TWM617282U - Third party instant communication system applied to enterprise login authentication system - Google Patents

Abstract

An enterprise login authentication system includes an enterprise server and an instant messaging system server. The aforementioned enterprise server stores a plurality of employee identification codes, and the employee identification code is a communication account or door number connected to the aforementioned instant messaging system server. The user device connects to the enterprise server through communication to receive and display the authentication data. The aforementioned enterprise server receives the data and transmits it to the user device in the form of a code pattern to perform the communication between the employee identification code and the communication account or door number. Antipodal.

Description

Third-party instant messaging system applied to enterprise login authentication system

This authoring system provides an enterprise login authentication system, especially a three-party mutual authorization authentication between an instant messaging server, an enterprise server, and a user device, providing a single and fast login method.

In its operations, companies will provide corporate resource platforms such as: corporate e-mail platform, corporate personnel platform, corporate accounting platform, corporate inventory management platform, corporate procurement platform,… and other corporate resource platforms for corporate employees to use, and corporate employees must enter account numbers and The password is required to use the resources of the enterprise. Enterprise employees need to enter different accounts and passwords on many login pages on different platforms. Although it can improve the information security between resource platforms, it is necessary to memorize multiple sets of accounts and passwords for the operations of enterprise employees, which often leads to recalling current operations. The login page is the account and password of which resource platform to use.

With the evolution of technology and the change of people’s usage habits, personal mobile phones can be used as identity authentication devices in many applications. Nowadays, people’s demand for instant messaging systems is getting higher and higher. Known instant messaging systems have not communicated with corporate customers. The employee information is integrated, so it cannot be used for authorization of the internal system of enterprise customers after logging in to the Zhizhi instant messaging system.

The main purpose of this creation to solve the problem is to provide a three-party mutual authorization authentication between an instant messaging server, an enterprise server and a user device, and to provide a single and fast login method.

In order to achieve the above-mentioned purpose, this creation provides an enterprise login authentication system, which includes: at least one enterprise resource platform providing a login page; an enterprise server storing a plurality of employee identification codes; and an instant messaging system server, communication Connect to an enterprise server and store the employee identification codes, and the employee identification codes are mapped to at least one communication account or a door number used to log in to an instant messaging platform; wherein, the enterprise resource platform issues a login in response to the login page Request to the enterprise server to receive an authentication data to be displayed on the login page; wherein, in response to the login request, the enterprise server sends an authentication request to the instant messaging system server, and receives the authentication data in response to the enterprise Server, and receives an authentication result response from the instant messaging system server to the enterprise server to determine whether the login page is allowed to log in; wherein, the instant messaging system server includes a login authentication module, the login authentication The module responds to the authentication request of the enterprise server to issue the authentication data, and the login authentication module receives and uses the communication account or a user device to upload an authentication data containing the authentication data, and is based on the authentication data. The verification data responds to the enterprise server with the corresponding employee identification code and the authentication result.

In a specific embodiment, the instant messaging system server includes a data update module, and the data update module establishes a communication connection with the enterprise server to update the communication account or between the door number and the employee identification code The antipodal relationship.

In a specific embodiment, the data update module is configured to update the mapping relationship between the employee identification codes and the communication accounts according to the change of the employee identification codes of the enterprise server.

In a specific embodiment, the enterprise resource platform or the enterprise server generates a code pattern based on the authentication data and displays it on the login page.

In a specific embodiment, the user device installs the instant messaging application, and the user device executes the instant messaging application to log in to the instant messaging system server using the communication account or the door number.

In a specific embodiment, the user device executes the instant messaging application to use a camera to capture the authentication data displayed on the login page, and generate the authentication data and upload it to the instant messaging system server.

In a specific embodiment, the authentication result includes the employee identification code.

In a specific embodiment, the authentication data includes a specified URL, and the user device uploads the authentication data to the instant messaging system server according to the specified URL, and the authentication data includes the authentication data and the communication account or the Door number.

1: Enterprise server

2: Instant messaging system server

3: User device

4: Data update module

5: Login authentication module

6: Enterprise Resource Platform

7: users (employees)

S0: Update command

S1: Invitation

S2: Response

S3: Invitation

S4: Login request

S5: Certification request/certification information

S6: Certification information

S7: Certification information

S8: Verification data

S9: Return employee identification code

S10: Authentication and authorization

Figure 1 is a block diagram of the logon authentication system of the creative enterprise.

Figure 2 is a schematic diagram of the login authentication system of the creative enterprise.

Figure 3 is the execution account integration process of this creative enterprise login authentication system.

Figure 4 is a schematic diagram of the login verification process of this creative enterprise login verification system.

In order to allow your reviewer to better understand the technical content of this creation, a preferred specific embodiment is described as follows.

As shown in Figure 1, the authoring department provides an enterprise login authentication system, which includes an enterprise server 1 and an instant messaging system server 2 communicating with the enterprise server 1. The login refers to login to a service or database run by the enterprise server 1, and the login is completed based at least on an operation of an instant messaging service run by the instant messaging system server 2. The aforementioned instant messaging system server 2 includes at least one data update module 4, and the data update module 4 can communicate with the instant messaging system server 2. The user device 3 communicates with the instant messaging system server 2, and the user device 3 is held and operated by a user 7 who wants to log in to an enterprise resource platform 6 (as shown in FIG. 2). The user device 3 may include one or more user devices 3 held or operated by a user 7, such as portable devices. In this creative embodiment, the enterprise server 1 stores a plurality of employee identification codes, and the instant messaging system server 2 stores at least one communication account or a door number of at least one user, and the user is a user 7 of a company employee. Of course, for those skilled in the art, it is also feasible that the instant messaging system server 2 is configured to store a plurality of employee identification codes. The employee identification code is related to the employee identification of a company, and the communication account or a door number is related to the login account (identity) of an instant messaging platform. The enterprise server 1 and the instant messaging system server 2 are configured so that the communication account or a door number stored in the instant messaging system server 2 and the employee identification code stored in the enterprise server 1 are at least partly mapped to each other. The mapping relationship indicates a communication account or a door number held by an employee with an employee identification code.

The enterprise server 1 is a server owned and controlled by a company or an enterprise, and is configured to allow authorized users (such as enterprise employees) 7 to access the services or data run by the enterprise server 1. The instant messaging system server 2 is a server that runs an instant messaging (platform) service, and the instant messaging (platform) service Communication services are not the services provided by the aforementioned companies or enterprises. As mentioned above, the authoring enterprise server 1 and the instant messaging system server 2 are configured so that their data is in the mapping relationship, and the mapping relationship can be dynamically updated over time. In one embodiment, the enterprise server 1 establishes a communication connection with the data update module 4 of the instant messaging system server 2 to establish or update the mapping relationship. For example, the data update module 4 can be configured to update the instant messaging system server 2 according to an update command S0 received by the data update module 4 according to the change event of the employee identification code stored in the enterprise server 1. Narrate the antipodal relationship.

The instant messaging system server 2 is configured to communicate with the user device 3, wherein the user device 3 stores and executes a specific instant messaging application to access the instant messaging service (platform) provided by the instant messaging system server 2. The instant messaging application program can be provided by the instant messaging system server 2 for the user device 3 to download and install. The instant messaging system server 2 is further configured to send a message or an invitation to the user device 3. For example, the instant messaging system server 2 sends an invitation S1 to the user by sending an Email to the user device 3. In other embodiments, it is not excluded that the instant messaging system server 2 can send the invitation S1 to other terminal devices through other means, or send the invitation S1 by sending a short message. The user device 3 is configured to receive a message from the instant messaging system server 2 and send a response S2 to the instant messaging system server 2. For example, the user device 3 may return a mobile phone number information to the instant messaging system server 2 based on an invitation related to authentication. In addition, in addition to the aforementioned email invitation method, the instant messaging system server 2 can also be configured to send an invitation S3 to the user device 3 via the instant messaging service it runs, and receive and process the invitation S3 by the related application.

The embodiment of Fig. 1 illustrates the basic composition of the authoring enterprise login authentication system and the connection relationship between various hardware. Figure 2 further specifically illustrates the interaction between the various block units in the creative enterprise login authentication system to describe a user 7 logging in to the enterprise resource platform through the creative enterprise login authentication system 6 services provided. According to an embodiment of this creation, the logon authentication system of this creation enterprise includes an enterprise server 1, an instant messaging system server 2, a login authentication module 5, and an enterprise resource platform 6.

Please refer to Figure 2. The following describes the flow of steps performed by the enterprise login authentication system. In this embodiment, the user (such as an enterprise employee) 7 operates the enterprise resource platform 6 and the user device 3 to complete the login. The aforementioned platforms, such as instant messaging platforms and enterprise resource platforms, are systems that provide specific purpose services, which may include a combination of software and hardware. For example, the enterprise resource platform 6 here may be a computer device provided by an enterprise or company and installed with special software provided by the enterprise.

Step 1: When the user 7 wants to log in to the enterprise resource platform 6, the enterprise resource platform 6 sends a login request S4 to the enterprise server 1 in response to a user 7's operation on a login page. More specifically, the login request refers to logging in a resource service provided by a company or an enterprise, and the resource service is run by the enterprise server 1, but is not limited to this. In an embodiment of the present creation, the enterprise resource platform 6 may be installed with a web browser, so that the user 7 can operate the network browser to make the enterprise resource platform 6 send a login request S4 to the enterprise server 1. . For example, the login page of the enterprise resource platform 6 provides a designated button, and the designated button allows the user 7 to enter the account and password, and select this creation to log in to the enterprise resource platform 6. When the user 7 operates the mouse and clicks the designated button, it will trigger the enterprise resource platform 6 to send a login request S4 to the enterprise server 1, and then display a code pattern like a QR code on the enterprise resource platform 6 through the user device 3. Image recognition to complete the login. This will be further detailed below.

Step 2: The enterprise server 1 receives the login request S4 and sends an authentication request S5 to the instant messaging system server 2 based on the login request S4. The authentication request S5 indicates that a user 7 wants to log in to the resource service (platform) provided by the enterprise server 1, and the user device 3 held by the user 7 is related to the communication account or door number of the instant messaging service . More specifically, the user 7 itself holds for The communication account or door number used to log in to the instant messaging service. The instant messaging system server 2 generates and returns an authentication data S5 based on receiving the authentication request S5, and the authentication data is used to subsequently verify the identity of the user 7. The authentication data is at least an identification symbol (token) that can be recognized by the instant messaging system server 2 such as a code. In an embodiment of this creation, the instant messaging system server 2 can also encrypt the authentication data to generate an encrypted authentication data.

Step 3: The enterprise server 1 receives the authentication data from the instant messaging system server 2 and transmits the authentication data S6 to the enterprise resource platform 6. In one embodiment, the enterprise server 1 converts the authentication data into content of a recognizable code pattern. In other embodiments, the enterprise server 1 converts the authentication data into a combination of numbers and English letters. Regardless of the form of the authentication data, the enterprise resource platform 6 presents the authentication data via a login page in response to the receipt of the authentication data. For example, the code pattern related to the authentication data can be displayed on the login page of the enterprise resource platform 6 for the user 7 to see. The display of the authentication data can also be accompanied by related information that instructs the user 7 to perform subsequent operations, such as instructing the user to read the code pattern with the user device 3 or input a series of numeric combinations related to the authentication data in the user device 3.

Step 4: The enterprise resource platform 6 transmits the authentication data S7 to the user device 3. As mentioned above, the user device 3 is installed with the instant messaging application provided by the instant messaging system server 2, and the user device 3 is configured to have a means of capturing the code pattern. In one embodiment, the user 7 opens the instant messaging application installed on the user device 3, and activates the image recognition module (such as the camera of a portable device) by executing the instant messaging application to capture the enterprise resource platform 6 The displayed code pattern is used to obtain the authentication data. In other embodiments, on the premise that wireless communication is established between the enterprise resource platform 6 and the user device 3, the authentication data S7 can also be passed through the enterprise resource platform 6 and the user device 3. In addition, the activation of the image recognition module by running the instant messaging application is not a limitation of this creation. The user 7 turns on the image recognition module of the user device 3 to directly capture the displayed code Pattern to obtain the authentication information. Alternatively, the user 7 can also input information (such as a string of numbers) associated with the authentication data in the user device 3 based on the authentication data learned from the enterprise resource platform 6. Then, the user device 3 combines the stored communication account or door number used to log in to the instant messaging service with the received authentication data through a known method to generate a verification data.

Step 5: After the user device 3 obtains the authentication data, it generates a verification data accordingly. The user device 3 sends a verification data S8 to the login authentication module 5 of the instant messaging system server 2, wherein the verification data includes at least the authentication data and a communication account or door number. As mentioned above, the user device 3 is installed with the instant messaging application provided by the instant messaging system server 2, which allows a communication account or a door number to log in to access the instant messaging service provided by the instant messaging system server 2. . The instant messaging application installed on the user device 3 can be configured to enable a function of capturing code patterns according to a command, allowing the user 7 to operate the user device 3 to capture the code patterns displayed by the enterprise resource platform 6, for example: QR code . Once the instant messaging application program recognizes the code pattern and/or parses the authentication data associated with the code pattern, the application program causes the user device 3 to treat the communication account or door number together with the authentication data as the verification data. Send to the login authentication module 5 of the instant messaging system server 2. In other embodiments, the image recognition module of the user device 3 directly captures the displayed code pattern, and obtains a designated URL from the authentication data, and the designated URL points to the instant messaging system server 2 according to the The designated URL transmits the verification data including at least the verification data S8 and the communication account or door number to the login authentication module 5 of the instant messaging system server 2.

Step 6: According to the verification data received from the user device 3 and the communication device or door number, the login authentication module 5 identifies and maps an employee identification code accordingly, and returns information S9 and related to the employee identification code. An authentication result is sent to the enterprise server 1 in an embodiment, as illustrated in FIG. 1, the instant messaging system server 2 stores the mapping relationship between the communication account or door number and the employee identification code, and the instant messaging system server 2 is based on verification Data to identify the mapping relationship jointly established by the enterprise server 1 and the instant messaging system server 2. In other embodiments, if the instant messaging system server 2 cannot identify the corresponding employee identification code based on the employee identification code received from the user device 3 and the identified mapping relationship, the instant messaging system server 2 An update request can be sent to the enterprise server 1, which requires the enterprise server 1 to update the mapping relationship, or reply to the user device 3 that its communication account or door number has not established a mapping relationship and cannot log in to the system.

Step 7: The enterprise server 1 sends an authentication authorization S10 to the enterprise resource platform 6 in response to the employee identification code received from the instant messaging system server 2. Specifically, once the enterprise server 1 receives the employee identification code mapped by the instant messaging system server 2, the enterprise server 1 allows the enterprise resource platform 6 that previously transmitted the authentication data to use the employee identification code to the enterprise server Server 1 or the service provided by enterprise server 1 is accessed. In other words, the user 7 finally logs in the service provided by the enterprise server 1 through the enterprise resource platform 6 with the mapped employee identification code.

Please refer to Figure 3, the following describes the step flow of the integration of the employee identification code and the enterprise login authentication system. In this embodiment, the enterprise server 1 completes the steps of integrating the employee identification code with the enterprise login authentication system through the data update module.

At least one communication account or a door number is prepared by the instant messaging platform. The instant messaging system server 2 includes a data update module 4, which establishes a communication connection with the enterprise server 1 Then, through the data update module 4, it can be configured to receive another update command S0 from the data update module 4 according to the total file/transaction file of the employee identification code stored in the enterprise server 1 to update the mapping relation. In a specific embodiment, the data update module 4 and the enterprise server 1 can establish communication through API or FTP transmission to complete the update of the mapping relationship.

The instant messaging system server 2 confirms whether the communication account or the door number has been mapped according to the status of the employee identification code of the user 7? If yes, complete the integration process of the employee identification code and login to the instant messaging system. If not, then remap the communication account or the door number to the data update module 4 to update the employee identification code. For the newly activated employee identification code, the instant messaging system server 2 will send an Email to the user device 3. The user 7 sends an invitation S1 or sends the invitation S1 by sending a short message to establish the mapping relationship.

Please refer to FIG. 4, the following is a configuration in conjunction with FIG. 2 to illustrate the step flow of the instant messaging system login verification. In this embodiment, the user (such as an enterprise employee) 7 operates the enterprise resource platform 6 and the user device 3 to complete the login.

First, a user (such as an enterprise employee) enters the login page of the enterprise resource platform 6. The login page of the enterprise resource platform 6 displays whether or not to choose to log in with a photo coded pattern. According to the response of the user 7 operating the login page, if yes, the enterprise server 1 is triggered to send an authentication request S5 to an instant messaging system server 2 to receive an authentication data S5 issued by the instant messaging system server 2; if If no, the user 7 is required to manually input the account and password for login. Then, after the enterprise server 1 receives the authentication data, it converts the authentication data into the content of a recognizable code pattern. In other embodiments, the enterprise server 1 converts the authentication data S6 into a combination of numbers and English letters. Regardless of the form of authentication data, the enterprise resource platform 6 presents the authentication data via a login page in response Receipt of certification materials. For example, the code pattern related to the authentication data can be displayed on the login page of the enterprise resource platform 6 for the user 7 to see. The display of the authentication data can also be accompanied by related information that instructs the user 7 to follow-up operations, such as instructing the user to use the user device 3 to take a code pattern or a user device 3 to input a string of numeric combinations related to the authentication data S6. The code pattern is displayed on the enterprise resource platform 6, the user device 3 is installed with the instant messaging application provided by the instant messaging system server 2, and the user device 3 is configured to have the ability to photograph the code pattern. The user 7 can open the image recognition module of the user device 3 (such as a camera of a portable device) to capture the code pattern displayed on the enterprise resource platform 6 to obtain the authentication data S7. In other embodiments, the authentication data S7 can also be transmitted via wireless communication between the enterprise resource platform 6 and the user device 3. The user device 3 combines the employee identification code used to log in to the instant messaging service and the received authentication data through a known method to generate a verification data. The user device 3 sends the authentication data and the employee identification code to the instant messaging system server 2. As mentioned above, the user device 3 is installed with the instant messaging application provided by the instant messaging system server 2, which allows a communication account or a door number to log in to access the instant messaging service provided by the instant messaging system server 2. . The instant messaging application installed on the user device 3 can be configured to enable a function of capturing code patterns according to a command, allowing the user 7 to operate the user device 3 to capture the code patterns displayed by the enterprise resource platform 6.

Once the instant messaging application program recognizes the code pattern and/or parses the authentication data S6 associated with the code pattern, the application program causes the user device 3 to send the communication account or door number together with the verification data S8 to the instant messaging system Server 2. According to the correctness of the authentication data, the instant messaging system server 2 recognizes the information of the employee identification code corresponding to the uploaded communication account or door number. Accordingly, the instant messaging system server 2 recognizes an employee identification code, and returns information related to the employee identification code S9 And an authentication result to the enterprise server 1 in response to the authentication request S5 sent by the enterprise server 1. In one embodiment, as illustrated in FIG. 1, the instant messaging system server 2 stores the mapping relationship between the communication account or door number and the employee identification code, and the instant messaging system server 2 identifies the enterprise server 1 based on the verification data. The mapping relationship established jointly with the instant messaging system server 2 and the corresponding employee identification code are identified based on the communication account or door number received from the user device 3 and the identified mapping relationship. In other embodiments, if the instant messaging system server 2 cannot identify the corresponding employee identification code based on the communication account (or door number) received from the user device 3 and the identified mapping relationship, the instant messaging system The system server 2 can send an update request to the enterprise server 1, which requests the enterprise server 1 to update the mapping relationship, or reply to the user device 3 that its communication account or door number has not established a mapping relationship and cannot log in to the system .

In the next determination step, the enterprise server 1 determines whether to allow the user 7 to log in to the enterprise resource platform 6 according to the authentication result. If the authentication result is legal and the employee identification code is correct (meaning that the employee identification code belongs to the enterprise server 1 management), the enterprise server 1 sends an authentication authorization S10 to the enterprise resource platform 6 in response to the instant messaging system server 2 The received employee identification code successfully logs in to the designated platform provided by enterprise server 1; if the authentication result is illegal or the employee identification code cannot be identified by enterprise server 1, the enterprise resource platform 6 displays login failure. Specifically, once the enterprise server 1 receives the employee identification code mapped by the instant messaging system server 2, the enterprise server 1 allows the enterprise resource platform 6 that previously transmitted the authentication data to use the employee identification code to the enterprise server Server 1 or a service provided by an enterprise server 1. In other words, the user 7 finally logs in the service provided by the enterprise server 1 through the enterprise resource platform 6 with the mapped employee identification code. The above are only examples, and are not limited to the examples. For example, those who do not deviate from the basic structure of creation should be the scope of rights claimed in this patent, and the scope of the patent application shall prevail.

1: Enterprise server

2: Instant messaging system server

3: User device

5: Login authentication module

6: Enterprise Resource Platform

7: users (employees)

S4: Login request

S5: Certification request/certification information

S6: Certification information

S7: Certification information

S8: Verification data

S9: Return employee identification code

S10: Authentication and authorization

Claims (10)

An enterprise login authentication system includes: at least one enterprise resource platform providing a login page; an enterprise server storing a plurality of employee identification codes; and an instant messaging system server communicating with an enterprise server and storing the Wait for the employee identification code, the employee identification code mapping is used to log in at least one communication account or a door number of an instant messaging platform; wherein, the enterprise resource platform sends a login request to the enterprise server in response to the login page to receive An authentication data is displayed on the login page; among them, the enterprise server sends an authentication request to the instant messaging system server in response to the login request, and receives the authentication data response to the enterprise server, and from the instant messaging system The server receives an authentication result response to the enterprise server to determine whether the login page is allowed to log in; wherein, the instant messaging system server includes a login authentication module, and the login authentication module responds to the enterprise server’s The authentication request is used to issue the authentication data, and the login authentication module receives a verification data containing the authentication data uploaded by a user device using the communication account or the door number, and the corresponding employee identification is mapped based on the verification data The code and the authentication result are returned to the enterprise server. The enterprise login authentication system according to claim 1, wherein the instant messaging system server includes a data update module, and the data update module establishes a communication connection with the enterprise server to update the communication account or the door number and the The mapping relationship between employee identification codes. The enterprise login authentication system according to claim 2, wherein the data update module is configured to update the mapping between the employee identification codes and the communication accounts according to the change of the employee identification codes of the enterprise server relation. The enterprise login authentication system according to claim 1, wherein the enterprise resource platform or the enterprise server generates a code pattern according to the authentication data and displays it on the login page. The enterprise login authentication system according to claim 1, wherein the user device installs the instant messaging application, and the user device executes the instant messaging application to log in to the instant messaging system server using the communication account or the door number . The enterprise login authentication system according to claim 5, wherein the user device executes the instant messaging application to use a camera to capture the authentication data displayed on the login page, and generate the authentication data and upload it to the instant messaging system server. The enterprise login authentication system according to claim 1, wherein the authentication result includes the employee identification code. The enterprise login authentication system according to claim 1, wherein the authentication data includes a specified URL, and the user device uploads the authentication data to the instant messaging system server according to the specified URL, and the authentication data includes the authentication data And the communication account or the door number. An enterprise login authentication system, comprising: an instant messaging system server, communicating with an enterprise server and storing a plurality of employee identification codes, and the employee identification codes are mapped to at least one communication account or door used to log in to an instant messaging platform No; Wherein, the instant messaging system server includes a data update module, and the data update module establishes a communication connection with the enterprise server to update the mapping relationship between the communication account and the employee ID; and wherein, the instant The communication system server includes a login authentication module, the login authentication module responds to an authentication request of the enterprise server to issue an authentication data, the authentication data is displayed on a login page of at least one enterprise resource platform through a coded pattern, and The login authentication module receives the authentication data containing the authentication data uploaded by a user device using the communication account or the door number, and responds to the enterprise server with the corresponding employee identification code and an authentication result based on the authentication data , To enable the enterprise server to determine whether the login page is allowed to log in. For example, the enterprise login authentication system according to claim 9, wherein the instant messaging system server provides an instant messaging application to be installed on the user device to enable the user device to execute the instant messaging application to use the communication account or The door number logs in to the instant messaging system server, and photographs the authentication data to generate the authentication data.

Images