TWI527419B - Method and System of Integrating Backend Service Authentication with Proxy Servo - Google Patents

Description

Method and system for proxy server integration backend service authentication

The present invention relates to a method and system for service authentication, and in particular to a method and system for proxy server integration backend service authentication.

After the popularization of electronic services, organizations often establish a variety of application systems. Each application system has its own identity verification mechanism, which makes it necessary to continuously perform identity verification when using different application systems. The repetitive login procedure is very troublesome. Therefore, the concept of Single Sign On (SSO) is born. Through the centralized management of the identity verification mechanism, the terminal device can log in and use the integrated application system with one identity verification. Repeated login can greatly improve the convenience of the application system. However, the essence of a single check-in is to assist the user to perform account password management for multiple application systems. The method is to pre-record the account password of the application system through a single check-in system, such as a single login management method and system (Taiwan Public No. :201209625), the method is to pre-edit the login URL of each application system and the login authentication information data of the website by a single check-in system, and generate a shortcut key associated with the authentication information data on the user interface of the user end, and use The user only needs to trigger the shortcut key, and the single check-in system can automatically provide the user to automatically log in to the application system according to the application login URL associated with the shortcut key and the login authentication information of the website. However, this method must be performed only when the user has obtained the password of the application system account, and the single sign-in system must also log the user account to the account password of the application system. Recorded in this single check-in system.

Installing the account password management program on the user terminal device is also a common method for simplifying user identity verification, such as a system and method for managing website login information (Taiwan Patent Publication No.: 567427), and installing an application on the user side. The application can store the login information of the user's login website. When the user wants to connect to the website, the application can automatically log in to the website through the stored login information. However, the disadvantage of this method is that the application must be installed on the user side. When the user terminal device is upgraded or replaced, the application must be reinstalled. Moreover, this method lacks the role permission control, and the application only stores the management user login. Information, and provide quick access to the website function, but can not provide different permissions to log in to the website for different users to further manage.

In addition, the current use of the service agent system to simplify the method of identity verification, such as the path mapping integrated network service agent system (Taiwan Patent Bulletin No.: I271973), the service agent system provides a single entry to the external service, and according to a pre-defined form Define the relationship between the path and the resource (URL) in the form. When the user terminal requests the service, the service agent system will provide the service request to the backend resource according to the definition of the form. After obtaining the content of the response, The content is then delivered to the user. This method mainly achieves the purpose of integration service and identity verification through the management of the network working state (Session). The service agent system establishes a session with the back-end resource, and the service agent system also establishes a session with the user end, through two The session inter-related connection achieves the purpose of identity certification, but the service agent system can establish a session with the back-end resources based on the connection from the back-end resources to trust the connection from the service proxy system. Otherwise, the client must pass the service proxy system to the back-end. The application system is then certified.

In summary, the account password of the application system is recorded in advance through a single check-in system, and the user must obtain the password of the application system account; the account password management process is installed on the user terminal device. In the case of the application, the application must be installed on the user side, and the role permission control is lacking; the current service agent system uses the path mapping integration website to complete the agent identity verification, and the technology of the authentication process is achieved through the session management, and Must be based on the connection of the backend resource trust from the service proxy system.

In view of the many shortcomings of the above-mentioned old and well-known technologies, Nai Si has made improvements and innovations, and based on the understanding of the evolution of information systems, after careful data research, evaluation considerations, test verification and improvement, the invention has finally been successfully developed. Method and system for proxy server integration for back-end service authentication."

The object of the present invention is to provide a method and system for proxy server integrated backend service authentication, which provides a terminal device to automatically log in to an application system through a proxy servo system, so that the terminal device is authenticated by the proxy server of the present invention. After the system is authenticated, the application system can be connected and the login status can be maintained, and the terminal device does not need to perform additional account password login verification, and the account password of the application system is not required.

According to an aspect of the present invention, a system for proxy-based integrated back-end service authentication is provided for providing a terminal device to automatically log in to an application system, which includes a mapping and forwarding management module, an account mapping management module, An application system login URL management module, an automatic login module, and a filter packaging module; wherein the mapping forwarding management module is configured to manage a mapping address data and store the data in a mapping address database; The account mapping management module is configured to manage account password data and role rights of the terminal device to log in to the application system, and store the information in a website and account mapping database; the application system login URL management module is used to manage An application system login URL is stored in the website and the account mapping database; the automatic login module is used to authenticate the terminal device, and the terminal device is authenticated to log in and connect to the application system; the filter packaging module Used to receive the terminal device requesting connection through a communication protocol The system requests the message by one of the systems, and reads the mapping address database data according to the request message and calls the automatic login module for processing, and returns the processing result of the request message to the terminal device.

A system for proxy-based integrated back-end service authentication according to the present invention is configured to receive, by the filter packaging module, the terminal device to request a message requested by one of the application systems through a communication protocol, and filter and classify according to the request message. Processing; when the filter package module receives the request message with a device authentication certificate, and calls the automatic login module to authenticate and log in to the application system, the automatic login module will authenticate the terminal device and the application system. The account and the account mapping database read the account password data of the terminal device login to the application system, and the terminal device is connected to the application system for authentication. If the authentication is passed, the automatic login module obtains the application system. Returning one of the application system authentication credentials, the application packaging system certificate is returned to the terminal device by the filter packaging module, and if the authentication fails, an authentication failure message is generated, and the filtering and packaging module returns the authentication failure message to the terminal. Device; when the filter package module receives the request message with the application system authentication And querying the mapping address database data according to the request message to obtain the actual website address of the application system to be connected to the terminal device, and connecting the terminal device to the application system; when the filter packaging module receives When the request message does not have the device authentication certificate and the application system authentication certificate, the automatic login module is called to perform terminal device authentication, and if the authentication is passed, the device authentication certificate is generated, and the device is authenticated by the filter packaging module. And transmitting the terminal device, if the authentication fails, generating an authentication failure message, and the filtering and packaging module returns the authentication failure message to the terminal device.

A method for proxy back-end service authentication by proxy servo according to one aspect of the present invention, wherein the proxy servo system receives the request by the terminal device to connect to the application system through a communication protocol; when the request is The message carries a device authentication certificate, and the proxy servo system Representing the terminal device to perform authentication with the application system, and returning the authentication to the terminal device by using one of the obtained application system authentication credentials, wherein the terminal device logs in the account password data of the application system, and the login URL of the application system is The server is stored in a website and an account mapping database. When the request message does not have the device authentication certificate, the agent server performs the terminal device authentication. After the authentication is passed, the device authentication certificate is generated and the terminal device is returned.

Wherein, when the request message carries a device authentication credential, the proxy server system authenticates the terminal device with the application system, and the step of returning the authentication through the obtained application system authentication credential to the terminal device is changed to: The application system that the terminal device requests to connect, the proxy servo system reads the mapping address data of the application system in the mapping address database; the proxy servo system reads the application in the website and the account mapping database a system login URL; if the mapped mapping information of the application system is the application login URL, the proxy server authenticates the terminal device and the application system, and authenticates the obtained application system authentication The voucher returns the terminal device; if the mapped mapping information of the application system is not the login URL of the application system, the proxy servo system forwards the terminal device to the application system URL through a communication protocol. The application system mapping forwarding data is stored in a mapping address database.

The method and system for proxy-server integrated back-end service authentication provided by the present invention have the following advantages compared with the current method and system:

1. The present invention does not require an application to be installed in a terminal device, and the terminal device can easily achieve the purpose of integrated authentication through the connection application system of the present invention.

2. The present invention uniformly manages the account password of each terminal device using the application system The code terminal device does not need to obtain the application system account password. The present invention can quickly package the new application system as part of the overall service for the service provider.

3. The present invention can be used to set the terminal device to use the application system according to the role, which is very flexible. For example, according to the attribute value of the terminal device account, the logical relationship corresponds to the role permission of the application system, so that multiple accounts of the same nature terminal device can use the same account of the application system. For the application system operation, each terminal device account has a dedicated application system account, but has the same application system role rights.

100‧‧‧ Terminal devices

200‧‧‧Agent Servo Integrated Backend Service Certification System

210‧‧‧Filter packaging module

220‧‧‧Automatic login module

230‧‧‧Map Transfer Management Module

240‧‧‧ account mapping management module

250‧‧‧Application Login URL Management Module

260‧‧‧Map Transfer Database

270‧‧‧Website and account mapping database

300‧‧‧Application System

S401~S413‧‧‧Procedures for the method of proxy servo integration back-end service authentication

Schematic diagram of application system certification for S501~S507‧‧‧ proxy servo integration back-end service authentication method

FIG. 1 is a system architecture diagram of a proxy servo integration backend service authentication according to the present invention.

2 is a flow chart showing the steps of a method for proxy server integration backend service authentication according to the present invention.

FIG. 3 is a schematic diagram of a method for applying system authentication by means of proxy servo integration backend service authentication according to the present invention.

The object of the present invention is to provide a method and system for proxy server integrated backend service authentication, which is used to provide a terminal device to automatically log in to an application system, so that the terminal device is authenticated by the proxy servo integrated backend service authentication system of the present invention. The application system can be connected, and the login status can be maintained, and the terminal device does not need to perform additional account password login verification, and the account password of the application system is not required.

An embodiment of the present invention can be referred to the system architecture diagram of FIG. 1. The purpose of the present invention is to provide a system 200 for proxy server integration backend service authentication, which includes a filter package module 210 and an automatic login module 220. , a mapping and forwarding management module 230, an account mapping management module 240, and an application system login URL management module 250; wherein the mapping and forwarding management module 230 is configured to manage a mapping address data and store The mapping mapping database 260 is configured to manage the account password data of the terminal device 100, the account password data and the role permission of the terminal device 100 to log in to the application system 300, and store the same in a a website and account mapping database 270; the application system login website management module 250 is configured to manage an application system login URL and stored in the website and account mapping database 270; the automatic login module 220 is configured to authenticate the The terminal device 100 provides the terminal device 100 for authenticating the login and connection to the application system 300. The filter package module 210 is configured to receive the request message from the terminal device 100 via the communication protocol to connect the application system 300. The request message reads the mapping address database 260 data and calls the automatic login module 220, and returns the request response result to the terminal device 100; wherein, the communication protocol Can be a HTTP (Hyper Text Transfer Protocol, HTTP), secure hypertext transfer protocol (Hyper Text Transfer Protocol Security, HTTPS) or Internet Protocol.

The filter package module 210 includes a request message classification processing unit and a request message result response unit, which are respectively described as follows:

1. The request message classification processing unit is configured to filter the classification according to the request message and process the following: the request message classification processing unit receives the request message with a device authentication certificate, and then calls the automatic login module 220 to perform authentication and login. The application system 300; the request message classification processing unit receives the application message with an application system authentication certificate, queries the mapping address database data 260 according to the request message, and forwards the connection to the application system 300; the request message classification When the request message received by the processing unit does not carry the device authentication certificate and the application system authentication certificate, the automatic login module 220 is called to perform terminal device 100 authentication.

The request message result response unit is configured to package the processing result of the request message into the response result message and send the message back to the terminal device 100, where the response result message may be a device authentication certificate, an application system authentication certificate, a connection application system. Message or error message.

The automatic login module 220 includes a device authentication unit and an application system authentication login unit, which are respectively described as follows:

1. Device authentication unit: for authenticating the terminal device 100, which outputs a device authentication screen to provide the terminal device for identity verification, and generates device authentication credentials after the terminal device passes the authentication, and the filter package module 210 The device authentication certificate is transmitted back to the terminal device 100.

2. The application system authentication login unit is configured to authenticate the terminal device 100 and the application system 300, and the application system authentication login unit reads the terminal device 100 and logs into the application system 300 at the website and the account mapping database 270. The account password data is connected to the application system 300 for authentication. The application system authentication login unit obtains the application system authentication certificate after the terminal device 100 authenticates the application system 300, and the application package system is authenticated by the filter package module 210. The certificate is returned to the terminal device 100.

The mapping and forwarding management module 230 outputs a mapping and forwarding management screen, and adds, modifies, and deletes the mapping and forwarding data of the application system 300, and stores the mapping information in the mapping and forwarding database 260.

The account mapping management module 240 outputs an application system account mapping management screen, and provides, adds, and deletes the role permission and account password information of the terminal device 100 to log in to the application system 300, and stores the password information in the website. And the account mapping database 270; wherein the account mapping management module 240 provides a correspondence between the role rights of the terminal device 100 to log in to the application system 300 according to the account attribute value of the terminal device 100, so that different terminal devices are enabled. If the terminal device account attribute values are logically the same, they have the same role rights.

The application login URL management module 250 outputs an application login URL management screen, and provides the addition, modification, and deletion of the application login URL, and stores the URL and the account mapping database 270.

The method for proxy server integrated backend service authentication provided by the present invention provides a terminal device to automatically log in to an application system through a proxy servo system. The flow chart of the steps can be referred to FIG. 2, and the steps are as follows: Receiving, by the system, the terminal device, by using a communication protocol, to request a request message S401 of the application system; the agent servo system checks whether the request message carries a device authentication certificate S402, and when the request message has a device authentication certificate, the proxy server system And the terminal device is authenticated by the application system, wherein the terminal device logs in the account password data of the application system, and the login URL of the application system is stored in a website and an account mapping database; when the request message is not There is the device authentication certificate, and the agent servo system performs the terminal device authentication S412.

Wherein, when the request message carries the device authentication certificate, the proxy server system performs the authentication of the terminal device and the application system as follows: for the application system that the terminal device requests to connect, the proxy server system is configured to The mapping address database reads the mapping data S403 of the application system, if the mapping address database does not have the mapping address data of the application system, the proxy servo system returns an error message to the terminal device S404; The proxy server reads the application login URL in the website and the account mapping database, and checks whether the mapping address information is the application login URL S405; when the mapped mapping information of the application system is read Logging in to the application system, and reading the role permission and account password data S406 of the terminal device to log in to the application system in the website and the account mapping database, if the website and the account mapping database do not have corresponding application systems Role permissions and account passwords The agent servo system returns an error message to the terminal device S404; if the URL and the account mapping data inventory are in the corresponding application system role rights and account password data, the proxy server system connects the application system and The authentication is performed by the terminal device logging in the account password data of the application system. If the authentication is passed, the application system authentication certificate is generated. If the authentication fails, an authentication failure message S408 is generated; when the mapping of the application system is read. If the data is not the application login URL, the proxy server relays the terminal device to the application system URL S410 through a communication protocol.

The invention provides a method for proxy back-end service authentication by proxy servo. The schematic diagram of the application system authentication case can be referred to FIG. 3, and the following is as follows: S501: The proxy servo system RP receives the terminal device Client1 and logs in through the HTTPS protocol. The proxy server RP verifies that the terminal device Client1 passes the identity authentication. The URL of the proxy server system RP is www.rp.com.tw , and the account attribute value of the terminal device Client1 is | (uid=CHT) (&(role=ABC) (!group=XYZ))), the account attribute value logic rule is that the account identification code is not CHT, or the account role identification code is equal to ABC and the group identification code is not XYZ; S502: the proxy servo system RP receives the terminal device Client1 requests to connect to the application system AP1 by using the HTTPS protocol, wherein the request message is www.abc.com.tw/AP1/login.html? sessionId=F0EA68BD83969B858F6F292159BE48D7 , including the device authentication certificate sessionId=F0EA68BD83969B858F6F292159BE48D7 and the URI of the connection application system is /AP1 ; S503: the proxy servo system RP obtains the mapping address data of the application system AP1 in the mapping address database as http://10.0. 0.101/theAP1/login.htm ; S504: The proxy server system RP obtains the application login URL of the website and the account mapping database as http://10.0.0.101/theAP1/login.do; S505: the proxy servo system RP depends on the terminal The account attribute value of the device Client1 is obtained by the website and the account mapping database, and the account password of the terminal device login application system AP1 is xxx/yyy; S506: the proxy server system RP is connected with the account password xxx/yyy of the client terminal device Client1. The application system AP1 performs login verification; S507: the proxy servo system RP successfully logs in to the application system AP1 and obtains the application system authentication credential, and the proxy servo system RP returns the application system authentication credential to the terminal device Client1.

The detailed description of the present invention is intended to be illustrative of a preferred embodiment of the invention, and is not intended to limit the scope of the invention. The patent scope of this case.

To sum up, this case is not only innovative in terms of technical thinking, but also has many of the above-mentioned functions that are not in the traditional methods of the past. It has fully complied with the statutory invention patent requirements of novelty and progressiveness, and applied for it according to law. Approved this invention patent application, in order to invent invention, to the sense of virtue.

100‧‧‧ Terminal devices

200‧‧‧Agent Servo Integrated Backend Service Certification System

210‧‧‧Filter packaging module

220‧‧‧Automatic login module

230‧‧‧Map Transfer Management Module

240‧‧‧ account mapping management module

250‧‧‧Application Login URL Management Module

260‧‧‧Map Transfer Database

270‧‧‧Website and account mapping database

300‧‧‧Application System

Claims (14)

A system for proxy server integration backend service authentication, comprising: a mapping and forwarding management module, configured to manage a mapping and forwarding data, and stored in a mapping and forwarding database; an account mapping management module, To manage the role rights and account password information of a terminal device to log into an application system, and store it in a website and account mapping database; an application system login URL management module for managing an application system login URL and storing The website and the account mapping database; an automatic login module for authenticating the terminal device, and reading the application login URL and the account password information of the application system on the website and the account mapping database to Providing the terminal device to authenticate login and connecting the application system; and a filter packaging module for receiving the terminal device to request to connect the application system through one of an HTTP protocol, an HTTPS protocol, or an internet protocol One of the request messages, and according to the request message, the mapping address database data is read and the automatic login module is called, and the request response is terminated. Returning the terminal device, the filter package module includes: a request message classification processing unit, configured to filter and classify according to the request message, and the request message classification processing unit receives the request message with a device The authentication credential is called to the automatic login module for authentication and login to the application system. If the request message does not have the device authentication credential, the automatic login module is called to perform terminal device authentication; and a request message result response unit is provided. And the method for packaging the processing result of the request message is sent back to the terminal device. For example, the system for proxy server integrated backend service authentication according to the first aspect of the patent application scope, wherein the mapping and forwarding management module outputs a mapping and forwarding management screen to provide new, modified, and deleted mapping address data. And stored in the map forwarding database. For example, the system for proxy-based integrated back-end service authentication described in the first application of the patent scope, wherein the account mapping management module outputs an application system account mapping management screen, and provides, adds, deletes, and deletes the terminal device. Log in to the application's role permissions and account password data, and store it in the URL and account mapping database. For example, the system for proxy server integrated back-end service authentication according to item 3 of the patent application scope, wherein the account mapping management module provides a correspondence corresponding to the role attribute of the terminal device to log in to the application system according to the account attribute value of the terminal device. relationship. The system of proxy server integrated back-end service authentication, as described in claim 1, wherein the application system login URL management module outputs an application system login URL management screen to provide new, modified, and deleted application systems. Login to the URL and save it in the URL and account mapping database. The system for proxy-integrated back-end service authentication, as described in claim 1, wherein the automatic login module comprises: a device authentication unit for authenticating the terminal device, and generating a device authentication after the authentication is passed a certificate, the device authentication certificate is returned to the terminal device by the filter packaging module; and an application system authentication login unit is configured to proxy the terminal device to perform authentication with the application system, and proxy the terminal device to pass the application system Obtain an application system authentication certificate after authentication, and the application is applied by the filter packaging module The system authentication certificate is returned to the terminal device. The system for proxy-integrated back-end service authentication, as described in claim 6, wherein the device authentication unit calls the automatic login module to perform terminal device authentication according to the request message, and the device The authentication unit outputs a device authentication screen to provide the terminal device for authentication. If the terminal device passes the authentication, the device authentication unit generates the device authentication certificate, and if the authentication fails, the device authentication unit generates an authentication failure message. The system for proxy-based integrated back-end service authentication, as described in claim 6, wherein the application authentication login unit calls the automatic login module to authenticate the login application module according to the request message. And the application authentication login unit reads the role permission and the account password data of the terminal device to log in to the application system at the website and the account mapping database, and connects the application system for authentication, and if the authentication passes, the automatic login is performed. The module obtains the application system authentication certificate returned by the application system. The system for proxy-integrated back-end service authentication, as described in claim 1, wherein the device authentication certificate is that the automatic login module authenticates the authentication credential generated by the terminal device. The system for proxy-integrated back-end service authentication, as described in claim 1, wherein the application system authentication certificate is an authentication credential generated by the application system through the terminal device. A method for proxy-integrated back-end service authentication is to provide a terminal device to automatically log in to an application system through a proxy servo system, the method comprising the steps of: the proxy servo system receiving the terminal device requesting connection through a communication protocol One of the application systems requests a message; a request message classification processing unit set by a filter package module of the proxy servo system confirms that the received request message carries a device authentication credential, and the proxy servo system performs a mapping on the map. The database reads the mapping address data of the application system, and the proxy server reads the application login URL in the website and the account mapping database, and if the read mapping information of the application system is read, The application server login URL, the proxy server system authenticates the terminal device and the application system, and the request message response unit provided by the filter packaging module is configured to package the processing result of the request message as the response result. The message is returned to the terminal device, where the response result message may be a device authentication credential, an application system authentication credential, a connection application system message or an error message, and the authentication is returned to the terminal device by using the obtained application system authentication credential. If the mapped mapping information of the application system is not the login URL of the application, the generation The servo system forwards the terminal device to the application system web address through a communication protocol, wherein the terminal device logs in the account password data of the application system, and the login URL of the application system is stored in a website address and account mapping database. When the request message does not carry the device authentication certificate, the agent servo system performs the terminal device authentication, and after the authentication is passed, the agent servo system generates the device authentication certificate and returns the terminal device. A method for proxying a backend service authentication by proxy server according to claim 11, wherein the proxy server performs the authentication of the terminal device and the application system as follows: the website and the account mapping database Reading the application login URL; reading the terminal device and logging in to the application system at the URL and the account mapping database The account password data; the proxy server system connects the application system, and uses the terminal device to log in to the application system account password data for authentication; if the authentication passes, the application system authentication certificate is generated; if the authentication fails, an authentication is generated. Failure message. A method for proxying a backend service authentication by proxy servo according to claim 11, wherein the proxy servo system routes the terminal device to the application system web address through a communication protocol as follows: The application system that is requested to be connected by the device, the proxy servo system reads a mapping address data of the application system in a mapping address database; the proxy servo system forwards the terminal device to the network through a communication protocol Mapping mapping data for the application system. A method for proxying a backend service authentication by proxy servo according to claim 11, wherein the proxy server performs the terminal device authentication as follows: reading the terminal device at the website and the account mapping database The account password data is authenticated; if the authentication is passed, the device authentication certificate is generated; if the authentication fails, an authentication failure message is generated.