). Be aware that this The single sign-on method and system of the embodiment of the present invention are described by only the authentication server of the two regional domains and the connected network server, but the implementation is not limited thereto, but is based on the business set by the multinational enterprise. Depending on the region.

Integrating a directory service system, for example, a Lightweight Directory Access Protocol (LDAP), an Active Directory (AD), etc., to establish a first domain and a second network The employee of the domain is the database 2150, 2250 of the user's authentication data and authority settings, so that each employee has a single identity code and a single control right to use inter-regional network resources. The above authentication data and authority settings and the system IDs of the network servers 2110~2130 and 2210~2230 are respectively stored in the databases 2150 and 2250 of the first verification server 2100 and the second verification server 2200. in.

At a fixed time, the first verification server 2100 and the second verification server 2200 respectively transmit the employee authentication data and the authority settings in the databases 2150 and 2250 to the other party for the purpose of synchronous update. When a user logs in to the first verification server 2100 through the user interface 2300, the first verification server 2100 verifies the user according to the account and password input by the user and the employee authentication data stored in the database 2150. When the verification is correct, the user is allowed to log in to the first verification server 2100, and a user browsing interface is opened, wherein the same user browsing interface includes a network server corresponding to a different region, such as Taiwan. It includes an employee portal, an employee performance website, and a human recruitment website, and each website is linked to a corresponding web server to perform the functions of the website, and the mainland area also has the website function on the same user browsing interface. Can correspond to the corresponding web server.

A session is established in the system while the user browsing interface is opened. The session is stored in the first authentication server and the client. The session includes user data, such as a user account and password. User authentication data, permission settings, etc. A license is generated according to the working phase, and is stored in the working phase of the user end connecting with the first verification server 2100.

The present invention is applied to a login system of a multinational company, which is a company employee. In other embodiments, for example, when the login network is used for global academic materials or a multinational bank's login network, the identity of the user can be adjusted accordingly.

"Ticket", as the name suggests, is similar to the bus tickets, movie tickets, etc. used in our daily lives. Users must obtain a license through some kind of pipeline (purchase or application), and then they can use this license to enjoy a certain license. Kind of service. Similarly, after the key center establishes the license of the server, the license can be issued to the authenticated client, and the client can use the license to request the server (or authenticate) later.

The "Session Variable" can be used to store and display information held during the user's visit to the website (ie, the work phase). The server creates individual work phase objects for each user and maintains them for a considerable period of time or until the object is explicitly terminated.

If the user wants to enter the employee portal to query the personal information, after clicking the website on the user browsing interface, the web server 2110 is linked to generate a URL address (URL address), for example, Http://portal.via.com.tw? LoginServer=portal.viatech.com, and the login URL parameter of the first authentication server 2100 is added to the link URL parameter to generate a complete URL, as shown in URL 2115 of FIG. Login URL parameters include USER_PW, HR_DEPT, SITE_GROUP, SITE_KEY, PERMISSION, SITE_LOCATION, SITE_SUB_GROUP, SSO_SERVER, IP_RANGE, USER_LOCATION, and so on.

The first verification server 2100 generates a session ID (Session ID) corresponding to the user data, and the work phase identification code, a plurality of system identification codes corresponding to all accessible network servers, and a pair The User ID of the user profile should be added to the user's license, and the login URL parameter will not be added to the license. The first authentication server 2100 encrypts the license in accordance with a network key instead of using the system identification code and transmits it to the network server 2110 for verification. After receiving the encrypted license, the network server 2110 decrypts the license, and judges whether the verification is passed according to the information contained in the license, that is, whether the work phase identification code, the system identification code, and the user identification code are determined. Correct, and allow the user to enter the web server 2110 after successful verification.

When the user wants to use the employee performance website in the mainland, in the past, the verification server in the mainland, such as the second verification server 2200, will definitely ask the user to re-enter the account and password to re-verify the user. Appropriate identity, but in the present invention, the user only needs to click the website on the same user browsing interface without re-entering the account and password. Although it is still unable to enter the web server 2220, it can be directly linked to the web server 2220 to generate another link URL parameter, such as http://portal.via.com.cn? LoginServer=portal.viatech.com, and at the same time, the web server 2220 receives the license of the client memory and the login URL parameter of the first authentication server 2100 transmitted by the client. It should be noted that since the system identifier system ID stored in the license after the first phase verification pass contains all the access rights of the user, it is not necessary to connect to his domain. Still need to increase.

The present invention provides two cross-region verification methods. A network server 2220 finds the first verification server 2100 across the area according to the received login URL parameter and transmits the license to the first verification server 2100. The first verification server 2100 encrypts the license in accordance with the encryption key corresponding to the web server 2220 and transmits it back to the web server 2220. When the network server 2220 receives the encrypted license, the license is decrypted, and it is determined whether the verification by the first verification server 2100 is previously performed according to the work phase identification code included in the decrypted license, and is verified. After successful, the user is directly allowed to enter the web server 2220 to query or update the data.

The cross-region verification method provided by the present invention is to transmit the license and the login URL parameter to the second verification server 2200 in the same area by the network server 2220, and the second verification server 2200 will perform the login according to the login. The URL parameter indicates that the user has been verified by the first verification server 2100, and then the second verification server 2200 directly transmits the license to the first verification server 2100 to confirm whether the user has verified the pass, A verification server 2100 will respond to the network after receiving the license. The encryption key of the device 2220 encrypts the license and sends it back to the web server 2220, and after subsequent decryption and verification, the user is allowed to enter the web server 2220 without having to enter the employee account and password again. . Similarly, when logging in to a web server in another regional domain, the user is authenticated in the same way.

When the user closes or logs out the user browsing interface, the working phase stored in the first authentication server and the client is eliminated, and then the user wants to log in to the first authentication server and then restarts the user. Re-enter the employee account and password when browsing the interface.

FIG. 3 is a flow chart showing the steps of the single sign-on method according to the embodiment of the present invention. Please refer to the system architecture diagram of FIG. 2 at the same time.

At a fixed time, the first verification server and the second verification server respectively transmit the employee authentication data and the authority settings to which they belong (step S301). The user input data is obtained by the first verification server (step S302), and a verification operation is performed on a user according to the user authentication data, and it is determined whether the user passes the verification (step S303). When the verification is correct, the user is allowed to log in to the first verification server, and a working phase is generated when the user browsing interface is opened (step S304), and then a license is generated according to the working phase, wherein the license is not stored. In a database (step S305).

It is determined whether a first link command is received (step S306). For example, the user selects the first network server through a user interface. When the first link command is received, a link URL parameter is generated, and the login URL parameter of the first verification server is added to the link URL parameter (such as FIG. 2 The URL 2115 is shown) (step S307). Generating, by the first verification server, a work phase identification code corresponding to the user data (step S308), and the work phase identification code, a pair of first system identifiers of the first network server, and a A user ID corresponding to the user profile is added to the license (step S309). The license is encrypted according to a network key and transmitted to the first web server (step S310).

Upon receiving the license, the license is decrypted by the first network server based on the first system identifier, and the user is authenticated based on the information contained in the license (step S311). It is judged whether the user has passed the verification (step S312), and the user is allowed to log in after the verification is successful (step S313). It is determined whether a second link command is received (step S314). For example, the user selects the second network server through the user interface. Receiving the second link command, by the first verification server, adding a second system identifier of a pair of second network servers to the license, and according to the second system identifier After encrypting the license, the license is transmitted to the second network server via the second verification server (step S315). When the license is received, the license is decrypted by the second network server according to the second system identifier to obtain the login URL parameter included therein (step S316). According to the login URL parameter, the first verification server is used to verify the user on the second network server according to the information contained in the license (step S317). It is judged whether the user has passed the verification (step S318), and the user is allowed to log in after the verification is successful (step S319). At this time, the first The link URL parameter of the second web server is displayed as shown in the URL 2225 of FIG.

The cross-regional single sign-on method and system in the embodiment of the present invention utilizes the three principles of active dissemination, common comparison and point concentration, so that the authentication servers of different domains can have the latest and most neat authentication comparison data in time. . In addition, using the Global Resource Locator (URL) technology, users with a single domain authentication can use the server's cross-checking comparison mechanism, and can use different domains without repeating the login authentication step. Resources, as shown in Figure 2.

The present invention further provides a recording medium, such as a disc, a floppy disk, a removable hard disk, etc., which records a computer readable license signing program to perform the above-described cross-region single sign-on method. Here, the permission signing program stored on the recording medium is basically composed of a plurality of code segments, such as creating an organization chart code segment, signing a form code segment, setting a code segment, and deploying a program. Code segments, and the functions of these code segments correspond to the steps of the above method and the functional block diagram of the above system.

While the present invention has been described above by way of a preferred embodiment, it is not intended to limit the invention, and the present invention may be modified and modified without departing from the spirit and scope of the invention. The scope of protection is subject to the definition of the scope of the patent application.

2100‧‧‧First authentication server

2110..2130‧‧‧Web server

2115‧‧‧ Website

2150‧‧‧Database

2200‧‧‧Second verification servo

2210..2230‧‧‧Web server

2225‧‧‧ Website

2250‧‧‧Database

2300‧‧‧User interface

Figure 1 shows a schematic diagram of a user logging into a different web server.

Figure 2 is a block diagram showing the architecture of the single sign-on system of the embodiment of the present invention. intention.

Figure 3 is a flow chart showing the steps of the single sign-on method of the embodiment of the present invention.

2100. . . First verification server

2110..2130. . . Web server

2115. . . URL

2150. . . database

2200. . . Second verification servo

2210..2230. . . Web server

2225. . . URL

2250. . . database

2300. . . user interface

Claims (27)

A single sign-on method, which is applicable to a single sign-on system, wherein the single sign-on system includes at least a first verification server and a second verification server, and the first verification server and the second verification server respectively and at least a first network server is connected to a second network server, the first authentication server and the first network server belong to a first network domain, and the second authentication server and the second The second network server belongs to a second network domain, and includes the following steps: performing a verification operation on a user according to one of the predefined user authentication data to determine whether the user passes the verification; when the verification is correct, the permission is allowed. The user logs in to the first verification server; generates a license according to a working phase; determines whether a first link command is received; and when the first link command is received, generates a link URL parameter, and The link URL parameter is added to one of the first authentication server login URL parameters; the login URL parameter and the user authentication data are added to the license and transmitted to the first network The server is configured to allow the user to log in to the first network server; determine whether a second link command is received; and when the second link command is received, transmit the license to the second authentication server a second network server; obtaining, by the second network server, the login URL parameter in the license; Determining the user on the second network server according to the login URL parameter, using the first authentication server and according to the user authentication data included in the license; and when the user verification succeeds , the user is allowed to log in to the second web server. The single sign-on method as described in claim 1, further comprising generating the working phase when a user browsing interface is opened. The single sign-on method of claim 2, further comprising the step of: generating a corresponding user input data by the first verification server after adding the login URL parameter to the link URL parameter a work phase identification code; and adding the work phase identification code, a pair of first system identifiers that should be the first network server, a pair of user identification codes that should be user data, and the login URL parameter to the license In the card. The single sign-on method of claim 3, further comprising encrypting the license according to the first system identifier and transmitting to the first network server. The single sign-on method of claim 4, further comprising the steps of: decrypting the license by the first network server and according to the first system identifier when receiving the license; Verifying the user based on the user authentication data included in the license to determine whether the user has passed verification; The user is allowed to log in to the first web server after the verification is successful. The single sign-on method according to claim 5, further comprising the step of: when receiving the second link command, by the first verification server, one of the pair of second network servers a second system identification code is added to the license; and the license is transmitted to the second network server via the second verification server. The single sign-on method of claim 6, further comprising: when the license is received, decrypting the license by the second network server according to the second system identifier to obtain The login URL parameter included in it. The single sign-on method of claim 1, further comprising: the first verification server and the second verification server respectively transmitting the user authentication data and permission settings to which the user belongs to the second verification server at a fixed time. other side. The single sign-on method as described in claim 1, wherein the license is not stored in a database. A single sign-on system, comprising: a first verification server, configured to perform a verification operation on the user according to a predefined user authentication data to determine whether the user passes the verification, and when the verification is correct, Allowing the user to log in, and generating a license according to a working phase, determining whether a first link command is received, and when receiving the first link command, generating a link URL parameter, Adding a login URL parameter of the first authentication server to the link URL parameter, and adding the login URL parameter and the user authentication data to the license; a first network server coupled to the first a verification server for obtaining the license from the first network server to allow the user to log in; a second verification server coupled to the first verification server for using the first The verification server obtains the license when receiving a second connection command; and a second network server coupled to the second verification server for obtaining the license from the second verification server The login URL parameter, according to the login URL parameter, using the first verification server and verifying the user on the second network server according to the user authentication data included in the license, and when When the user verification is successful, the user is allowed to log in to the second network server; wherein the first verification server and the first network server belong to a first network domain, and the second verification Server and The second part of a second network server-based domain. The single sign-on system of claim 10, wherein the first verification server generates the session when a user browsing interface is turned on. The single sign-on system of claim 11, wherein, after the login URL parameter is added to the link URL parameter, the first verification server generates a work phase corresponding to a user input data. The code is added, and the work session identifier, a pair of first system identifiers that should be the first network server, a pair of user identifiers that should be user data, and the login URL parameters are added to the license. The single sign-on system of claim 12, wherein the first verification server encrypts the license according to the first system identifier and transmits the license to the first network server. The single sign-on system of claim 13, wherein, upon receiving the license, the first network server decrypts the license according to the first system identifier, according to the license The user authentication data authenticates the user to determine whether the user has passed the verification and allows the user to log in after the verification is successful. The single sign-on system of claim 14, wherein, when the second link command is received, the first verification server adds a pair of second system identifiers corresponding to one of the second network servers Going to the license and transmitting the license to the second web server via the second authentication server. The single sign-on system of claim 15, wherein when the license is received, the second network server decrypts the license according to the second system identifier to obtain the included The login URL parameter. The single sign-on system of claim 10, wherein the first verification server and the second verification server respectively transmit the user authentication data and permission settings to which the user belongs to each other at a fixed time. . The single sign-on system of claim 10, wherein the license is not stored in a database. A computer readable medium for storing a computer program for loading into a computer system and causing the computer system to perform a single sign-on method, which is applicable to a single sign-on system, wherein the single sign-on system includes at least a first a verification server and a second verification server, wherein the first verification server and the second verification server are respectively connected to the at least one first network server and a second network server, the first verification server And the first network server belongs to a first network domain, and the second authentication server and the second network server belong to a second network domain, and the following steps are included: according to a predefined user The authentication data performs a verification operation on the user to determine whether the user passes the verification; when the verification is correct, the user is allowed to log in to the first verification server; a license is generated according to a working phase; a first link command; when receiving the first link command, generating a link URL parameter, and adding the first URL to the first authentication server Login URL parameter; adding the login URL parameter and the user authentication data to the first network server to allow the user to log in to the first network server; determining whether a first network server is received a second connection command; when the second connection command is received, the license is transmitted to the second network server via the second verification server; Obtaining, by the second network server, the login URL parameter in the license; using the first verification server according to the login URL parameter, and according to the user authentication data included in the license, The second network server authenticates the user; and when the user authentication is successful, the user is allowed to log in to the second network server. The computer readable medium of claim 19, further comprising generating the working phase when a user browsing interface is opened. The computer readable medium of claim 20, further comprising the step of: generating a corresponding user input data by the first verification server after adding the login URL parameter to the link URL parameter a work phase identification code; and adding the work phase identification code, a pair of first system identifiers that should be the first network server, a pair of user identification codes that should be user data, and the login URL parameter to In the license. The computer readable medium of claim 21, further comprising encrypting the license according to the first system identification code and transmitting to the first network server. The computer readable medium of claim 22, further comprising the steps of: when the license is received, the license is obtained by the first network server and according to the first system identifier Decrypt The user is authenticated according to the user authentication data included in the license to determine whether the user passes the verification; and the user is allowed to log in to the first network server after the verification is successful. The computer readable medium of claim 23, further comprising the steps of: when receiving the second connection command, by using the first verification server, the pair of second network servers One of the second system identification codes is added to the license; and the license is transmitted to the second network server via the second verification server. The computer readable medium of claim 24, further comprising: decrypting the license by the second network server and according to the second system identifier when the license is received, To get the login URL parameters included in it. The computer readable medium according to claim 19, further comprising the first authentication server and the second verification server respectively setting the user authentication data and authority to which the second authentication server belongs. Transfer to the other party. The computer readable medium of claim 19, wherein the license is not stored in a database.