WO2013040957A1

WO2013040957A1 - Single sign-on method and system, and information processing method and system

Info

Publication number: WO2013040957A1
Application number: PCT/CN2012/079709
Authority: WO
Inventors: 夏正雪; 韦银星
Original assignee: 中兴通讯股份有限公司
Priority date: 2011-09-20
Filing date: 2012-08-06
Publication date: 2013-03-28
Also published as: CN103023856A; CN106254386B; CN106254386A; CN103023856B

Abstract

A single sign-on method, a single sign-on system, an information processing method, an information processing device, an identity provision server, a service provision server, and a name mapping server. The single sign-on method includes: an identity provision server confirming that a user has passed access authentication; the identity provision server providing an inter-server shared key according to itself and the service to be accessed by the user to generate assertion information about the user, and sending the assertion information to the service provision server. By reusing access authentication, the embodiments in the present invention solve the problem that the user has to undergo register authentication many times when accessing the Internet, protect user privacy by generating a pseudonym, and avoid leakage of user privacy.

Description

Single sign-on method, system and information processing method, system

Technical field

The present invention relates to the field of network communications, and in particular, to a method for single sign-on, a system for single sign-on, an information processing method, an information processing system, an identity providing server, a service providing server, and a name mapping server. Background technique

In the Transmission Control Protocol (TCP)/Internet Protocol (IP) system, the core of the network layer is the IP protocol at the network layer, which enables mutual access between users through IP addresses. Various applications, such as web browsing, mail sending and receiving, instant messaging, etc., are carried on top of the application layer protocol.

Before using these services, users must access the Internet through the basic network provided by the telecom operators. Different users may have different access methods, such as various types of digital subscriber lines (xDSL), optical fibers, mobile access, and so on. In general, the user terminal obtains an IP address, and the user then accesses various applications on the Internet through the IP address, which is equivalent to the temporary identity of the user.

Since the prefix part of the IP address indicates the subnet where the user is currently located, when the user's location changes, different IP addresses must be assigned. Otherwise, the router cannot correctly forward the data packet to the user. Because the IP address has the dual attributes of identity and location, and the IP address obtained by the user is not necessarily the same every time, and thus cannot be used as the long-term identity of the user, the application system on the Internet must establish a user identity identification system. This is the so-called user account system.

It can be seen that there is a secondary authentication when the user accesses the application on the Internet, and the operator performs authentication once when the user accesses the Internet, and the application system on the Internet performs its own authentication when the user accesses.

With the rapid development of information technology and network technology, there are more and more application systems on the Internet. Since these applications are independent of each other, users must register before using each system and log in according to their respective identities. For this reason, users must remember the username and password of each application system, which brings a lot of users. Big trouble. In this case, the concept of single sign-on is mentioned Come out and get applied.

Single-Sign On (SSO) is a technology that allows users to access multiple application systems. Users only need to authenticate once when logging in, and they can access freely between multiple application systems without having to repeatedly input users. Name and password to confirm identity.

In the related art Internet single sign-on system, a user must register at an identity provider (IdP, Identity Provider) before using single sign-on, and a service provider server of a service provider (SP, Service Provider) depends on the identity. The identity of the provider IdP provides the authentication result of the server to provide services to the user. In addition, since the identity provider IdP of the Internet is usually deployed in a distributed manner, if the service provider SP adopts the single sign-on method, the scale of its business development will largely depend on the number of IdP registered users it depends on. . The main technologies involved in single sign-on are: OpenID (OpenID), Passport (passport), Liberty Alliance (Freedom Alliance), etc. Here, OpenID is easy to use, but there are security risks, and it is not good to prevent "phishing" attacks. Passport is easy to use and slightly safer, but it is only suitable for internal use by service providers SP; Liberty Alliance has certain security. However, the deployment is not easy and the user is not convenient to use.

Since the user needs to access the carrier network before accessing the Internet application, the operator can be used as the identity provider IdP. As an identity provider, the IdP has the following advantages: The access authentication of the operator can ensure security. At the same time, the operator, as the identity provider IdP, will not require the user to re-register, and is easy to use. As an identity provider IdP, the operator has a high-quality and mature user consumer group compared to the Internet identity provider IdP.

At present, the IP address has the double attribute defect, which brings about mobility and security issues, and has become a bottleneck restricting the further development of the Internet industry. To solve this problem, the industry has proposed HIP (Host Identity Protocol) and LISP (Locator/Identifier Separation Protocol) technologies. Common to these techniques is the introduction of two types of encoding: identity encoding on behalf of the user's identity and location encoding on behalf of the user's location. Each user has both an identity code and a location code, and the user communicates based on the identity code and the peer. When the user's location changes, the user's identity code remains the same, and the user's location code will change. In this way, the user identity code can always correspond to the user without the problem of ambiguity of the IP address.

However, in the related identity location separation network technology, the user identity coding is only used in the network layer label. Knowing the user's identity, users still need to register for multiple registrations to access the Internet application system. On the other hand, since the user registers an account in a large number of different Internet application systems, usually for the sake of convenience, the account registered by the user has a certain regularity, and it is easy to cause the user's identity privacy information to be leaked. Summary of the invention

The embodiment of the invention provides a single sign-on method, a single sign-on system, an information processing method, an information processing system, an identity providing server, a service providing server and a name mapping server, so as to solve the problem that the user accesses the Internet application system. The problem of secondary registration certification.

The embodiment of the invention provides a method for single sign-on, the method comprising:

The identity providing server confirms that the user passes the access authentication;

The identity providing server generates assertion information for the user according to the shared key between the server and the service providing server that the user wants to access, and sends the assertion information to the service providing server.

Preferably, before the identity providing server generates the assertion information for the user according to the shared key between the service provider and the service provider that the user wants to access, the method further includes:

After receiving the authentication request sent by the service providing server or the service access request sent by the user, the identity providing server checks whether the shared key exists, and if not, the service providing server passes the authentication. After that, the shared key is generated.

Preferably, before the identity providing server generates the assertion information for the user, the method further includes:

Preferably, the identity providing server obtains a pseudonym for the user and a lifetime corresponding to the pseudonym, including:

The identity providing server sends a name mapping server according to the anonymous service request of the user

(NMS) transmitting an anonymous identity request, and receiving a pseudonym of the user generated according to the anonymous identity request returned by the NMS and a lifetime corresponding to the pseudonym.

Preferably, the identity providing server obtains a pseudonym for the user and corresponds to the pseudonym After the lifetime, the method further includes:

The identity providing server receives an anonymous update request sent by the user and carries a specified user name and a corresponding lifetime, and sends the anonymous update request to the NMS, and receives an update result returned by the NMS.

Preferably, the assertion information carries a random number, identity information of the identity providing server, identity information of the service providing server, identity information of the user, a signature algorithm, and the identity providing server according to the sharing. a signature result calculated by the key; wherein the identity information of the user includes the pseudonym or the specified username.

The embodiment of the invention further provides a method for single sign-on, the method comprising:

The service providing server receives the assertion information sent by the identity providing server to the user who wants to access the service providing server; the service providing server verifies the assertion information according to the shared key between the server and the identity providing server.

Preferably, after the service providing server verifies the assertion information according to the sharing key between the server and the identity providing server, the method further includes:

If the verification is passed, the service providing server creates an entry corresponding to the identity information of the user included in the assertion information, and provides a service to the user; the identity information of the user is the name of the user or Specify a username.

Preferably, before the service providing server receives the assertion information sent by the identity providing server to the user who wants to access the service providing server, the method further includes:

After receiving the service access request sent by the user, the service providing server generates a random number, and sends an authentication request carrying the random number to the identity providing server.

Preferably, the assertion information carries the random number, the identity information of the identity providing server, the identity information of the service providing server, the identity information of the user, a signature algorithm, and the identity providing server according to the The signature result calculated by the shared key;

The service providing server verifies the assertion information according to a shared key between the server and the identity providing server, including:

The service providing server provides identity information of the server according to the identity, and the service provides Calculating the signature result by the identity information of the server, the identity information of the user, the signature algorithm, and the shared key, and comparing whether the signature result calculated by the self is consistent with the signature result calculated by the identity providing server; as well as

It is determined whether the generation time of the random number is currently the most recent and whether the random number is unique. An embodiment of the present invention further provides an information processing method, where the method includes:

The name mapping server (NMS) receives an anonymous identity request sent by the identity providing server, and the anonymous identity request carries the identity of the user;

Generating, according to the anonymous identity request, the pseudonym of the user corresponding to the identity identifier and the lifetime corresponding to the pseudonym, and returning, to the identity providing server, the pseudonym of the user and the survival corresponding to the pseudonym period.

Preferably, after the NMS sends the user's pseudonym and the lifetime corresponding to the pseudonym to the identity providing server, the method further includes:

The NMS receives an anonymous update request from the user that carries the specified username and corresponding lifetime sent by the identity providing server, performs an update process according to the anonymous update request, and returns an update result.

The embodiment of the present invention further provides an identity providing server, where the identity providing server includes: an acknowledgment module, configured to: confirm that the user passes the access authentication;

The assertion information processing module is configured to: after the confirming module confirms that the user passes the access authentication, generate the assertion information for the user according to the shared key between the identity providing server and the service providing server that the user wants to access, And transmitting the assertion information to the service providing server.

Preferably, the identity providing server further includes:

a key generation module, configured to: after the assertion information processing module generates the assertion information for the user, after receiving the authentication request sent by the service providing server or the service access request sent by the user, checking whether the The shared key, if not present, generates the shared key after the service providing server passes the authentication.

Preferably, the identity providing server further includes:

Obtaining a module, configured to: after the confirmation module confirms that the user passes the access authentication, Before the assertion information processing module generates the assertion information for the user, obtain the pseudonym for the user and the lifetime corresponding to the pseudonym.

Preferably, the obtaining module is configured to: send an anonymous identity request to a name mapping server (NMS) according to the anonymous service request of the user, and receive the user generated by the NMS according to the anonymous identity request A pseudonym and a lifetime corresponding to the pseudonym.

Preferably, the obtaining module is further configured to: receive an anonymous update request that is sent by the user and carry a specified user name and a corresponding lifetime, and send the anonymous update request to the NMS, and receive the NMS return Update results.

The embodiment of the present invention further provides a service providing server, where the service providing server includes: a receiving module, configured to: receive an assertion information sent by an identity providing server to a user who wants to access the service provider;

And a verification module, configured to: verify the assertion information according to a shared key between the service providing server and the identity providing server.

Preferably, the service providing server further includes:

And a service providing module, configured to: after the verification module verifies the information through the assertion information, create an entry corresponding to the identity information of the user included in the assertion information, and provide a service to the user.

An embodiment of the present invention provides a name mapping server (NMS), where the NMS includes: a receiving module, configured to: receive an anonymous identity request sent by an identity providing server, where the anonymous identity request carries an identity of the user;

And generating a sending module, configured to: return, according to the anonymous identity request received by the receiving module, the pseudonym of the user and a lifetime corresponding to the pseudonym.

Preferably, the generating and sending module is further configured to: receive the identity providing server to send An anonymous update request from the user carrying the specified username and corresponding lifetime, updating processing according to the anonymous update request, and returning the update result.

An embodiment of the present invention further provides an information processing system, where the system includes the foregoing identity providing server and the name mapping server.

The embodiment of the invention further provides a single sign-on system, which comprises the above identity providing server and the above service providing server.

The embodiment of the invention further provides a single sign-on system, which comprises the above-mentioned identity providing server, the above-mentioned name mapping server and the above-mentioned service providing server.

In the embodiment of the present invention, by reusing access authentication, the problem of user accessing the Internet for multiple registration authentication is well solved, and the pseudonym is used to protect the privacy of the user, thereby avoiding leakage of user privacy. BRIEF abstract

FIG. 1 is a schematic structural diagram of a network element according to an embodiment of the present invention;

2 is a flowchart of an embodiment of a single sign-on method according to the present invention;

3 is a signaling flow diagram of an embodiment of a single sign-on method initiated by a service providing server according to the present invention;

4 is a signaling flow diagram of an embodiment of a single sign-on method initiated by an identity providing server according to the present invention;

FIG. 5 is a schematic structural diagram of an embodiment of an identity providing server according to the present invention; FIG.

6 is a schematic structural diagram of an embodiment of a service providing server according to the present invention;

7 is a schematic structural diagram of an embodiment of a name mapping server according to the present invention;

8 is a schematic structural diagram of an embodiment of an information processing apparatus according to the present invention;

FIG. 9 is a schematic structural diagram of an embodiment of a single sign-on system according to the present invention. Preferred embodiment of the invention

Embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be noted that In the case of no conflict, the features in the embodiments and the embodiments in the present application may be arbitrarily combined with each other. First, the network element architecture involved in the embodiment of the present invention is introduced. As shown in FIG. 1, the architecture includes a user terminal (Mobile Node, MN) 101, an access service node (ASN) 102, and an authentication center 103. Identity Provider (IdP) identity providing server 104, Name Mapping Server (NMS) 105, Interconnect Service Node (ISN) 106, and Service Provider (SP) services A server 107 is provided, wherein:

The MN accessing the network may be one or more of a mobile terminal and a fixed terminal, such as a mobile phone, a fixed telephone, a computer, and an application server;

The ASN is configured to: provide access services for the user terminal, maintain the connection between the terminal and the network, assign a Routing Identifier (RID) to the terminal, and register with the Identity Location Register (ILR)/Message Forwarding Function Entity (PTF). Register and query the RID of the terminal, maintain the Access Identifier (AID)-RID mapping information, and implement routing and forwarding of data packets.

The authentication center is set to: record attribute information of the network user, such as user category, authentication information, and user service level, complete access authentication and authorization for the terminal, and also have a charging function. The authentication center supports two-way authentication between the terminal and the network, and can generate user security information for authentication, integrity protection, and confidentiality protection;

The identity providing server provides the service providing server with the assertion information of the user, and authenticates the service providing server, and checks the legality of the service providing server; and queries the corresponding attribute information of the user through the interface with the authentication center, and provides an interface with the NMS. User's pseudonym service;

The NMS generates a pseudonym based on the identity of the user provided by the identity providing server, as an alternate identity of the user, and creates a pseudonym and user identity information, a service provider server uniform resource locator (URL), and an entry corresponding to the lifetime (lifetime), if the user modifies the pseudonym And the life of the pseudonym, the NMS also updates the information after receiving the anonymous update request from the identity providing server; wherein, the NMS and the identity providing server can be separately deployed, or the NMS can be used as a function module of the identity providing server. Deployment

ISN, used to query and maintain the AID-RID mapping information of the network terminal, encapsulate, route and forward the data between the network and the traditional IP network, implement the network and the traditional IP network. Interconnection function, which includes a format conversion module, configured to convert an IPv4/IPv6 address of the network terminal included in a data packet sent by the traditional IP network into a corresponding AID, and convert the AID of the network terminal After being in the IPv4/IPv6 address format, it is sent to the terminal of the traditional IP network. The service providing server is an application system for providing services to users on the Internet.

The embodiment of the invention provides a method for single sign-on, which is described from the identity providing server side, and the method includes:

Step 11. The identity providing server confirms that the user passes the access authentication.

The identity providing server confirms that the user passes the access authentication according to the identity of the user;

Step 12: The identity providing server generates the assertion information for the user according to the shared key between the service provider and the service provider that the user wants to access, and sends the assertion information to the service providing server.

The embodiment of the invention further provides a method for single sign-on, which is described from the service providing server side, and the method includes:

Step 21: The service providing server receives the assertion information sent by the identity providing server to the user who wants to access the service providing server.

Step 22: The service providing server provides the assertion information according to the shared key insurance certificate between the server and the identity providing server.

The foregoing service providing server uses the assertion information sent by the identity providing server to perform authentication, so that the user accessing the Internet application system does not need to perform multiple registration authentication, and the embodiment of the present invention provides an information processing method. The method is described from the name mapping server side, and the method includes:

Step 31: The name mapping server (NMS) receives an anonymous identity request sent by the identity providing server, where the anonymous identity request carries the identity of the user;

Step 32: The NMS generates a pseudonym of the user corresponding to the identity identifier and a lifetime corresponding to the pseudonym according to the anonymous identity request, and returns a pseudonym of the user to the identity providing server and the Name corresponds to the lifetime. In order to more clearly describe the single sign-on method of the embodiment of the present invention, the following describes the interaction between the identity providing server, the service providing server, and the name mapping server. As shown in FIG. 2, the single sign-on method is implemented according to the present invention. A flowchart of an example, the method comprising the steps of:

Step 201: After receiving the authentication request of the service providing server or the service access request of the user, the identity providing server checks whether there is a shared key Ks between itself and the service providing server. If not, the authentication service providing server authenticates. After the success, the shared key Ks is generated. The authentication method includes but is not limited to: pre-shared key, TLS, public key infrastructure (PKI), protocol security (IPsec), etc., since they are all existing Technology, no more details here.

Step 202: The identity providing server confirms that the user passes the access authentication, and protects the user identity by using the name mapping server to generate a pseudonym according to the anonymous service request of the user, and generates the assertion information for the user for the service providing server.

Step 203: After receiving the assertion information sent by the identity providing server, the service providing server verifies the assertion information. If the verification succeeds, the entry corresponding to the user pseudonym is created, and the service is provided to the user.

The above single sign-on method, by reusing access authentication and pseudonym, solves the problem that the user accessing the Internet application system requires multiple registration authentication and identity privacy leakage.

As shown in FIG. 3, it is a signaling flowchart of an embodiment of a single sign-on method initiated by a service providing server according to the present invention, where the method includes:

Step 301: Perform access authentication between the MN, the ASN, and the authentication center. After the authentication is passed, the identity separation network allocates an access identifier AID to the user.

After that, the packet sent by the user terminal is transmitted by the AID, the ASN allocates the RID to the user, and the routing is selected by the RID to find the ISN. The ISN obtains the AID of the user from the packet, and converts the packet into an IPv4/IPv6 address and sends the packet to the traditional IP address. The internet.

Step 302: The MN initiates a service access request to the service providing server.

Step 303: The user selects an identity providing server on the service providing server page, and the service provides The server generates a random number R1 according to the current timestamp, as a temporary identifier of the user in the service providing server, and constructs an authentication request message, where the message carries the service providing server URL, the identity providing server URL, and the random number R1;

Step 304: The service providing server redirects the authentication request message to the identity providing server by using a hypertext transfer protocol (HTTP);

Step 305: The user sends an anonymous service request to the identity providing server through the terminal. Step 306: The identity providing server obtains the access identifier AID of the user from the packet, confirms that the user passes the access authentication, and checks whether it is between the server and the service providing server. The shared key Ks exists. If not, the authentication service providing server generates a shared key Ks after the authentication succeeds; determines that there is no pseudonym corresponding to the user or the corresponding pseudonym lifetime expires;

The manner in which the identity providing server authenticates the service providing server includes, but is not limited to, a pre-shared key, a PKI, a TLS, or an IPsec authentication method. Since they are all prior art, they are not described here;

Step 307: The identity providing server sends an anonymous identity request message to the NMS, where the request message carries the user's AID and the URL of the service providing server.

Step 308: After receiving the anonymous identity request message, the NMS generates a random number R2 and a default lifetime, and R2 is used as the pseudonym of the corresponding user, and constructs an AID of the MN, a service providing server URL, and an entry corresponding to R2, lifetime, as shown in Table 1. Shown

Table 1 MN corresponding entries

Step 309: The NMS sends an anonymous identity response message to the identity providing server, where the response message carries the user's AID, the service provider server URL, the random number R2, and the lifetime;

Step 310: The identity providing server sends an anonymous service response message to the user terminal, where the response message carries the service providing server URL, the random number R2, and the lifetime;

Step 311: The user sends the specified username and its lifetime to the identity providing server through the terminal. The user can modify the random number R2 to the specified user name, that is, the user name desired to be presented, and specify the desired lifetime;

Step 312: The identity providing server sends an anonymous update request message to the NMS, where the message carries the user's AID, the random number R2, the user-specified pseudonym, and the lifetime;

Step 313: After adding the user-specified pseudonym and updating the lifetime, the NMS sends an anonymous update response message to the identity providing server, where the message carries the result of the successful or failed update.

Step 314: The identity providing server constructs an authentication response message, where the authentication response message includes the assertion information, where the assertion information carries a random number R1, a service providing server URL, an identity providing server URL, a pseudonym R2 generated by the NMS, or a user-specified username, The signature algorithm, and the signature result of Ks;

The signature result here is the signature result calculated by the identity providing server according to the service providing server URL, the identity providing server URL, the pseudonym R2 generated by the NMS, or the user-specified username and the shared key using the signature algorithm; the identity in this embodiment Providing the server URL to represent the identity information of the identity providing server; the service providing server URL represents the identity information of the service providing server; the pseudonym R2 generated by the NMS or the user name specified by the user represents the identity information of the user; the random number R1 is used to prevent the replay attack; Step 315: The identity providing server sends an authentication response message to the service providing server by using HTTP redirection;

Step 316: The service providing server verifies the integrity of the assertion by using the shared key Ks with the identity providing server, and checks whether R1 is recently generated, whether it is repeated, or the like;

The service providing server calculates the signature according to the service providing server URL carried in the assertion information, the identity providing server URL, the pseudonym R2 generated by the NMS, or the user-specified username and the shared key negotiated with the identity providing server using the signature algorithm carried in the assertion information. As a result, the signature result is compared with the signature result carried in the assertion information, and if the two are consistent, the assertion is complete; and at the same time, it is determined according to the generation time of R1 whether it is recently generated and repeated; if it is recently generated and is not repeated , then the danger certificate passed.

Step 317: After the foregoing verification is passed, the service providing server creates a random number R2 or an entry of the specified user name for the user MN; Step 318: The service providing server returns a service access response to the user, and uses R2 or the user name as the user to provide the service to the user in the identifier of the service providing server.

As shown in FIG. 4, it is a signaling flowchart of an embodiment of a single sign-on method initiated by an identity providing server according to the present invention. The method includes the following steps:

Step 401: The access authentication is performed between the MN, the ASN, and the authentication center. After the authentication is passed, the identity separation network allocates an access identifier AID to the user.

Step 402: The MN initiates a service access request to the identity providing server.

Step 403: The MN selects a service to be accessed on the identity providing server page, and sends an anonymous service request to the identity providing server.

Step 404: The identity providing server obtains the access identifier AID of the user from the packet, confirms that the user passes the access authentication, and checks whether there is a shared key Ks between the server and the service providing server. If not, the authentication service provides After the server passes the authentication, the shared key Ks is generated. Check that there is no pseudonym corresponding to the AID or the corresponding pseudonym expires;

Step 405: The identity providing server sends an anonymous identity request message to the NMS according to the anonymous service request of the user, where the request message carries the user's AID and the service providing server URL;

Step 406: After receiving the anonymous identity request message, the NMS generates a random number R2 and a default lifetime as the pseudonym of the corresponding user, and constructs an AID of the MN, a service provider server URL, and an entry corresponding to R2, lifetime, as shown in Table 1. Show

Step 407: The NMS sends an anonymous identity response message to the identity providing server, where the response message carries the user's AID, the service provider server URL, the random number R2, and the lifetime;

Step 408: The identity providing server sends an anonymous service response message to the user, where the response message carries the service providing server URL, the random number R2, and the lifetime;

Step 409: The user sends the specified username and its lifetime to the identity providing server through the terminal. The user can modify the random number R2 to the specified user name, that is, the user name desired to be presented, and specify the desired lifetime;

Step 410: The identity providing server sends an anonymous update request message to the NMS, where the message carries the user's AID, the random number R2, the user-specified pseudonym, and the lifetime;

Step 411: After adding the user-specified pseudonym and updating the lifetime, the NMS sends an anonymous update response message to the identity providing server, where the message carries the result of the successful or failed update.

Step 412: The identity providing server generates a random number R1 according to the current timestamp, and constructs an authentication response message, where the authentication response message includes the assertion information, where the assertion information carries the random number R1, the service provider server URL, the identity providing server URL, and the NMS generated. Kana R2 or user-specified username, signature algorithm, and signature result of Ks;

Step 413: The identity providing server sends an authentication response message to the service providing server by using HTTP redirection;

Step 414: The service providing server verifies the integrity of the assertion by using the shared key Ks with the identity providing server, and checks whether R1 is recently generated, whether it is repeated, or the like;

Step 415: After the foregoing verification is passed, the service providing server creates a random number R2 or an entry of the specified user name for the user MN;

Step 416: The service providing server returns a service access response to the user, and uses R2 or the user name as the user to provide the service to the user in the identifier of the service providing server.

Since steps 403-416 in this embodiment are similar to the processes in steps 305-318 in the above embodiment, they are not described in detail in this embodiment.

As shown in FIG. 5, it is a schematic structural diagram of an embodiment of an identity providing server according to the present invention. The identity providing server includes a confirming module 51 and an assertion information processing module 52, where:

The confirmation module 51 is set to confirm that the user passes the access authentication;

The assertion information processing module 52 is configured to: after the confirmation module 51 confirms that the user passes the access authentication, generate the assertion information for the user according to the shared key between the identity providing server and the service providing server that the user wants to access, And transmitting the assertion information to the service providing server. In addition, the identity providing server further includes: a key generating module, configured to receive an authentication request sent by the service providing server or a service access sent by the user before the assertion information processing module generates the assertion information for the user After the request, it is checked whether the shared key exists, and if not, the shared key is generated after the service providing server passes the authentication.

In order to avoid the disclosure of the identity information of the user, the identity providing server further includes: an obtaining module, configured to: after the confirming module confirms that the user passes the access authentication, before the assertion information processing module generates the assertion information for the user, Obtaining a pseudonym for the user and a lifetime corresponding to the pseudonym. Specifically, the obtaining module is configured to send an anonymous identity request to a name mapping server (NMS) according to the anonymous service request of the user, and receive a pseudonym of the user generated by the NMS according to the anonymous identity request. And the lifetime corresponding to the pseudonym. In addition, the user may also modify the username, so the obtaining module is further configured to receive an anonymous update request sent by the user and carrying the specified user name and the corresponding lifetime, and send the anonymous update request to the NMS. And receiving an update result returned by the NMS.

The assertion information carries a random number, identity information of the identity providing server, identity information of the service providing server, identity information of the user, a signature algorithm, and the identity providing server according to the shared secret The signature result calculated by the key; wherein the identity information of the user includes the pseudonym or the specified username.

After confirming that the user passes the access authentication, the service providing server provides the service providing server with the assertion information of the user, so that the user does not need to input the authentication information when accessing the service providing server.

As shown in FIG. 6, FIG. 6 is a schematic structural diagram of an embodiment of a service providing server according to the present invention. The service providing server includes a receiving module 61 and a verifying module 62, where:

The receiving module 61 is configured to receive the assertion information sent by the identity providing server to the user who wants to access the service providing server;

The verification module 62 is configured to assert the information according to the shared key insurance between the service providing server and the identity providing server.

In addition, the service providing server further includes: a service providing module, configured to be the verification mode After the block verification passes the assertion information, an entry corresponding to the identity information of the user included in the assertion information is created, and the service is provided to the user.

The verification module calculates the signature according to the service providing server URL carried in the assertion information, the identity providing server URL, the pseudonym R2 generated by the NMS, or the user-specified username and the shared key negotiated with the identity providing server using the signature algorithm carried in the assertion information. As a result, the signature result is compared with the signature result carried in the assertion information, and if the two are consistent, the assertion is complete; and at the same time, it is determined according to the generation time of R1 whether it is recently generated and repeated; if it is recently generated and is not repeated , then the danger certificate passed.

The service providing server performs the single sign-on of the user according to the assertion information sent by the server according to the identity providing server, and effectively protects the privacy of the user.

As shown in FIG. 7, it is a schematic structural diagram of an embodiment of a name mapping server according to the present invention. The NMS includes a receiving module 71 and a generating and transmitting module 72, where:

The receiving module 71 is configured to receive an anonymous identity request sent by the identity providing server, where the anonymous identity request carries the identity of the user;

The generating and sending module 72 is configured to return the pseudonym of the user and the lifetime corresponding to the pseudonym according to the anonymous identity requesting the receiving server received by the receiving module.

In addition, in order to modify the user's pseudonym, the generating and sending module is further configured to receive an anonymous update request from the user that carries the specified user name and the corresponding lifetime, which is sent by the identity providing server, according to the anonymous update request. Perform update processing and return the update results.

The name mapping server shown in FIG. 7 and the identity providing server shown in FIG. 5 can be combined. The device after the combination is as shown in FIG. 8. The functions of the related modules in the device are shown in FIG. 5 and FIG. The functions of the corresponding modules are the same and will not be described here.

The embodiment of the present invention further provides a single sign-on system. As shown in FIG. 9, the system includes a service providing server 91, an identity providing server 92, and a name mapping server 93. The system includes a single sign-on method. The function of the relevant module in the middle and the function of the corresponding module in Figure 5-7 Can be the same, will not repeat them here.

In summary, in the embodiment of the present invention, after receiving the authentication request of the service providing server or the service access request of the user, the identity providing server checks whether the shared key Ks exists, and if not, the authentication service providing server, after the authentication is passed, The shared key Ks is generated, and the identity providing server confirms the user's access authentication according to the user's identity, and protects the user's identity by generating a pseudonym through a name mapping server (NMS, Name Mapping Server) according to the anonymous service request of the user. The service providing server generates the assertion information of the user, and after receiving the assertion information of the identity providing server, the service providing server verifies the validity of the assertion information, and if the verification passes, creates an entry corresponding to the pseudonym and provides the service to the user.

Of course, if only the problem of multiple authentication needs to be solved, the name mapping server may not be included in the above system, and accordingly, the obtaining module is not required to be included in the identity providing server.

One of ordinary skill in the art will appreciate that all or a portion of the above steps may be accomplished by a program that instructs the associated hardware to be stored in a computer readable storage medium, such as a read only memory, a magnetic disk, or an optical disk. Alternatively, all or part of the steps of the above embodiments may also be implemented using one or more integrated circuits. Correspondingly, each module/unit in the above embodiment may be implemented in the form of hardware or in the form of a software function module. The invention is not limited to any specific form of combination of hardware and software.

The above embodiments are only intended to illustrate the technical solutions of the present invention and are not to be construed as limiting the invention. It should be understood by those skilled in the art that the present invention may be modified or equivalently substituted without departing from the spirit and scope of the invention.

Industrial Applicability In the embodiment of the present invention, by reusing access authentication, the problem of user accessing the Internet for multiple registration authentication is well solved, and the pseudonym is used to protect the privacy of the user, thereby avoiding leakage of user privacy.

Claims

Claim

A method for single sign-on, the method comprising: the identity providing server confirming that the user passes the access authentication;

2. The method of claim 1 wherein:

The method further includes: before the identity providing server generates the assertion information for the user according to the shared key between the service providing server and the service provider that the user wants to access, the method further includes:

3. A method according to claim 1 or 2, wherein:

Before the identity providing server generates the assertion information for the user, the method further includes:

4. The method of claim 3, wherein:

The steps include:

The identity providing server sends an anonymous identity request to the name mapping server (NMS) according to the anonymous service request of the user, and receives a pseudonym of the user generated according to the anonymous identity request returned by the NMS and corresponds to the pseudonym The lifetime.

5. The method according to claim 4, wherein: the method further comprises:

6. The method of claim 5, wherein:

The assertion information carries a random number, identity information of the identity providing server, identity information of the service providing server, identity information of the user, a signature algorithm, and the identity providing server calculates according to the shared key. The signature result of the user; wherein the identity information of the user includes the pseudonym or the specified username.

A method for single sign-on, the method comprising: receiving, by a service providing server, assertion information sent by an identity providing server to a user who wants to access the service providing server; the service providing server providing a server according to itself and the identity The shared key verifies the assertion information.

8. The method of claim 7 wherein:

After the service providing server verifies the assertion information according to the shared key between the server and the identity providing server, the method further includes:

9. A method according to claim 7 or 8, wherein:

Before the service providing server receives the assertion information sent by the identity providing server to the user who wants to access the service providing server, the method further includes:

10. The method of claim 9 wherein:

The assertion information carries the random number, the identity information of the identity providing server, the identity information of the service providing server, the identity information of the user, a signature algorithm, and the identity providing server according to the shared secret The signature result calculated by the key;

The step of the service providing server verifying the assertion information according to the shared key between the service provider and the identity providing server includes: The service providing server calculates a signature result according to the identity information of the identity providing server, the identity information of the service providing server, the identity information of the user, the signature algorithm, and the shared key, and compares the calculation by itself. Whether the signed result is consistent with the signature result calculated by the identity providing server;

It is determined whether the generation time of the random number is currently the most recent and whether the random number is unique.

11. An information processing method, the method comprising:

12. The method of claim 11 wherein:

After the NMS sends the user's pseudonym and the lifetime corresponding to the pseudonym to the identity providing server, the method further includes:

13. An identity providing server, the identity providing server comprising:

a confirmation module, which is set to confirm that the user passes the access authentication;

An assertion information processing module, configured to: after the confirmation module confirms that the user passes the access authentication, generate an assertion information to the user according to the shared key between the identity providing server and the service providing server that the user wants to access, and The assertion information is sent to the service providing server.

The identity providing server according to claim 13, wherein the identity providing server further comprises:

The identity providing server according to claim 14, wherein the identity providing server further comprises:

Obtaining a module, configured to: after the confirmation module confirms that the user passes the access authentication, and before the assertion information processing module generates the assertion information for the user, obtain a pseudonym for the user and correspond to the pseudonym Survival period.

16. The identity providing server according to claim 15, wherein:

The obtaining module is configured to: send an anonymous identity request to a name mapping server (NMS) according to the anonymous service request of the user, and receive a pseudonym and a user of the user generated according to the anonymous identity request returned by the NMS The pseudonym corresponds to the lifetime.

17. The identity providing server according to claim 16, wherein:

The obtaining module is further configured to: receive an anonymous update request that is sent by the user and carry a specified user name and a corresponding lifetime, and send the anonymous update request to the NMS, and receive an update result returned by the NMS.

18. The identity providing server according to claim 17, wherein:

19. A service providing server, the service providing server comprising:

a receiving module, configured to receive the assertion information sent by the identity providing server to the user who wants to access the service providing server;

And a verification module configured to assert the information according to a shared key insurance certificate between the service providing server and the identity providing server.

The service providing server according to claim 19, wherein the service providing server further comprises:

And a service providing module, configured to: after the verifying module verifies, by using the assertion information, create an entry corresponding to the identity information of the user included in the assertion information, and provide a service to the user.

21. A name mapping server (NMS), the NMS comprising:

a receiving module, configured to: receive an anonymous identity request sent by the identity providing server, where the anonymous identity request carries the identity of the user;

22. The NMS of claim 21, wherein:

The generating and sending module is further configured to: receive an anonymous update request from the user that carries the specified user name and the corresponding lifetime, and perform an update process according to the anonymous update request, and return an update result.

An information processing system comprising the identity providing server according to any of claims 16-18 and the name mapping server according to any of claims 21-22.

A single sign-on system comprising the identity providing server of any of claims 13-18 and the service providing server of any of claims 19-20.

25. A single sign-on system, the system comprising the identity providing server of any of claims 16-18, the name mapping server of any of claims 21-22, and claims 19-20 A service providing server as claimed in the preceding claims.