WO2015176500A1 - 单点登录认证方法、设备、系统及计算机存储介质 - Google Patents
单点登录认证方法、设备、系统及计算机存储介质 Download PDFInfo
- Publication number
- WO2015176500A1 WO2015176500A1 PCT/CN2014/090688 CN2014090688W WO2015176500A1 WO 2015176500 A1 WO2015176500 A1 WO 2015176500A1 CN 2014090688 W CN2014090688 W CN 2014090688W WO 2015176500 A1 WO2015176500 A1 WO 2015176500A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- authentication
- user identity
- location information
- user
- terminal location
- Prior art date
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
Definitions
- the invention relates to a single sign-on (SSO) related technology in a mobile internet, and in particular to an SSO authentication method, device, system and computer storage medium.
- SSO single sign-on
- Single sign-on refers to the same user who accesses protected resources in different applications on the same server. It only needs to input the user name and password for identity authentication, and then seamlessly access all authorized resources without multiple times. Perform login authentication.
- a user's mobile terminal installs multiple applications of a large Internet company. These applications use single sign-on. After the user enters the account information for the first time, all applications will be automatically logged in with the relevant information of the account. . At this time, if the user mobile terminal is unfortunately stolen or lost, the user can directly log in to the above application after obtaining the mobile terminal, thereby stealing the user information. Therefore, in view of the fact that the user mobile terminal device is easy to lose, if the authentication validity policy of the authentication server is not strong, it is impossible to identify whether the account is used by a real user, thereby causing leakage of user information, which is extremely dangerous. Big.
- the embodiments of the present invention are expected to provide an SSO authentication method, device, system, and computer storage medium, which can improve the security of the mobile Internet client SSO system and avoid user information leakage.
- An embodiment of the present invention provides a single sign-on (SSO) authentication method, where the method includes:
- the authentication client obtains terminal location information, and sends an authentication request including the user basic information and the terminal location information;
- the user identity credential is used to authenticate the client to implement SSO authentication when logging in again.
- the method further includes: the authentication client receives the input user basic information.
- the user identity certificate is generated by the authentication server according to the user basic information and the terminal location information in the authentication request.
- the method further includes: the authentication client saves the user identity credential.
- the method further includes: when the authentication client logs in again, the SSO authentication is implemented by using the user identity credential.
- the SSO authentication by using the user identity credential when the authentication client logs in again includes: the authentication client obtains the terminal location information, and sends an authentication request including the user identity credential and the terminal location information, and receives the authentication request.
- the authentication success message is sent by the authentication server after the user identity certificate and the terminal location information in the user identity certificate are successfully verified.
- the embodiment of the present invention further provides an SSO authentication client, where the authentication client includes: a positioning module, a first sending module, and a receiving module;
- the positioning module is configured to acquire terminal location information
- the first sending module is configured to send an authentication request including user basic information and the terminal location information;
- the receiving module is configured to receive a user identity credential, and the user identity credential is used to recognize SSO authentication is implemented when the client logs in again.
- the authentication client further includes an input module configured to receive the input user basic information.
- the authentication client further includes a storage module configured to store the user identity certificate.
- the first sending module is further configured to send an authentication request that includes the user identity credential and the terminal location information;
- the receiving module is further configured to receive an authentication success message.
- An embodiment of the present invention further provides an SSO authentication system, where the system includes: an authentication client and an authentication server;
- the authentication client is configured to acquire terminal location information, and send an authentication request including the user basic information and the terminal location information to the authentication server;
- the authentication server is configured to check the basic information of the user, and after the verification succeeds, generate a user identity certificate according to the basic information of the user and the location information of the terminal, and return the user identity certificate to the authentication client. .
- the authentication client is further configured to receive the input user basic information, save the user identity certificate, and use the user identity certificate to implement SSO authentication when logging in again;
- the authentication server is further configured to extract user basic information and terminal location information in the authentication request.
- the verifying, by the authentication server, the basic information of the user includes: the authentication server matches the user basic information with the user information pre-stored by the authentication server, and if the matching is consistent, the verification succeeds; when the matching is inconsistent , the verification failed.
- implementing the SSO authentication by using the user identity certificate includes: the authentication client acquiring the terminal location information, and transmitting the The authentication request of the user identity certificate and the terminal location information is sent to the authentication server; the authentication server extracts the user identity certificate in the authentication request and checks, and after the verification succeeds, extracts the terminal location information and the authentication in the user identity certificate. The terminal location information in the request is verified, and after the verification succeeds, an authentication success message is returned to the authentication client.
- the authentication server extracts the user identity credential in the authentication request and the verification includes: the authentication server extracts the user identity credential in the authentication request, and determines whether the user credential is the user credential according to the user credential generation rule.
- the authentication server generates, determines that the authentication server generates, and the verification succeeds; otherwise, the verification fails.
- the authentication server extracting the terminal location information in the user identity credential and the terminal location in the authentication request.
- the information is determined according to the location information-based user identity verification rule saved by the authentication server, and determines whether the terminal location information in the authentication request meets the verification rule, and the verification succeeds when the verification rule is met; otherwise, the verification is performed. failure.
- the embodiment of the invention further provides a computer storage medium, wherein the computer storage medium stores computer executable instructions, and the computer executable instructions are used to execute the SSO authentication method described above.
- the authentication client obtains the terminal location information, and sends an authentication request including the basic information of the user and the location information of the terminal to the authentication server;
- the user basic information is verified, and after the verification is successful, the user identity certificate is generated according to the user basic information and the terminal location information, and the user identity certificate is returned to the authentication client; thus, the mobile internet client can be improved.
- the security of the SSO system thus avoiding the leakage of user information.
- FIG. 1 is a schematic flowchart of an SSO authentication method according to an embodiment of the present invention.
- FIG. 2 is a schematic flowchart of a method for SSO authentication according to Embodiment 2 of the present invention
- FIG. 3 is a schematic flowchart of a third SSO authentication method according to an embodiment of the present invention.
- FIG. 4 is a schematic flowchart of a method for authenticating an SSO according to an embodiment of the present invention
- FIG. 5 is a schematic structural diagram of a composition of an SSO authentication client according to an embodiment of the present invention.
- FIG. 6 is a schematic structural diagram of a structure of an SSO authentication system according to an embodiment of the present invention.
- FIG. 7 is a schematic structural diagram of a composition of an SSO authentication server according to an embodiment of the present invention.
- the authentication client obtains the terminal location information, and sends an authentication request including the user basic information and the terminal location information to the authentication server; the authentication server performs verification on the basic information of the user, and after the verification succeeds Generating a user identity credential according to the user basic information and the terminal location information, and returning the user identity credential to the authentication client.
- the authentication server returns an authentication success message when returning the user identity certificate to the authentication client;
- the user identity certificate returned by the authentication server to the authentication client is configured as the subsequent SSO authentication of the user.
- FIG. 1 is a schematic flowchart of an SSO authentication method according to an embodiment of the present invention. As shown in FIG. 1 , the SSO authentication method process in this embodiment includes:
- Step 101 The authentication client acquires terminal location information, and sends an authentication request including the user basic information and the terminal location information.
- the terminal is a terminal currently logged in to the authentication server, and the authentication client is included in the terminal;
- the method further includes: the authentication client receives the user basic information input by the user; the user basic information includes a user name and a password, and the like;
- the authentication client obtains the location information of the terminal through a Global Position System (GPS) and an assisted global positioning system (Assisted Global Positioning). Positioning methods such as System, AGPS) and hotspot positioning are obtained; the terminal location information may include latitude and longitude and the like.
- GPS Global Position System
- AGPS assisted global positioning system
- hotspot positioning are obtained; the terminal location information may include latitude and longitude and the like.
- Step 102 Receive a user identity certificate.
- the user identity credential is used to authenticate the client to implement SSO authentication when logging in again;
- the user identity credential is generated by the authentication server according to the user basic information and the terminal location information in the authentication request; specifically, the authentication server extracts the user basic information and the terminal location information in the authentication request, Determining the basic information of the user, and verifying the user identity certificate generated according to the basic information of the user and the location information of the terminal;
- the verifying the basic information of the user includes: matching the basic information of the user with the pre-stored user information, and if the matching is consistent, the verification is successful; when the matching is inconsistent, the verification fails;
- Generating the user identity credential according to the user basic information and the terminal location information includes: generating a user identity credential plaintext including the user basic information and the terminal location information, and encrypting the user credential clear text to generate a user identity
- the voucher here, the user credential plaintext includes at least the terminal location information, and may further include one or more of user basic information, user identifier, login time, and server information, and the information is separated by a separator. And the ranking order is not defined; the plaintext encryption of the user identity credential can be implemented by an encryption method such as symmetric encryption, asymmetric encryption, or MB5 encryption;
- the method further includes: receiving an authentication success message
- the method further includes: the authentication client saving the user identity credential.
- the method further includes: when the authentication client logs in again, using the user identity credential to implement SSO authentication; specifically: when the authentication client logs in again, The authentication client obtains the terminal location information, sends an authentication request including the user identity certificate and the terminal location information, and receives the authentication success. interest;
- the authentication success message is sent by the authentication server after the user identity certificate and the terminal location information in the user identity certificate are successfully verified; specifically, the authentication server extracts the user identity certificate in the authentication request and verifies and verifies After the success, the terminal location information in the user identity certificate is extracted and the terminal location information in the authentication request is verified, and after the verification is successful, the authentication success message is sent;
- the extracting the terminal location information in the user identity certificate and the terminal location information in the authentication request for verification comprises: extracting terminal location information in the user identity certificate and terminal location information in the authentication request, and the user is based on the location information according to the authentication server.
- the identity verification rule determines whether the terminal location information in the authentication request meets the verification rule, and determines that the verification is successful according to the verification rule; otherwise, the verification fails; where the verification rule may be
- the end position of the identity voucher is centered, and the circle covers a radius of 5 km. In practice, the radius length can be changed according to specific conditions.
- FIG. 2 is a schematic flowchart of a method for SSO authentication according to Embodiment 2 of the present invention. As shown in FIG. 2, the process of the SSO authentication method in this embodiment includes:
- Step 201 The authentication client receives basic user information input by the user.
- the user basic information includes a user name, a password, and the like.
- Step 202 The authentication client obtains the terminal location information, and sends an authentication request including the user basic information and the terminal location information.
- the authentication client obtains terminal location information specifically by using GPS, AGPS, and hot A positioning method such as point positioning is obtained; the terminal location information may include latitude and longitude and the like.
- Step 203 The authentication client receives the user identity certificate and the authentication success message.
- the user identity credential is used to authenticate the client to implement SSO authentication when logging in again;
- the user identity credential is generated by the authentication server according to the user basic information and the terminal location information in the authentication request; specifically, the authentication server extracts the user basic information and the terminal location information in the authentication request, Determining the basic information of the user, and verifying the user identity certificate generated according to the basic information of the user and the location information of the terminal;
- the verifying the basic information of the user includes: matching the basic information of the user with the pre-stored user information, and if the matching is consistent, the verification is successful; when the matching is inconsistent, the verification fails;
- Generating the user identity credential according to the user basic information and the terminal location information includes: generating a user identity credential plaintext including the user basic information and the terminal location information, and encrypting the user credential clear text to generate a user identity
- the voucher here, the user credential plaintext includes at least the terminal location information, and may further include one or more of user basic information, user identifier, login time, and server information, and the information is separated by a separator.
- the plaintext encryption of the user identity credential can be implemented by an encryption method such as symmetric encryption, asymmetric encryption or MB5 encryption.
- Step 204 The authentication client saves the user identity certificate.
- Step 205 The authentication client acquires terminal location information, and sends an authentication request including the user identity certificate and the terminal location information.
- Step 206 The authentication client receives the authentication success message.
- the authentication success message is sent by the authentication server after the user identity certificate and the terminal location information in the user identity certificate are successfully verified; specifically, the authentication server extracts the user identity certificate in the authentication request and verifies and verifies After successful, the terminal location information in the user identity certificate is extracted and the terminal location information in the authentication request is verified, and is verified after the verification succeeds.
- the authentication success message is sent by the authentication server after the user identity certificate and the terminal location information in the user identity certificate are successfully verified; specifically, the authentication server extracts the user identity certificate in the authentication request and verifies and verifies After successful, the terminal location information in the user identity certificate is extracted and the terminal location information in the authentication request is verified, and is verified after the verification succeeds.
- the authentication success message is sent by the authentication server after the user identity certificate and the terminal location information in the user identity certificate are successfully verified; specifically, the authentication server extracts the user identity certificate in the authentication request and verifies and verifies After successful, the terminal location information in the user identity certificate is extracted and the terminal location information in the authentication request is verified, and is verified after
- the extracting the terminal location information in the user identity credential and the terminal location information in the authentication request for verification comprises: extracting terminal location information in the user identity credential and terminal location information in the authentication request, according to the location information saved by the authentication server
- the user identity verification rule determines whether the terminal location information in the authentication request meets the verification rule, and if the verification rule is met, the verification succeeds; otherwise, the verification fails.
- FIG. 3 is a schematic flowchart of a third SSO authentication method according to an embodiment of the present invention.
- the present embodiment is an embodiment of an authentication client first login authentication system.
- the SSO authentication method process in this embodiment includes:
- Step 301 The authentication client receives basic user information input by the user.
- the user basic information includes a user name, a password, and the like.
- Step 302 The authentication client obtains the terminal location information, and sends an authentication request including the user basic information and the terminal location information to the authentication server.
- the acquiring client terminal location information may be specifically obtained by using a positioning manner such as GPS, AGPS, hotspot positioning, etc.; the terminal location information may include latitude and longitude and the like;
- the communication protocol between the authentication client and the authentication server may be the https protocol.
- Step 303 The authentication server extracts the user basic information and the terminal location information in the authentication request, and checks the basic information of the user to determine whether the verification is successful. If the verification is successful, step 304 is performed; otherwise, the execution is performed. Step 306;
- the verifying the basic information of the user includes: matching the basic information of the user with the user information stored by the user, and if the matching is consistent, the verification is successful; when the matching is inconsistent, The verification failed.
- Step 304 Generate a user identity credential according to the user basic information and the terminal location information, and return the user identity credential and the authentication success message to the authentication client.
- the generating the user identity credential according to the user basic information and the terminal location information comprises: generating a user identity credential plaintext including the user basic information and the terminal location information, and encrypting the user identity credential plaintext Generating a user identity credential;
- the user credential plaintext includes at least the terminal location information, and may further include: one or more of user basic information, user identifier, login time, and server information; and the encryption method It can be symmetric encryption, asymmetric encryption or MB5 encryption.
- Step 305 The authentication client saves the user identity certificate, and ends the process flow.
- Step 306 Return an authentication failure message to the authentication client.
- FIG. 4 is a schematic flowchart of a fourth SSO authentication method according to an embodiment of the present invention.
- This embodiment is an embodiment in which an authentication client re-logs into an authentication system by using a user identity credential based on the third embodiment.
- the present embodiment is SSO.
- the certification method process includes:
- Step 401 The authentication client obtains terminal location information, and sends an authentication request including the user identity certificate and the terminal location information to the authentication server.
- the terminal is a terminal currently logged in to the authentication server, and the authentication client is included in the terminal;
- the obtaining, by the authentication client, the location information of the terminal may be obtained by using a positioning manner such as GPS, AGPS, or hotspot positioning; the terminal location information may include latitude and longitude;
- the communication protocol between the authentication client and the authentication server may be the https protocol.
- Step 402 The authentication server extracts the user identity certificate in the authentication request, and checks the user identity certificate to determine whether the verification is successful, and when the verification is successful, step 403 is performed; when the verification fails, step 406 is performed;
- the verification of the user identity credential by the authentication server includes: an authentication service
- the device determines whether the user identity certificate is generated by the authentication server according to its own user identity credential generation rule, and determines that the authentication server generates the verification, and the verification succeeds; otherwise, the verification fails; here, the generation rule is an authentication server. Generate how user credentials are generated.
- Step 403 Extract terminal location information in the user identity certificate and terminal location information in the authentication request.
- Step 404 Check the terminal location information in the user identity certificate and the terminal location information in the authentication request, and determine whether the verification is successful. If the verification is successful, step 405 is performed; if the verification fails, step 406 is performed;
- the verifying the terminal location information in the user identity credential and the terminal location information in the authentication request includes: determining, according to the user identity credential verification rule of the authentication server based on the location information, whether the terminal location information in the authentication request conforms to the The rule determines that the verification succeeds when the rule is met; otherwise, the verification fails; here, the verification rule may be a circle coverage circle with a radius of 5 kilometers centering on the terminal location in the identity certificate.
- Step 405 Return the authentication success message to the authentication client, and end the processing flow.
- Step 406 Return an authentication failure message to the authentication client.
- the SSO authentication client includes: a positioning module 51, a first sending module 52, and a receiving module 53;
- the positioning module 51 is configured to acquire terminal location information.
- the first sending module 52 is configured to send an authentication request including user basic information and the terminal location information to the authentication server;
- the receiving module 53 is configured to receive a user identity certificate
- the user basic information includes a user name and a password, and the like
- the terminal location information may include latitude and longitude and the like
- the positioning module 51 obtains terminal location information, which can be specifically determined by GPS, AGPS, and hotspot. Bit positioning and other methods of obtaining;
- the user identity credential is used to authenticate the client to implement SSO authentication when logging in again;
- the user identity credential is generated by the authentication server according to the user basic information and the terminal location information in the authentication request; specifically, the authentication server extracts the user basic information and the terminal location information in the authentication request, The basic information of the user is verified, and after the verification is successful, the user identity certificate generated according to the basic information of the user and the location information of the terminal is used.
- the authentication client further includes an input module 54 and a storage module 55;
- the input module 54 is configured to receive input user basic information
- the storage module 55 is configured to store a user identity certificate.
- the first sending module 52 is further configured to send an authentication request including the user identity credential and the terminal location information to the authentication server;
- the receiving module 53 is further configured to receive an authentication success message.
- FIG. 6 is a schematic structural diagram of an SSO authentication system according to an embodiment of the present invention.
- the SSO authentication system component of the embodiment of the present invention includes: an authentication client 61 and an authentication server 62;
- the authentication client 61 is configured to acquire terminal location information, and send an authentication request including user basic information and the terminal location information to the authentication server;
- the authentication server 62 is configured to check the basic information of the user, and after the verification succeeds, generate a user identity certificate according to the basic information of the user and the location information of the terminal, and return the user identity certificate to the authentication client. end;
- the terminal is a terminal currently logged in to the authentication server, and the authentication client is included in the terminal;
- the user basic information includes a user name and a password
- the terminal location information may include latitude and longitude and the like
- the authentication client 61 obtains terminal location information, which may specifically be through GPS, AGPS, and hotspot. Positioning and other positioning methods are obtained;
- the verification of the basic information of the user by the authentication server includes: the authentication server matches the user basic information with the user information pre-stored by the authentication server, and if the matching is consistent, the verification succeeds; when the matching is inconsistent, the verification fails. .
- the authentication client 61 is further configured to receive the input user basic information, save the user identity credential; and, when logging in again, use the user identity credential to implement SSO authentication;
- the authentication server 62 is further configured to extract user basic information and terminal location information in the authentication request.
- implementing SSO authentication by using the user identity credential comprises: the authentication client 61 acquiring terminal location information, and transmitting the authentication including the user identity credential and the terminal location information.
- the authentication server 62 extracts the user identity credential in the authentication request and the verification includes: the authentication server extracts the user identity credential in the authentication request, and determines whether the user credential is the credential according to the user credential generation rule.
- the server generates, determines that the authentication server generates, and the verification succeeds; otherwise, the verification fails; where the generation rule is a generation manner of generating a user identity certificate by the authentication server;
- the authentication server 62 extracts the terminal location information in the user identity certificate and the terminal location information in the authentication request for verification, and the authentication server 62 extracts terminal location information in the user identity certificate and terminal location information in the authentication request, According to the location information-based user identity verification rule saved by the authentication server 62, determining whether the terminal location information in the authentication request meets the verification rule, and determining that the verification rule is met, the verification succeeds; otherwise, the verification is lost.
- the verification rule may be a range covered by a circle having a radius of 5 kilometers in a center of the terminal position in the identity certificate.
- FIG. 7 is a schematic structural diagram of a SSO authentication server according to an embodiment of the present invention. As shown in FIG. 7, the SSO authentication server includes: a verification module 71, a generation module 72, and a second sending module 73;
- the verification module 71 is configured to check the basic information of the user, and after the verification is successful, send the basic information of the user and the location information of the terminal to the generating module 72;
- the generating module 72 is configured to generate a user identity certificate according to the user basic information and the terminal location information;
- the second sending module 73 is configured to return the user identity certificate and the authentication success message to the authentication client.
- the verification module 71 performs verification on the basic information of the user, and the verification module 71 matches the basic information of the user with the stored basic information of the user, and if the matching is consistent, the verification succeeds; the matching is inconsistent. When the verification fails;
- the authentication server further includes a user information database 75 configured to store user information.
- the authentication server further includes an extraction module 74 configured to extract user basic information and terminal location information in the authentication request, and extract a user identity certificate in the authentication request, and terminal location information in the user identity certificate. And terminal location information in the authentication request.
- an extraction module 74 configured to extract user basic information and terminal location information in the authentication request, and extract a user identity certificate in the authentication request, and terminal location information in the user identity certificate. And terminal location information in the authentication request.
- the verification module 71 is further configured to verify the user identity certificate in the extracted authentication request, and after the verification succeeds, the terminal location information in the user identity certificate and the terminal location information in the authentication request. Perform verification
- the verification module 71 verifies the user identity credential in the extracted authentication request, and the verification module 71 determines, according to the user identity credential generation rule, whether the user identity credential is generated by the authentication server, and determines that it is The authentication server generates and the verification succeeds; otherwise, the school Failure
- the verification module 71 performs verification on the terminal location information in the user identity credential and the terminal location information in the authentication request, and the verification module 71 determines the authentication according to the user identity credential verification rule based on the location information. Whether the terminal location information in the request meets the verification rule, and the verification succeeds when the verification rule is met; otherwise, the verification fails; here, the verification rule may be centered on the terminal location in the identity certificate. The range covered by a circle with a radius of 5 km.
- the positioning module 51, the first sending module 52, the receiving module 53, the input module 54, the verifying module 71, the generating module 72, the second sending module 73, and the extracting module 74 are in actual application process.
- the memory module 55 and the user information database 75 can be implemented by a memory, or can be implemented by a single chip microcomputer, a Field Programmable Gate Array (FPGA), or a Digital Signal Processor (DSP). achieve.
- the embodiment of the invention further describes a computer storage medium, wherein the computer storage medium stores computer executable instructions, and the computer executable instructions are configured to execute the SSO authentication method shown in any one of FIG. 1 to FIG. .
- the disclosed apparatus and method may be implemented in other manners.
- the device embodiments described above are merely illustrative.
- the division of the unit is only a logical function division.
- there may be another division manner such as: multiple units or components may be combined, or Can be integrated into another system, or some features can be ignored or not executed.
- the coupling, or direct coupling, or communication connection of the components shown or discussed may be indirect coupling or communication connection through some interfaces, devices or units, and may be electrical, mechanical or other forms. of.
- the units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place.
- the party may also be distributed to multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.
- each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may be separately used as one unit, or two or more units may be integrated into one unit;
- the unit can be implemented in the form of hardware or in the form of hardware plus software functional units.
- the foregoing program may be stored in a computer readable storage medium, and the program is executed when executed.
- the foregoing storage medium includes: a mobile storage device, a random access memory (RAM), a read-only memory (ROM), a magnetic disk, or an optical disk.
- RAM random access memory
- ROM read-only memory
- magnetic disk or an optical disk.
- optical disk A medium that can store program code.
- the above-described integrated unit of the present invention may be stored in a computer readable storage medium if it is implemented in the form of a software function module and sold or used as a standalone product.
- the technical solution of the embodiments of the present invention may be embodied in the form of a software product in essence or in the form of a software product, which is stored in a storage medium and includes a plurality of instructions for making
- a computer device which may be a personal computer, server, or network device, etc.
- the foregoing storage medium includes various media that can store program codes, such as a mobile storage device, a RAM, a ROM, a magnetic disk, or an optical disk.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Telephonic Communication Services (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
本发明实施例公开了一种单点登录（SSO）认证方法，包括：认证客户端获取终端位置信息，并发送包含用户基本信息及所述终端位置信息的认证请求（101）；接收用户身份凭证（102），所述用户身份凭证用于认证客户端再次登录时实现SSO认证。本发明实施例还同时公开了一种SSO认证系统、设备及计算机存储介质。
Description
本发明涉及移动互联网中单点登录(Single Sign-On，SSO)相关技术，尤其涉及一种SSO认证方法、设备、系统及计算机存储介质。
单点登录是指在访问同一服务器不同应用中受保护资源的同一用户，只需要用户输入一次用户名和口令进行身份认证，后续就可以对所有被授权的资源进行无缝访问，而不需要多次进行登录认证。
单点登录技术的提出及广泛应用极大的提升了用户体验，提高了业务系统的效率，已经成为当前主流大型互联网和企业的首选账户认证授权方案，但是，单点登录技术对认证授权服务器有极高的要求，安全性是其中最大的隐患，特别是在移动互联网中。
假设如下一种场景：用户移动终端安装了某大型互联网公司的多个应用程序，这些应用采用单点登录方式，用户在首次输入了账号信息之后，以后所有的应用都会用该账号相关信息自动登录。此时，如果该用户移动终端不幸被盗或丢失，那么，他人拿到移动终端后直接就能登录到上述应用中，从而窃取用户信息。因此，鉴于用户移动终端设备易于丢失的特性，如果认证服务器的合法性校验策略安全性不强的话，便无法鉴别该账户是否为真实的用户所使用，从而造成用户信息的泄漏，危险性极大。
发明内容
本发明实施例期望提供一种SSO认证方法、设备、系统及计算机存储介质，能提高移动互联网客户端SSO系统的安全性，避免用户信息泄露。
本发明实施例的技术方案是这样实现的：
本发明实施例提供了一种单点登录(SSO)认证方法，所述方法包括：
认证客户端获取终端位置信息，并发送包含用户基本信息及所述终端位置信息的认证请求；
接收用户身份凭证，所述用户身份凭证用于认证客户端再次登录时实现SSO认证。
上述方案中，所述认证客户端获取终端位置信息之前，所述方法还包括：认证客户端接收输入的用户基本信息。
上述方案中，所述用户身份凭证由认证服务器依据所述认证请求中的所述用户基本信息及所述终端位置信息生成。
上述方案中，所述接收用户身份凭证之后，所述方法还包括：认证客户端保存所述用户身份凭证。
上述方案中，所述方法还包括：认证客户端再次登录时，利用所述用户身份凭证实现SSO认证。
上述方案中，所述认证客户端再次登录时利用所述用户身份凭证实现SSO认证包括：认证客户端获取终端位置信息，发送包含所述用户身份凭证及所述终端位置信息的认证请求，并接收认证成功消息；所述认证成功消息由认证服务器对用户身份凭证及所述用户身份凭证中的终端位置信息校验成功后发出。
本发明实施例还提供了一种SSO认证客户端，所述认证客户端包括：定位模块、第一发送模块及接收模块；其中，
所述定位模块，配置为获取终端位置信息；
所述第一发送模块，配置为发送包含用户基本信息及所述终端位置信息的认证请求；
所述接收模块，配置为接收用户身份凭证，所述用户身份凭证用于认
证客户端再次登录时实现SSO认证。
上述方案中，所述认证客户端还包括输入模块，配置为接收输入的用户基本信息。
上述方案中，所述认证客户端还包括存储模块，配置为存储用户身份凭证。
上述方案中，所述第一发送模块，还配置为发送包含所述用户身份凭证及所述终端位置信息的认证请求；
所述接收模块，还配置为接收认证成功消息。
本发明实施例还提供了一种SSO认证系统，所述系统包括：认证客户端及认证服务器；其中，
所述认证客户端，配置为获取终端位置信息，并发送包含用户基本信息及所述终端位置信息的认证请求给认证服务器；
所述认证服务器，配置为对所述用户基本信息进行校验，校验成功后，依据所述用户基本信息及所述终端位置信息生成用户身份凭证，并将所述用户身份凭证返回认证客户端。
上述方案中，所述认证客户端，还配置为接收输入的用户基本信息，保存所述用户身份凭证；并在再次登录时，利用所述用户身份凭证实现SSO认证；
所述认证服务器，还配置为提取所述认证请求中的用户基本信息和终端位置信息。
上述方案中，所述认证服务器对所述用户基本信息进行校验包括：所述认证服务器将所述用户基本信息与自身预先存储的用户信息进行匹配，匹配一致时，校验成功；匹配不一致时，校验失败。
上述方案中，所述认证客户端再次登录时，利用所述用户身份凭证实现SSO认证包括：所述认证客户端获取终端位置信息，并发送包含所述用
户身份凭证及所述终端位置信息的认证请求给认证服务器；所述认证服务器提取认证请求中的用户身份凭证并校验，校验成功后，提取所述用户身份凭证中的终端位置信息与认证请求中的终端位置信息进行校验，并在校验成功后，返回认证成功消息给认证客户端。
上述方案中，所述认证服务器提取认证请求中的用户身份凭证并校验包括：所述认证服务器提取认证请求中的用户身份凭证，依据自身的用户身份凭证生成规则判断所述用户身份凭证是否为所述认证服务器生成，确定是所述认证服务器生成，校验成功；否则，校验失败。
上述方案中，所述认证服务器提取所述用户身份凭证中终端位置信息与认证请求中终端位置信息进行校验包括：所述认证服务器提取所述用户身份凭证中终端位置信息与认证请求中终端位置信息，依据认证服务器保存的基于位置信息的用户身份凭证校验规则，判断认证请求中终端位置信息是否符合所述校验规则，确定符合所述校验规则时，校验成功；否则，校验失败。
本发明实施例还提供一种计算机存储介质，所述计算机存储介质中存储有计算机可执行指令，所述计算机可执行指令用于执行以上所述的SSO认证方法。
本发明实施例所提供的SSO认证方法、设备、系统及计算机存储介质，认证客户端获取终端位置信息，并发送包含所述用户基本信息及终端位置信息的认证请求给认证服务器；认证服务器对所述用户基本信息进行校验，校验成功后，依据所述用户基本信息及所述终端位置信息生成用户身份凭证，并将所述用户身份凭证返回给认证客户端；如此，能提高移动互联网客户端SSO系统的安全性，进而避免用户信息泄露。
图1为本发明实施例一SSO认证方法流程示意图；
图2为本发明实施例二SSO认证方法流程示意图；
图3为本发明实施例三SSO认证方法流程示意图；
图4为本发明实施例四SSO认证方法流程示意图；
图5为本发明实施例SSO认证客户端组成结构示意图；
图6为本发明实施例SSO认证系统组成结构示意图；
图7为本发明实施例SSO认证服务器组成结构示意图。
在本发明实施例中，认证客户端获取终端位置信息，并发送包含所述用户基本信息及终端位置信息的认证请求给认证服务器；认证服务器对所述用户基本信息进行校验，校验成功后，依据所述用户基本信息及所述终端位置信息生成用户身份凭证，并将所述用户身份凭证返回认证客户端。
优选地，认证服务器在向认证客户端返回用户身份凭证时，还返回认证成功消息；
优选地，认证服务器向认证客户端返回的用户身份凭证配置为该用户后续的SSO认证。
图1为本发明实施例一SSO认证方法流程示意图，如图1所示，本实施例SSO认证方法流程包括：
步骤101：认证客户端获取终端位置信息，并发送包含用户基本信息及所述终端位置信息的认证请求；
这里，所述终端为当前登录认证服务器的终端，所述认证客户端包含于所述终端；
所述认证客户端获取终端位置信息之前，所述方法还包括：认证客户端接收用户输入的用户基本信息；所述用户基本信息包括用户名和密码等；
所述认证客户端获取终端位置信息具体可通过全球定位系统(Global Position System，GPS)、辅助全球卫星定位系统(Assisted Global Positioning
System，AGPS)、热点定位等定位方式获得；所述终端位置信息可以包括经纬度等。
步骤102：接收用户身份凭证；
这里，所述用户身份凭证，用于认证客户端再次登录时实现SSO认证；
所述用户身份凭证，由认证服务器依据所述认证请求中的所述用户基本信息及所述终端位置信息生成；具体为认证服务器提取所述认证请求中的用户基本信息和终端位置信息，对所述用户基本信息进行校验，校验成功后，依据所述用户基本信息及所述终端位置信息生成的用户身份凭证；
所述对所述用户基本信息进行校验包括：将所述用户基本信息与预先存储的用户信息进行匹配，匹配一致时，校验成功；匹配不一致时，校验失败；
依据所述用户基本信息及所述终端位置信息生成用户身份凭证包括：生成包含所述用户基本信息及所述终端位置信息的用户身份凭证明文，并对所述用户身份凭证明文加密，生成用户身份凭证；这里，所述用户身份凭证明文至少包括所述终端位置信息，还可以包括：用户基本信息、用户标识、登录时间及服务器信息等的一种或多种，信息间以分隔符隔开，且没有排列次序限定；所述对所述用户身份凭证明文加密可通过对称加密、非对称加密或MB5加密等加密方法实现；
所述接收用户身份凭证时，所述方法还包括：接收认证成功消息；
所述接收用户身份凭证之后，所述方法还包括：所述认证客户端保存所述用户身份凭证。
优选地，所述认证客户端保存所述用户身份凭证之后，所述方法还包括：认证客户端再次登录时，利用所述用户身份凭证实现SSO认证；具体包括：当认证客户端再次登录时，认证客户端获取终端位置信息，发送包含所述用户身份凭证及所述终端位置信息的认证请求，并接收认证成功消
息；
这里，所述认证成功消息，由认证服务器对用户身份凭证及所述用户身份凭证中的终端位置信息校验成功后发出；具体为认证服务器提取认证请求中的用户身份凭证并校验，校验成功后，提取所述用户身份凭证中的终端位置信息与认证请求中的终端位置信息进行校验，并在校验成功后，发送的认证成功消息；
所述认证服务器提取认证请求中的用户身份凭证并校验包括：所述认证服务器提取认证请求中的用户身份凭证，依据自身的用户身份凭证生成规则判断所述用户身份凭证是否为所述认证服务器生成，确定是所述认证服务器生成，校验成功；否则，校验失败；这里，所述生成规则为认证服务器生成用户身份凭证的生成方式；
所述提取所述用户身份凭证中终端位置信息与认证请求中终端位置信息进行校验包括：提取所述用户身份凭证中终端位置信息与认证请求中终端位置信息，依据认证服务器基于位置信息的用户身份凭证校验规则，判断认证请求中终端位置信息是否符合所述校验规则，确定符合所述校验规则时，校验成功；否则，校验失败；这里，所述校验规则可以为以身份凭证中终端位置为中心，以长度为5公里为半径的圆覆盖的范围，在实际应用中可根据具体情况更改所述半径长度。
图2为本发明实施例二SSO认证方法流程示意图，如图2所示，本实施例SSO认证方法流程包括：
步骤201：认证客户端接收用户输入的用户基本信息；
这里，所述用户基本信息包括用户名、密码等。
步骤202：认证客户端获取终端位置信息，并发送包含用户基本信息及所述终端位置信息的认证请求；
这里，所述认证客户端获取终端位置信息具体可通过GPS、AGPS、热
点定位等定位方式获得；所述终端位置信息可以包括经纬度等。
步骤203：认证客户端接收用户身份凭证及认证成功消息；
这里，所述用户身份凭证，用于认证客户端再次登录时实现SSO认证；
所述用户身份凭证，由认证服务器依据所述认证请求中的所述用户基本信息及所述终端位置信息生成；具体为认证服务器提取所述认证请求中的用户基本信息和终端位置信息，对所述用户基本信息进行校验，校验成功后，依据所述用户基本信息及所述终端位置信息生成的用户身份凭证；
所述对所述用户基本信息进行校验包括：将所述用户基本信息与预先存储的用户信息进行匹配，匹配一致时，校验成功；匹配不一致时，校验失败；
依据所述用户基本信息及所述终端位置信息生成用户身份凭证包括：生成包含所述用户基本信息及所述终端位置信息的用户身份凭证明文，并对所述用户身份凭证明文加密，生成用户身份凭证；这里，所述用户身份凭证明文至少包括所述终端位置信息，还可以包括：用户基本信息、用户标识、登录时间及服务器信息等的一种或多种，信息间以分隔符隔开，且没有排列次序限定；所述对所述用户身份凭证明文加密可通过对称加密、非对称加密或MB5加密等加密方法实现。
步骤204：认证客户端保存所述用户身份凭证。
步骤205：认证客户端获取终端位置信息，并发送包含用户身份凭证及所述终端位置信息的认证请求。
步骤206：认证客户端接收认证成功消息；
这里，所述认证成功消息，由认证服务器对用户身份凭证及所述用户身份凭证中的终端位置信息校验成功后发出；具体为认证服务器提取认证请求中的用户身份凭证并校验，校验成功后，提取所述用户身份凭证中的终端位置信息与认证请求中的终端位置信息进行校验，并在校验成功后发
出的认证成功消息；
所述认证服务器提取认证请求中的用户身份凭证并校验包括：所述认证服务器提取认证请求中的用户身份凭证，依据自身的用户身份凭证生成规则判断所述用户身份凭证是否为所述认证服务器生成，确定是所述认证服务器生成，校验成功；否则，校验失败；
所述提取所述用户身份凭证中终端位置信息与认证请求中终端位置信息进行校验包括：提取所述用户身份凭证中终端位置信息与认证请求中终端位置信息，依据认证服务器保存的基于位置信息的用户身份凭证校验规则，判断认证请求中终端位置信息是否符合所述校验规则，确定符合所述校验规则时，校验成功；否则，校验失败。
图3为本发明实施例三SSO认证方法流程示意图，本实施为认证客户端首次登录认证系统实施例，如图3所示，本实施例SSO认证方法流程包括：
步骤301：认证客户端接收用户输入的用户基本信息；
这里，所述用户基本信息包括用户名、密码等。
步骤302：认证客户端获取终端位置信息，并发送包含用户基本信息及所述终端位置信息的认证请求给认证服务器；
这里，所述认证客户端获取终端位置信息具体可通过GPS、AGPS、热点定位等定位方式获得；所述终端位置信息可以包括经纬度等；
所述认证客户端及认证服务器之间的通信协议可以是https协议。
步骤303：认证服务器提取所述认证请求中的用户基本信息和终端位置信息，并对所述用户基本信息进行校验，判断校验是否成功，确定校验成功时，执行步骤304；否则，执行步骤306；
这里，所述对所述用户基本信息进行校验包括：将所述用户基本信息与自身存储的用户信息进行匹配，匹配一致时，校验成功；匹配不一致时，
校验失败。
步骤304：依据所述用户基本信息及所述终端位置信息生成用户身份凭证，并返回所述用户身份凭证及认证成功消息给认证客户端；
这里，所述依据所述用户基本信息及所述终端位置信息生成用户身份凭证包括：生成包含所述用户基本信息及所述终端位置信息的用户身份凭证明文，并对所述用户身份凭证明文加密，生成用户身份凭证；这里，所述用户身份凭证明文至少包括所述终端位置信息，还可以包括：用户基本信息、用户标识、登录时间及服务器信息等的一种或多种；所述加密方法可以为对称加密、非对称加密或MB5加密等。
步骤305：所述认证客户端保存所述用户身份凭证，结束本处理流程。
步骤306：返回认证失败消息给认证客户端。
图4为本发明实施例四SSO认证方法流程示意图，本实施例是在实施例三的基础上认证客户端利用用户身份凭证再次登录认证系统的实施例，如图4所示，本实施例SSO认证方法流程包括：
步骤401：认证客户端获取终端位置信息，并发送包含用户身份凭证及所述终端位置信息的认证请求给认证服务器；
这里，所述终端为当前登录认证服务器的终端，所述认证客户端包含于所述终端；
所述认证客户端获取终端位置信息具体可通过GPS、AGPS、热点定位等定位方式获得；所述终端位置信息可以包括经纬度等；
所述认证客户端及认证服务器之间的通信协议可以是https协议。
步骤402：认证服务器提取认证请求中的用户身份凭证，并对所述用户身份凭证进行校验，判断校验是否成功，确定校验成功时，执行步骤403；校验失败时，执行步骤406；
这里，所述认证服务器对所述用户身份凭证进行校验包括：认证服务
器依据自身的用户身份凭证生成规则判断所述用户身份凭证是否为所述认证服务器生成，确定是所述认证服务器生成，校验成功；否则，校验失败；这里，所述生成规则为认证服务器生成用户身份凭证的生成方式。
步骤403：提取所述用户身份凭证中的终端位置信息及认证请求中的终端位置信息。
步骤404：对用户身份凭证中的终端位置信息与认证请求中的终端位置信息进行校验，并判断校验是否成功，校验成功时，执行步骤405；校验失败，执行步骤406；
这里，所述对用户身份凭证中的终端位置信息与认证请求中的终端位置信息进行校验包括：依据认证服务器基于位置信息的用户身份凭证校验规则，判断认证请求中终端位置信息是否符合所述规则，确定符合所述规则时，校验成功；否则，校验失败；这里，所述校验规则可以为以身份凭证中终端位置为中心，以5公里为半径的圆覆盖的范围。
步骤405：返回认证成功消息给认证客户端，结束本处理流程。
步骤406：返回认证失败消息给认证客户端。
图5为本发明实施例SSO认证客户端组成结构示意图；如图5所示，本发明实施例SSO认证客户端组成包括：定位模块51、第一发送模块52及接收模块53；其中，
所述定位模块51，配置为获取终端位置信息；
所述第一发送模块52，配置为发送包含用户基本信息及所述终端位置信息的认证请求给认证服务器；
所述接收模块53，配置为接收用户身份凭证；
这里，所述用户基本信息包括用户名和密码等，所述终端位置信息可以包括经纬度等；
所述定位模块51获取终端位置信息具体可通过GPS、AGPS、热点定
位等定位方式获得；
所述用户身份凭证用于认证客户端再次登录时实现SSO认证；
所述用户身份凭证，由认证服务器依据所述认证请求中的所述用户基本信息及所述终端位置信息生成；具体为认证服务器提取所述认证请求中的用户基本信息和终端位置信息，对所述用户基本信息进行校验，校验成功后，依据所述用户基本信息及所述终端位置信息生成的用户身份凭证。
优选地，所述认证客户端还包括输入模块54和存储模块55；其中，
所述输入模块54，配置为接收输入的用户基本信息；
所述存储模块55，配置为存储用户身份凭证。
优选地，所述第一发送模块52，还配置为发送包含所述用户身份凭证及所述终端位置信息的认证请求给认证服务器；
所述接收模块53，还配置为接收认证成功消息。
图6为本发明实施例SSO认证系统组成结构示意图，如图6所示，本发明实施例SSO认证系统组成包括：认证客户端61及认证服务器62；其中，
所述认证客户端61，配置为获取终端位置信息，并发送包含用户基本信息及所述终端位置信息的认证请求给认证服务器；
所述认证服务器62，配置为对所述用户基本信息进行校验，校验成功后，依据所述用户基本信息及所述终端位置信息生成用户身份凭证，并将所述用户身份凭证返回认证客户端；
这里，所述终端为当前登录认证服务器的终端，所述认证客户端包含于所述终端；
所述用户基本信息包括用户名和密码等，所述终端位置信息可以包括经纬度等；
所述认证客户端61获取终端位置信息具体可通过GPS、AGPS、热点
定位等定位方式获得；
所述认证服务器对所述用户基本信息进行校验包括：所述认证服务器将所述用户基本信息与自身预先存储的用户信息进行匹配，匹配一致时，校验成功；匹配不一致时，校验失败。
优选地，所述认证客户端61，还配置为接收输入的用户基本信息，保存所述用户身份凭证；并在再次登录时，利用所述用户身份凭证实现SSO认证；
所述认证服务器62，还配置为提取所述认证请求中的用户基本信息和终端位置信息；
这里，所述认证客户端61再次登录时，利用所述用户身份凭证实现SSO认证包括：所述认证客户端61获取终端位置信息，并发送包含所述用户身份凭证及所述终端位置信息的认证请求给认证服务器62；所述认证服务器62提取认证请求中的用户身份凭证并校验，校验成功后，提取所述用户身份凭证中的终端位置信息与认证请求中的终端位置信息进行校验，并在校验成功后，返回认证成功消息给认证客户端61；其中，
所述认证服务器62提取认证请求中的用户身份凭证并校验包括：所述认证服务器提取认证请求中的用户身份凭证，依据自身的用户身份凭证生成规则判断所述用户身份凭证是否为所述认证服务器生成，确定是所述认证服务器生成，校验成功；否则，校验失败；这里，所述生成规则为认证服务器生成用户身份凭证的生成方式；
所述认证服务器62提取所述用户身份凭证中终端位置信息与认证请求中终端位置信息进行校验包括：所述认证服务器62提取所述用户身份凭证中终端位置信息与认证请求中终端位置信息，依据认证服务器62保存的基于位置信息的用户身份凭证校验规则，判断认证请求中终端位置信息是否符合所述校验规则，确定符合所述校验规则时，校验成功；否则，校验失
败；这里，所述校验规则可以为以身份凭证中终端位置为中心，以长度为5公里为半径的圆覆盖的范围。
图7为本发明实施例SSO认证服务器组成结构示意图；如图7所示，本发明实施例SSO认证服务器组成包括：校验模块71、生成模块72及第二发送模块73；其中，
所述校验模块71，配置为对所述用户基本信息进行校验，并在校验成功后，发送所述用户基本信息及所述终端位置信息给生成模块72；
所述生成模块72，配置为依据所述用户基本信息及所述终端位置信息生成用户身份凭证；
所述第二发送模块73，配置为返回所述用户身份凭证及认证成功消息给认证客户端；
这里，所述校验模块71对所述用户基本信息进行校验包括：所述校验模块71将所述用户基本信息与存储的用户基本信息进行匹配，匹配一致时，校验成功；匹配不一致时，校验失败；
相应的，所述认证服务器还包括用户信息数据库75，配置为存储用户信息。
优选地，所述认证服务器还包括提取模块74，配置为提取所述认证请求中的用户基本信息和终端位置信息，以及提取认证请求中的用户身份凭证、所述用户身份凭证中的终端位置信息及认证请求中的终端位置信息。
优选地所述校验模块71，还配置为校验提取的认证请求中的用户身份凭证，并在校验成功后，对所述用户身份凭证中的终端位置信息与认证请求中的终端位置信息进行校验；
这里，所述校验模块71校验提取的认证请求中的用户身份凭证包括：所述校验模块71依据用户身份凭证生成规则判断所述用户身份凭证是否为所述认证服务器生成，确定是所述认证服务器生成，校验成功；否则，校
验失败；
所述校验模块71对所述用户身份凭证中的终端位置信息与认证请求中的终端位置信息进行校验包括：所述校验模块71依据基于位置信息的用户身份凭证校验规则，判断认证请求中终端位置信息是否符合所述校验规则，确定符合所述校验规则时，校验成功；否则，校验失败；这里，所述校验规则可以为以身份凭证中终端位置为中心，以长度为5公里为半径的圆覆盖的范围。
本发明实施例中，所述定位模块51、第一发送模块52、接收模块53、输入模块54、校验模块71、生成模块72、第二发送模块73、提取模块74在实际应用过程中，既可以由软件实现，也可以通过单片机、现场可编程门阵列(Field Programmable Gate Array，FPGA)或数字信号处理器(Digital Signal Processor，DSP)实现，所述存储模块55、用户信息数据库75可由存储器实现。
本发明实施例还记载一种计算机存储介质，所述计算机存储介质中存储有计算机可执行指令，所述计算机可执行指令配置为执行图1至如图4任一附图所示的SSO认证方法。
在本发明所提供的几个实施例中，应该理解到，所揭露的设备和方法，可以通过其它的方式实现。以上所描述的设备实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，如：多个单元或组件可以结合，或可以集成到另一个系统，或一些特征可以忽略，或不执行。另外，所显示或讨论的各组成部分相互之间的耦合、或直接耦合、或通信连接可以是通过一些接口，设备或单元的间接耦合或通信连接，可以是电性的、机械的或其它形式的。
上述作为分离部件说明的单元可以是、或也可以不是物理上分开的，作为单元显示的部件可以是、或也可以不是物理单元，即可以位于一个地
方，也可以分布到多个网络单元上；可以根据实际的需要选择其中的部分或全部单元来实现本实施例方案的目的。
另外，在本发明各实施例中的各功能单元可以全部集成在一个处理单元中，也可以是各单元分别单独作为一个单元，也可以两个或两个以上单元集成在一个单元中；上述集成的单元既可以采用硬件的形式实现，也可以采用硬件加软件功能单元的形式实现。
本领域普通技术人员可以理解：实现上述方法实施例的全部或部分步骤可以通过程序指令相关的硬件来完成，前述的程序可以存储于一计算机可读取存储介质中，该程序在执行时，执行包括上述方法实施例的步骤；而前述的存储介质包括：移动存储设备、随机存取存储器(RAM，Random Access Memory)、只读存储器(ROM，Read-Only Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
或者，本发明上述集成的单元如果以软件功能模块的形式实现并作为独立的产品销售或使用时，也可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明实施例的技术方案本质上或者说对相关技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机、服务器、或者网络设备等)执行本发明各个实施例所述方法的全部或部分。而前述的存储介质包括：移动存储设备、RAM、ROM、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本发明的具体实施方式，但本发明的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应以所述权利要求的保护范围为准。。
Claims (17)
- 一种单点登录SSO认证方法，所述方法包括：认证客户端获取终端位置信息，并发送包含用户基本信息及所述终端位置信息的认证请求；接收用户身份凭证，所述用户身份凭证用于认证客户端再次登录时实现SSO认证。
- 根据权利要求1所述方法，其中，所述认证客户端获取终端位置信息之前，所述方法还包括：认证客户端接收输入的用户基本信息。
- 根据权利要求1所述方法，其中，所述用户身份凭证由认证服务器依据所述认证请求中的所述用户基本信息及所述终端位置信息生成。
- 根据权利要求1至3任一项所述方法，其中，所述接收用户身份凭证之后，所述方法还包括：认证客户端保存所述用户身份凭证。
- 根据权利要求4所述方法，其中，所述方法还包括：认证客户端再次登录时，利用所述用户身份凭证实现SSO认证。
- 根据权利要求5所述方法，其中，所述认证客户端再次登录时利用所述用户身份凭证实现SSO认证包括：认证客户端获取终端位置信息，发送包含所述用户身份凭证及所述终端位置信息的认证请求，并接收认证成功消息；所述认证成功消息由认证服务器对用户身份凭证及所述用户身份凭证中的终端位置信息校验成功后发出。
- 一种SSO认证客户端，所述认证客户端包括：定位模块、第一发送模块及接收模块；其中，所述定位模块，配置为获取终端位置信息；所述第一发送模块，配置为发送包含用户基本信息及所述终端位置信息的认证请求；所述接收模块，配置为接收用户身份凭证，所述用户身份凭证用于认 证客户端再次登录时实现SSO认证。
- 根据权利要求7所述认证客户端，其中，所述认证客户端还包括输入模块，配置为接收输入的用户基本信息。
- 根据权利要求7或8所述认证客户端，其中，所述认证客户端还包括存储模块，配置为存储用户身份凭证。
- 根据权利要求9所述认证客户端，其中，所述第一发送模块，还配置为发送包含所述用户身份凭证及所述终端位置信息的认证请求；所述接收模块，还配置为接收认证成功消息。
- 一种SSO认证系统，所述系统包括：认证客户端及认证服务器；其中，所述认证客户端，配置为获取终端位置信息，并发送包含用户基本信息及所述终端位置信息的认证请求给认证服务器；所述认证服务器，配置为对所述用户基本信息进行校验，校验成功后，依据所述用户基本信息及所述终端位置信息生成用户身份凭证，并将所述用户身份凭证返回认证客户端。
- 根据权利要求11所述认证系统，其中，所述认证客户端，还配置为接收输入的用户基本信息，保存所述用户身份凭证；并在再次登录时，利用所述用户身份凭证实现SSO认证；所述认证服务器，还配置为提取所述认证请求中的用户基本信息和终端位置信息。
- 根据权利要求11所述认证系统，其中，所述认证服务器对所述用户基本信息进行校验包括：所述认证服务器将所述用户基本信息与自身预先存储的用户信息进行匹配，匹配一致时，校验成功；匹配不一致时，校验失败。
- 根据权利要求12所述认证系统，其中，所述认证客户端再次登录 时，利用所述用户身份凭证实现SSO认证包括：所述认证客户端获取终端位置信息，并发送包含所述用户身份凭证及所述终端位置信息的认证请求给认证服务器；所述认证服务器提取认证请求中的用户身份凭证并校验，校验成功后，提取所述用户身份凭证中的终端位置信息与认证请求中的终端位置信息进行校验，并在校验成功后，返回认证成功消息给认证客户端。
- 根据权利要求14所述认证系统，其中，所述认证服务器提取认证请求中的用户身份凭证并校验包括：所述认证服务器提取认证请求中的用户身份凭证，依据自身的用户身份凭证生成规则判断所述用户身份凭证是否为所述认证服务器生成，确定是所述认证服务器生成，校验成功；否则，校验失败。
- 根据权利要求14所述认证系统，其中，所述认证服务器提取所述用户身份凭证中终端位置信息与认证请求中终端位置信息进行校验包括：所述认证服务器提取所述用户身份凭证中终端位置信息与认证请求中终端位置信息，依据认证服务器保存的基于位置信息的用户身份凭证校验规则，判断认证请求中终端位置信息是否符合所述校验规则，确定符合所述校验规则时，校验成功；否则，校验失败。
- 一种计算机存储介质，所述计算机存储介质中存储有计算机可执行指令，所述计算机可执行指令用于权利要求1至6任一项所述的单点登录SSO认证方法。
Applications Claiming Priority (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410216268.9A CN105101199A (zh) | 2014-05-21 | 2014-05-21 | 一种单点登录认证方法、设备及系统 |
| CN201410216268.9 | 2014-05-21 |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| WO2015176500A1 true WO2015176500A1 (zh) | 2015-11-26 |
Family
ID=54553359
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| PCT/CN2014/090688 WO2015176500A1 (zh) | 2014-05-21 | 2014-11-10 | 单点登录认证方法、设备、系统及计算机存储介质 |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN105101199A (zh) |
| WO (1) | WO2015176500A1 (zh) |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106302479A (zh) * | 2016-08-18 | 2017-01-04 | 武汉斗鱼网络科技有限公司 | 一种用于多业务互联网网站的单点登录方法及系统 |
| CN111565179A (zh) * | 2020-04-27 | 2020-08-21 | 北京奇艺世纪科技有限公司 | 身份校验方法、装置、电子设备及存储介质 |
| CN113037742A (zh) * | 2021-03-04 | 2021-06-25 | 上海华申智能卡应用系统有限公司 | 一种指纹认证方法及系统 |
| CN114158046A (zh) * | 2021-12-30 | 2022-03-08 | 支付宝(杭州)信息技术有限公司 | 一键登录业务的实现方法和装置 |
| CN114938305A (zh) * | 2022-05-24 | 2022-08-23 | 中国矿业大学 | 一种金融设备的安全认证方法、系统及存储介质 |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107634904A (zh) * | 2017-11-07 | 2018-01-26 | 北京恒华伟业科技股份有限公司 | 一种即时通讯交互方法及系统 |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101232372A (zh) * | 2007-01-26 | 2008-07-30 | 华为技术有限公司 | 认证方法、认证系统和认证装置 |
| CN103118325A (zh) * | 2011-11-02 | 2013-05-22 | 株式会社三菱东京Ufj银行 | 认证系统、认证方法以及认证服务器 |
| CN103685282A (zh) * | 2013-12-18 | 2014-03-26 | 飞天诚信科技股份有限公司 | 一种基于单点登录的身份认证方法 |
| CN103716292A (zh) * | 2012-09-29 | 2014-04-09 | 西门子公司 | 一种跨域的单点登录的方法和设备 |
Family Cites Families (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20030159072A1 (en) * | 2002-02-04 | 2003-08-21 | Atreus Systems Corp. | Single sign-on for multiple network -based services |
| CN101043331A (zh) * | 2006-06-30 | 2007-09-26 | 华为技术有限公司 | 一种为网络设备分配地址的系统和方法 |
| JP5179298B2 (ja) * | 2007-09-27 | 2013-04-10 | 株式会社日立製作所 | アクセス認可システム、アクセス制御サーバ、およびビジネスプロセス実行システム |
| CN101902327B (zh) * | 2009-06-01 | 2012-05-23 | 中国移动通信集团公司 | 一种实现单点登录的方法、设备及其系统 |
| US8437742B2 (en) * | 2009-10-16 | 2013-05-07 | At&T Intellectual Property I, L.P. | Systems and methods for providing location-based application authentication using a location token service |
-
2014
- 2014-05-21 CN CN201410216268.9A patent/CN105101199A/zh active Pending
- 2014-11-10 WO PCT/CN2014/090688 patent/WO2015176500A1/zh active Application Filing
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101232372A (zh) * | 2007-01-26 | 2008-07-30 | 华为技术有限公司 | 认证方法、认证系统和认证装置 |
| CN103118325A (zh) * | 2011-11-02 | 2013-05-22 | 株式会社三菱东京Ufj银行 | 认证系统、认证方法以及认证服务器 |
| CN103716292A (zh) * | 2012-09-29 | 2014-04-09 | 西门子公司 | 一种跨域的单点登录的方法和设备 |
| CN103685282A (zh) * | 2013-12-18 | 2014-03-26 | 飞天诚信科技股份有限公司 | 一种基于单点登录的身份认证方法 |
Cited By (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106302479A (zh) * | 2016-08-18 | 2017-01-04 | 武汉斗鱼网络科技有限公司 | 一种用于多业务互联网网站的单点登录方法及系统 |
| CN106302479B (zh) * | 2016-08-18 | 2019-03-05 | 武汉斗鱼网络科技有限公司 | 一种用于多业务互联网网站的单点登录方法及系统 |
| CN111565179A (zh) * | 2020-04-27 | 2020-08-21 | 北京奇艺世纪科技有限公司 | 身份校验方法、装置、电子设备及存储介质 |
| CN111565179B (zh) * | 2020-04-27 | 2022-12-06 | 北京奇艺世纪科技有限公司 | 身份校验方法、装置、电子设备及存储介质 |
| CN113037742A (zh) * | 2021-03-04 | 2021-06-25 | 上海华申智能卡应用系统有限公司 | 一种指纹认证方法及系统 |
| CN114158046A (zh) * | 2021-12-30 | 2022-03-08 | 支付宝(杭州)信息技术有限公司 | 一键登录业务的实现方法和装置 |
| CN114158046B (zh) * | 2021-12-30 | 2024-04-23 | 支付宝(杭州)信息技术有限公司 | 一键登录业务的实现方法和装置 |
| CN114938305A (zh) * | 2022-05-24 | 2022-08-23 | 中国矿业大学 | 一种金融设备的安全认证方法、系统及存储介质 |
Also Published As
| Publication number | Publication date |
|---|---|
| CN105101199A (zh) | 2015-11-25 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US20220215082A1 (en) | Method and apparatus for facilitating the login of an account | |
| US10402797B2 (en) | Secured authentication and transaction authorization for mobile and internet-of-things devices | |
| WO2015176500A1 (zh) | 单点登录认证方法、设备、系统及计算机存储介质 | |
| CN105337949B (zh) | 一种SSO认证方法、web服务器、认证中心和token校验中心 | |
| US9529985B2 (en) | Global authentication service using a global user identifier | |
| KR101708587B1 (ko) | 양방향 권한 부여 시스템, 클라이언트 및 방법 | |
| WO2017028804A1 (zh) | 一种Web实时通信平台鉴权接入方法及装置 | |
| US10206099B1 (en) | Geolocation-based two-factor authentication | |
| WO2017041621A1 (zh) | 基于认证设备进行注册的方法和设备 | |
| CN104917727B (zh) | 一种帐户鉴权的方法、系统及装置 | |
| KR101214839B1 (ko) | 인증 방법 및 그 시스템 | |
| US20150106900A1 (en) | Mobile network-based multi-factor authentication | |
| US20180295514A1 (en) | Method and apparatus for facilitating persistent authentication | |
| GB2547472A (en) | Method and system for authentication | |
| US20160381001A1 (en) | Method and apparatus for identity authentication between systems | |
| CN106921663B (zh) | 基于智能终端软件/智能终端的身份持续认证系统及方法 | |
| US9208299B2 (en) | Secure user authentication with improved one-time-passcode verification | |
| CN109347864B (zh) | 基于虚拟专用网络的单点登录方法及装置 | |
| CN103139200A (zh) | 一种web service单点登录的方法 | |
| CN104394214A (zh) | 一种通过接入控制保护桌面云服务的方法及系统 | |
| WO2017076216A1 (zh) | 服务器、移动终端、网络实名认证系统及方法 | |
| WO2016054990A1 (zh) | 安全校验方法、装置、终端及服务器 | |
| CN105993156B (zh) | 服务器访问验证方法以及装置 | |
| WO2019173620A1 (en) | Method and apparatus for facilitating frictionless two-factor authentication | |
| WO2018099407A1 (zh) | 账户认证登录方法及装置 |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| 121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 14892442 Country of ref document: EP Kind code of ref document: A1 |
|
| NENP | Non-entry into the national phase |
Ref country code: DE |
|
| 122 | Ep: pct application non-entry in european phase |
Ref document number: 14892442 Country of ref document: EP Kind code of ref document: A1 |