WO2021031689A1

WO2021031689A1 - Single sign-on method, device, and system

Info

Publication number: WO2021031689A1
Application number: PCT/CN2020/097895
Authority: WO
Inventors: 许建东
Original assignee: 北京国双科技有限公司
Priority date: 2019-08-19
Filing date: 2020-06-24
Publication date: 2021-02-25
Also published as: CN112398799A

Abstract

Embodiments of the present invention provide a single sign-on method, a device, and a system, pertaining to the technical field of network security, for enhancing data security of application servers in the single sign-on technique. The method comprises: receiving a sign-on request sent by a terminal apparatus, the sign-on request carrying a certificate of the terminal apparatus and used to request a sign-on credential for signing on to a single sign-on (SSO) system; sending a first authentication request to a blockchain network, the first authentication request being used to request the blockchain network to authenticate, according to verification of the certificate, whether the certificate is valid; receiving a first authentication response sent by the blockchain network; and if the first authentication response indicates that the certificate is valid, sending the sign-on credential to the terminal apparatus, and writing, according to permission information of the terminal apparatus, access permission corresponding to the sign-on credential in the blockchain network. The embodiments of the present invention are used to perform security authentication on terminal apparatuses attempting to access an application server in an SSO system.

Description

Single sign-on method, device and system

This application is filed based on a Chinese patent application with the application number 201910764781.4 and the filing date on August 19, 2019, and claims the priority of the Chinese patent application of the Chinese patent application. The entire content of the Chinese patent application is incorporated into this application as a reference.

Technical field

The present invention relates to the technical field of network security, in particular to a single sign-on method, device and system.

Background technique

Enterprise companies or organizations often have multiple application servers. In order to improve user or employee efficiency and simplify management, companies or organizations generally deploy Single Sign On (SSO). Through the deployment of SSO, users only need to log in. All mutually trusted application servers can be accessed at one time.

As network hackers evolve in the ability and means of stealing user credentials (such as account numbers and passwords), login protection has become increasingly unreliable; and because of the user credentials stolen by attackers after logging into any application server in SSO , The attacker can obtain data in all application servers that trust the application server. Therefore, compared with conventional application servers, the data security of the application server in SSO is lower. For the security of application server data in SSO, the prior art proposes to replace the original user name and password mechanism with a certificate-based user identification mechanism during identity verification, although certificate-based user identification is simpler than the original user name and password The mechanism is more secure, but for small companies or organizations, certificate verification is very challenging. In addition, even if the certificate-based user identification mechanism is adopted, the attacker can forge the root certificate and then forge the user certificate. Therefore, even if the application server in SSO uses the certificate-based user identification mechanism to replace the username and password mechanism during authentication, SSO The application server in it may still be accessed by an attacker, causing data leakage.

Summary of the invention

In view of this, the embodiments of the present invention provide a single sign-on method, device, and system for improving the security of application server data in SSO.

In order to achieve the foregoing objectives, the embodiments of the present invention provide technical solutions as follows:

In the first aspect, an embodiment of the present invention provides a single sign-on method applied to an identity authentication server, and the method includes:

Receiving a login request sent by a terminal device; the login request carries a certificate of the terminal device, and is used to request to obtain a login credential for logging in to a single sign-on system SSO;

Sending a first verification request to a blockchain network, where the first verification request is used to request the blockchain network to verify whether the certificate is valid according to the verification of the certificate;

Receiving the first verification response sent by the blockchain network;

In the case that the first verification response indicates that the certificate is valid, the login credential is sent to the terminal device, and the log-in credential is written to the blockchain network according to the authority information of the terminal device. access permission.

As an optional implementation manner of the embodiment of the present invention, before sending the first verification request to the blockchain network, the method further includes:

Receiving a registration request sent by the terminal device, the registration request carrying user information;

Generating the certificate according to the user profile and the authority information;

Send the certificate to the terminal device, and write the verification of the certificate into the blockchain network.

As an optional implementation manner of the embodiment of the present invention, after sending the certificate to the terminal device and writing the verification of the certificate into the blockchain network, the method further includes: deleting The certificate generated by the user profile and the authority information.

As an optional implementation manner of the embodiment of the present invention, the method further includes:

In a case where the first verification response indicates that the certificate is invalid, sending prompt information to the terminal device;

Wherein, the prompt information is used to prompt that the certificate of the terminal device is invalid.

In the second aspect, an embodiment of the present invention provides a single sign-on method, which is applied to a target application server in a single sign-on system SSO, and the method includes:

Receiving an access request sent by a terminal device, where the access request carries login credentials;

Send a second verification request to the blockchain network, the second verification request is used to request the blockchain network to verify whether the terminal device has the permission to access the target application server according to the access permissions corresponding to the login credentials ；

Receiving a second verification response sent by the blockchain network;

In a case where the second verification response indicates that the terminal device has the authority to access the target application server, the terminal device is allowed to access.

If the second verification response indicates that the terminal device does not have the authority to access the target application server, the terminal device is denied access.

In the third aspect, an embodiment of the present invention provides a single sign-on method, including:

The terminal device sends a login request to the identity authentication server; the login request carries the certificate of the terminal device, and is used to request to obtain the login credentials for logging in to the single sign-on system SSO;

Sending, by the identity authentication server, a first verification request to a blockchain network, the first verification request being used to request the blockchain network to verify whether the certificate is valid according to the verification of the certificate;

The identity authentication server receives the first verification response sent by the blockchain network;

In the case that the first verification response indicates that the certificate is valid, the identity authentication server sends the login credential to the terminal device, and writes the login credentials to the blockchain network according to the authority information of the terminal device. Describe the access rights corresponding to the login credentials;

An access request sent by the terminal device to the target application server in the SSO, where the access request carries login credentials;

The target application server sends a second verification request to the blockchain network, and the second verification request is used to request the blockchain network to verify whether the terminal device has access to the The permissions of the target application server;

The target application server receives the second verification response sent by the blockchain network;

In a case where the second verification response indicates that the terminal device has the authority to access the target application server, the target application server allows the terminal device to access.

As an optional implementation manner of the embodiment of the present invention, before the terminal device sends a login request to the identity authentication server, the method further includes:

The terminal device sends a registration request to the identity authentication server, and the registration request carries user information;

The identity authentication server generates the certificate according to the user profile and the authority information;

The identity authentication server sends the certificate to the terminal device, and writes the verification of the certificate into the blockchain network.

As an optional implementation manner of the embodiment of the present invention, after the identity authentication server sends the certificate to the terminal device, and writes the verification of the certificate into the blockchain network, the Methods also include:

The identity authentication server deletes the certificate generated according to the user profile and the authority information.

As an optional implementation manner of the embodiment of the present invention, in a case where the first verification response indicates that the certificate is invalid, the identity authentication server sends prompt information to the terminal device;

As an optional embodiment of the embodiment of the present invention, when the second verification response indicates that the terminal device does not have the right to access the target application server, the target application server refuses the terminal device to perform access.

In a fourth aspect, an embodiment of the present invention provides a single sign-on device applied to an identity authentication server, including:

The receiving unit is configured to receive a login request sent by a terminal device; the login request carries a certificate of the terminal device, and is used to request to obtain a login credential for logging in to a single sign-on system SSO;

A sending unit, configured to send a first verification request to a blockchain network, the first verification request being used to request the blockchain network to verify whether the certificate is valid according to the verification of the certificate;

The receiving unit is further configured to receive the first verification response sent by the blockchain network;

The sending unit is further configured to send the login credential to the terminal device when the first verification response indicates that the certificate is valid;

The writing unit is configured to write the access authority corresponding to the login credential to the blockchain network according to the authority information of the terminal device when the first verification response indicates that the certificate is valid.

As an optional implementation manner of the embodiment of the present invention, the single sign-on apparatus further includes: a certificate generating unit;

The receiving unit is further configured to receive a registration request sent by the terminal device before the sending unit sends a first verification request to the blockchain network, where the registration request carries user information;

The certificate generating unit is configured to generate the certificate according to the user profile and the authority information;

The sending unit is further configured to send the certificate to the terminal device;

The writing unit is also used to write the verification of the certificate into the blockchain network.

As an optional implementation manner of the embodiment of the present invention, the single sign-on apparatus further includes:

The deleting unit is configured to delete the certificate according to the user profile and the terminal device after the writing unit writes the verification of the certificate into the blockchain network. The certificate generated by the authority information.

As an optional embodiment of the embodiment of the present invention, the sending unit is further configured to send prompt information to the terminal device when the first verification response indicates that the certificate is invalid;

In a fifth aspect, an embodiment of the present invention provides a single sign-on device, which is applied to an application server, where the application server is an application server in a single sign-on system SSO, and the single sign-on device includes:

A receiving unit, configured to receive an access request sent by a terminal device, where the access request carries login credentials;

The sending unit is configured to send a second verification request to the blockchain network, and the second verification request is used to request the blockchain network to verify whether the terminal device has access to the application according to the access authority corresponding to the login credential Server permissions;

The receiving unit is further configured to receive a second verification response sent by the blockchain network;

The processing unit is configured to allow the terminal device to access when the second verification response indicates that the terminal device has the authority to access the application server.

As an optional implementation manner of the embodiment of the present invention, the processing unit is further configured to reject the terminal when the second verification response indicates that the terminal device does not have the right to access the application server The device is accessed.

In a sixth aspect, an embodiment of the present invention provides an identity authentication server, including: a memory and a processor, the memory is used to store a computer program; the processor is used to execute the first aspect or any one of the implementation manners of the first aspect when the computer program is invoked The single sign-on method described.

In a seventh aspect, an embodiment of the present invention provides an application server, including: a memory and a processor, the memory is used to store a computer program; the processor is used to execute the first aspect or the second aspect of the second aspect when the computer program is invoked Single sign-on method.

In an eighth aspect, an embodiment of the present invention provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, it implements any one of the first aspect or the second aspect or the first aspect of the claim or The single sign-on method according to any one of the embodiments of the second aspect.

In a ninth aspect, an embodiment of the present invention provides a single sign-on system, including: the single sign-on device according to the third aspect or any implementation manner of the third aspect, and the fourth aspect or any implementation manner of the fourth aspect At least one of the single sign-on device in the fifth aspect, the identity authentication server described in the fifth aspect, and the application server described in the sixth aspect.

In the single sign-on method provided by the embodiment of the present invention, when the identity authentication server receives the login request sent by the terminal device, it first sends a request to the blockchain network to verify whether the certificate is valid, and only after the received first verification response instruction Only when the certificate is valid, will the login credential be sent to the terminal device. Therefore, in the embodiment of the present invention, when the terminal device logs in to SSO, the validity of the terminal device's certificate can be verified through the blockchain network. Therefore, the security of the data of the application server in the SSO is improved in terms of identity authentication; in addition, in the case that the first verification response indicates that the certificate is valid, the identity authentication server will also report the authorization information of the terminal device to the The blockchain network writes the access authority corresponding to the login credentials. When the terminal device logs in to the SSO through the login credentials and wants to access the target application server in the SSO, the target application server will send a request to the blockchain network The blockchain network verifies whether the terminal device has the second verification request for the permission to access the target application server according to the access authority corresponding to the login credential, and only when the second verification response indicates the terminal device The terminal device is allowed to access only if it has the authority to access the target application server. Therefore, the embodiment of the invention can also improve the application server performance in SSO from the aspect of user authority when the terminal device accesses the application server in SSO. Data security; that is, the embodiment of the present invention can improve the data security of the application server in SSO in terms of identity authentication and user authority. Therefore, compared with the prior art, the embodiment of the present invention can improve the application server in SSO. The security of your data.

Description of the drawings

Figure 1 is a schematic structural diagram of a single sign-on system provided by an embodiment of the present invention;

2 is a schematic diagram of the interaction process of the single sign-on method provided by an embodiment of the present invention;

Figure 3 is a structural diagram of a single sign-on device provided by an embodiment of the present invention;

4 is a schematic diagram of the hardware structure of an identity authentication server provided by an embodiment of the present invention;

FIG. 5 is a structural diagram of a single sign-on device provided by an embodiment of the present invention;

FIG. 6 is a schematic diagram of the hardware structure of an application server provided by an embodiment of the present invention.

detailed description

The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all of them. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative work shall fall within the protection scope of the present invention.

The term "and/or" in this article is only an association relationship describing associated objects, which means that there can be three relationships, for example, A and/or B, which can mean: A alone exists, A and B exist at the same time, exist alone B these three situations. In addition, the character "/" in this article generally indicates that the associated objects before and after are in an "or" relationship; in the formula, the character "/" indicates that the associated objects before and after are in a "division" relationship. If not specified, the "plurality" in this article means two or more.

In order to facilitate the clear description of the technical solutions of the embodiments of the present invention, in the embodiments of the present invention, the words "first" and "second" are used to distinguish the same items or similar items with basically the same function or effect. Personnel can understand that the words "first" and "second" do not limit the quantity and order of execution.

In the embodiments of the present invention, words such as "exemplary" or "for example" are used as examples, illustrations, or illustrations. Any embodiment or design solution described as "exemplary" or "for example" in the embodiments of the present invention should not be construed as being more preferable or advantageous than other embodiments or design solutions. To be precise, words such as "exemplary" or "for example" are used to present related concepts in a specific manner.

The following first describes the system architecture to which the single sign-on method provided in the embodiment of the present invention is applied.

As shown in FIG. 1, the single sign-on system provided by the embodiment of the present invention includes: at least one terminal device (in FIG. 1, one terminal device 11 is shown as an example), an SSO system 12 including multiple application servers (in FIG. Take the SSO system 12 including an application server 121, an application server 122, an application server 123, an application server 124, and an application server 125 as examples), an identity authentication server 13 and a blockchain network 14.

Among them, the terminal device 11 and the identity authentication server 13 can perform wired communication or wireless communication, and each application server of the terminal device 11 and the SSO system 12 can perform wired communication or wireless communication; each application server in the SSO system 12 can communicate with each other. Wired communication or wireless communication can be carried out between the blockchain network 14, and wired or wireless communication can also be carried out between the identity authentication server 13 and the blockchain network 14.

The terminal device 11 in the embodiment of the present invention may be a mobile phone, a tablet computer, a notebook computer, a personal computer (personal computer, PC), an ultra-mobile personal computer (UMPC), a netbook, or a personal digital assistant (personal digital assistant). , PDA), smart watches, smart bracelets, etc., or the terminal device may also be other types of electronic devices, which are not limited in the embodiment of the present invention. In order to facilitate the understanding of those skilled in the art, the terminal device 11 is shown as an example in the drawings as a PC.

The embodiment of the present invention provides a single sign-on method. As shown in FIG. 2, in the single sign-on method provided by the embodiment of the present invention, each device in the single sign-on system described above performs the following steps:

S11. The terminal device sends a login request to the identity authentication server.

Correspondingly, the identity authentication server receives the login request sent by the terminal device.

Wherein, the login request carries the certificate of the terminal device for requesting to obtain the login credential for logging in to the SSO.

S12. The identity authentication server sends a first verification request to the blockchain network.

Correspondingly, the blockchain network receives the first verification request sent by the identity authentication server.

The first verification request is used to request the blockchain network to verify whether the certificate is valid according to the verification of the certificate.

Wherein, the verification of the certificate is written into the blockchain network by the identity authentication server. That is, before the identity authentication server sends the first verification request to the blockchain network, the identity authentication server also needs to generate a certificate and certificate verification based on user profile data and authority data, and write the certificate and certificate verification to In the blockchain network.

The identity authentication server writes the certificate and the verification of the certificate into the blockchain network to prevent the certificate and/or the verification of the certificate from being tampered with by an attacker, thereby improving data security.

S13. The blockchain network sends a first verification response to the identity verification server.

Correspondingly, the identity authentication server receives the first verification response sent by the blockchain network.

Wherein, the first verification response is used to indicate that the certificate is valid or the certificate is invalid.

When the first verification response indicates that the certificate is valid, the following steps S14 and the steps after S14 are executed.

S14. The identity authentication server sends the login credential to the terminal device.

Correspondingly, the terminal device receives the login credential sent by the identity authentication server.

The login credentials in the embodiment of the present invention are generated by the identity authentication server. Optionally, the identity authentication server may generate a login credential corresponding to each terminal device when each terminal device is registered, and store it in the local storage. When the first verification response indicates that the certificate is valid, the log-in credentials from the local storage Find the login credential corresponding to the terminal device and send it to the terminal device. Optionally, the identity authentication server may also generate the login credentials corresponding to the terminal device when the first verification response indicates that the certificate is valid, and delete the login credentials after sending the login credentials to the terminal device to avoid attacks The person invades the identity authentication server to obtain the login credentials of the terminal device.

S15. The identity authentication server writes the access permission corresponding to the login credential to the blockchain network according to the permission information of the terminal device.

Correspondingly, the blockchain network receives the access authority corresponding to the login credential written by the identity authentication server.

Optionally, the way in which the identity authentication server obtains the authority information of the terminal device can be implemented as follows: establish a Lightweight Directory Access Protocol (LDAP) system, and save the terminal device data (including: terminal device authority information) In the LDAP system, when the authority information of the terminal device needs to be obtained, the authority information of the terminal device is read from the LDAP system.

Specifically, LDAP is an open, neutral, and industry standard application protocol used to provide access control and maintain distributed information directory information through the IP protocol. The LDAP system in the embodiment of the present invention may be independent of the identity authentication server, or may be integrated into the identity authentication server, which is not limited in the embodiment of the present invention.

By the above step S14, the identity verification server has completed the identity verification of the terminal device. In the process that the identity verification server verifies the identity of the terminal device, the identity verification server sends the certificate of the terminal device to the blockchain network and receives the verification result of the blockchain network, and determines according to the verification result of the blockchain network Whether to send the login credentials to the terminal device, therefore, the foregoing embodiment can prevent network attackers from forging root certificates and forging user certificates to log in, thereby improving the security of data in the application server in SSO.

S16. The terminal device sends an access request to the target application server in the SSO.

Correspondingly, the target application server receives the access request sent by the terminal device.

Wherein, the access request carries login credentials.

S17. The target application server sends a second verification request to the blockchain network.

Correspondingly, the blockchain network receives the second verification request sent by the target application server.

The second verification request is used to request the blockchain network to verify whether the terminal device has the permission to access the target application server according to the access permission corresponding to the login credential.

S18. The blockchain network sends a second verification response to the target application server.

Correspondingly, the target application server receives the second verification response sent by the blockchain network.

The second verification response is used to indicate that the terminal device has the authority to access the target application server, or that the terminal device does not have the authority to access the target application server.

In the case where the second verification response indicates that the terminal device has the authority to access the target application server, the following step S19 is executed.

S19. The target application server allows the terminal device to access.

Through the above steps S15 to S19, the target application server has completed the verification of the access authority of the terminal device. In the process of verifying the access authority of the terminal device by the target application server, since the target application sends a second verification request to the blockchain network, and determines whether the terminal device is allowed to access according to the second verification response sent by the blockchain network. The foregoing embodiment can prevent network attackers from tampering with the access authority of the terminal device, thereby causing data leakage. Therefore, the embodiment of the present invention can further improve the security of data in the application server in SSO.

As an optional implementation manner of the embodiment of the present invention, before the above step S12 (the identity authentication server sends the first verification request to the blockchain network), the single sign-on method provided by the embodiment of the present invention further includes the following steps a- Step c.

Step a: The identity authentication server receives the registration request sent by the terminal device.

Wherein, the registration request carries user information.

Exemplarily, the user profile may include information such as the user name and identification code of the user.

Step b: The identity authentication server generates the certificate according to the user profile and authority information.

It should be noted that the way to obtain the above permission information can be: the identity authentication server configures the terminal device according to the user profile; it can also be: the terminal device carries permission request information in the registration request, and the identity authentication server carries permission request information in the registration request. Perform an audit, and use the approved permission request item as the permission information.

When the terminal device carries the permission request information in the registration request, the identity authentication server reviews the permission request information carried in the registration request, and uses the approved permission request item as the permission information, the registration request sent by the terminal device The carried permission request information and the permission information may be the same or different. For example, the authorization request information carried in the registration request sent by the terminal device includes: access to application server A, access to application server B, and access to application server C. The authorization information when the identity authentication server generates the certificate may include: access to application server A, The permissions for accessing application server B and accessing application server C may also include: accessing application server A and accessing application server B, but not including accessing application server C.

Step c: The identity authentication server sends the certificate to the terminal device, and writes the verification of the certificate into the blockchain network.

Correspondingly, the terminal device receives the certificate sent by the identity authentication server, and the blockchain network receives the written certificate verification.

Since the identity authentication server needs to write the verification of the certificate to the blockchain network, the identity authentication server first needs to generate the verification of the certificate. The embodiment of the present invention does not limit the algorithm for generating certificate verification.

According to the function of the identity authentication server in the above single sign-on method, the identity authentication server provided by the embodiment of the present invention may be composed of the following modules:

Account management module, the main functions include:

Establish an LDAP system to store user data;

Establish a user registration and review mechanism, allow users to register online, and review users;

Establish a user management mechanism, allowing user administrators to add, delete, modify, and check users, and notify users by email;

Establish a user authority management mechanism to allow administrators to manage the authority of users to access related systems.

Certificate management module, the main functions include:

Used to generate a certificate based on user profile data;

Calculate the verification of the certificate and write it into the blockchain network;

Generate a unique link for the user to download the certificate and send it to the terminal device;

Establish a certificate management mechanism to allow administrators to revoke and renew certificates.

Identity authentication module, the main functions include:

When the terminal device requests to download the certificate according to the unique link, the certificate is sent to the terminal device;

Analyze the certificate carried by the terminal device at the time of terminal and device login request;

After filling the certificate information according to the specified data structure, initiate a certificate verification request to the blockchain network;

After the certificate is successfully verified, obtain the permission information from the LDAP system, and then write the access permission to the blockchain network;

After the certificate is successfully verified, the login credentials are returned to the terminal device.

As an optional implementation manner of the embodiment of the present invention, after the certificate is sent to the terminal device in step c, the single sign-on method provided in the embodiment of the present invention further includes:

After the identity authentication server sends the certificate to the terminal device, it deletes the certificate generated based on the user profile and the authority information, which can prevent network attackers from invading the identity authentication server to obtain the certificate of the terminal device. Therefore, the foregoing embodiment The data security of the application server in SSO can be further improved.

As an optional implementation manner of the embodiment of the present invention, when the first verification response indicates that the certificate is invalid, the single sign-on method provided in the embodiment of the present invention further includes:

The identity authentication server sends prompt information to the terminal device;

As an optional implementation manner of the embodiment of the present invention, in the case that the second verification response indicates that the terminal device does not have the authority to access the target application server, the single sign-on method provided in the embodiment of the present invention further includes :

The target application server denies the terminal device access.

The embodiment of the present application may divide the terminal device and the like into functional modules according to the foregoing method example. For example, each function module may be divided corresponding to each function, or two or more functions may be integrated into one module. The above-mentioned integrated modules can be implemented in the form of hardware or software functional modules. It should be noted that the division of modules in the embodiments of the present application is illustrative, and is only a logical function division, and there may be other division methods in actual implementation.

In the case of an integrated unit, FIG. 3 shows a possible structural diagram of the single sign-on device applied to the identity authentication server involved in the foregoing embodiment, and the single sign-on device 300 includes:

The receiving unit 31 is configured to receive a login request sent by a terminal device; the login request carries a certificate of the terminal device, and is used to request to obtain a login credential for logging in to the SSO system;

The sending unit 32 is configured to send a first verification request to the blockchain network, where the first verification request is used to request the blockchain network to verify whether the certificate is valid according to the verification of the certificate;

The receiving unit 31 is further configured to receive the first verification response sent by the blockchain network;

The sending unit 32 is further configured to send the login credentials to the terminal device when the first verification response indicates that the certificate is valid;

The writing unit 33 is configured to write the access authority corresponding to the login credential to the blockchain network according to the authority information of the terminal device when the first verification response indicates that the certificate is valid.

Referring to FIG. 3, as an optional implementation manner of the embodiment of the present invention, the single sign-on apparatus 300 further includes: a certificate generating unit 34;

The receiving unit 31 is further configured to receive a registration request sent by the terminal device before the sending unit sends the first verification request to the blockchain network, and the registration request carries user information;

The certificate generating unit 34 is configured to generate the certificate according to the user profile and the authority information;

The sending unit 32 is further configured to send the certificate to the terminal device;

The writing unit 33 is also used to write the verification of the certificate into the blockchain network.

Referring to FIG. 3, as an optional implementation manner of the embodiment of the present invention, the single sign-on apparatus 300 further includes:

The deleting unit 35 is configured to delete the certificate according to the user profile after the sending unit sends the certificate to the terminal device, and the writing unit writes the verification of the certificate into the blockchain network And the certificate generated by the authority information.

As an optional embodiment of the embodiment of the present invention, the sending unit 32 is further configured to send prompt information to the terminal device when the first verification response indicates that the certificate is invalid;

In the case of using an integrated unit, FIG. 4 shows a possible structural diagram of the single sign-on apparatus applied to the application server in SSO involved in the foregoing embodiment, and the single sign-on apparatus 400 includes:

The receiving unit 41 is configured to receive an access request sent by a terminal device, where the access request carries login credentials;

The sending unit 42 is configured to send a second verification request to the blockchain network, and the second verification request is used to request the blockchain network to verify whether the terminal device has access to the Application server permissions;

The receiving unit 41 is further configured to receive a second verification response sent by the blockchain network;

The processing unit 43 is configured to allow the terminal device to access when the second verification response indicates that the terminal device has the authority to access the application server.

As an optional implementation manner of the embodiment of the present invention, the processing unit 43 is further configured to reject the application server when the second verification response indicates that the terminal device has no right to access the application server Terminal equipment for access.

Since the single sign-on device applied to the identity authentication server and the single sign-on device applied to the application server provided by the embodiment of the present invention can execute the single sign-on method provided in the above method embodiment, the technical effect similar to the above embodiment can be achieved. , I won’t repeat it here.

Based on the same inventive concept, the embodiment of the present invention also provides an identity authentication server. FIG. 5 is a schematic structural diagram of an identity authentication server provided by an embodiment of the present invention. As shown in FIG. 5, the identity authentication server provided in this embodiment includes: a memory 51 and a processor 52, where the memory 51 is used to store computer programs; and the processor 52 It is used to execute the steps executed by the identity authentication server in the single sign-on method described in the foregoing method embodiment when the computer program is invoked.

Based on the same inventive concept, the embodiment of the present invention also provides an application server in SSO. Fig. 6 is a schematic structural diagram of an application server provided by an embodiment of the present invention. As shown in Fig. 6, the application server provided by this embodiment includes: a memory 61 and a processor 62. The memory 61 is used for storing computer programs; When the computer program is invoked, the steps executed by the application server in the single sign-on method described in the foregoing method embodiment are executed.

The identity authentication server and the application server provided in this embodiment can execute the single sign-on method provided in the above method embodiments, and the implementation principles and technical effects are similar, and will not be repeated here.

The embodiment of the present invention also provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the single sign-on method described in the foregoing method embodiment is implemented.

Those skilled in the art should understand that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, this application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, this application may take the form of a computer program product implemented on one or more computer-usable storage media containing computer-usable program codes.

The processor can be a central processing unit (Central Processing Unit, CPU), it can also be other general-purpose processors, digital signal processors (Digital Signal Processor, DSP), application specific integrated circuits (Application Specific Integrated Circuit, ASIC), ready-made programmable Field-Programmable Gate Array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor or the like.

The memory may include non-permanent memory in a computer readable medium, random access memory (RAM) and/or non-volatile memory, such as read-only memory (ROM) or flash memory (flash RAM). The memory is an example of a computer-readable medium.

Computer-readable media include permanent and non-permanent, removable and non-removable storage media. The storage medium can implement information storage by any method or technology, and the information can be computer readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, CD-ROM, digital versatile disc (DVD) or other optical storage, Magnetic cassettes, disk storage or other magnetic storage devices or any other non-transmission media can be used to store information that can be accessed by computing devices. According to the definition in this article, computer-readable media does not include transitory media, such as modulated data signals and carrier waves.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, but not to limit it; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand: It is still possible to modify the technical solutions described in the foregoing embodiments, or equivalently replace some or all of the technical features; these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the technical solutions of the embodiments of the present invention range.

Claims

A single sign-on method applied to an identity authentication server, characterized in that the method includes:

Receiving a login request sent by a terminal device; the login request carries a certificate of the terminal device, and is used to request to obtain a login credential for logging in to a single sign-on system SSO;

Sending a first verification request to a blockchain network, where the first verification request is used to request the blockchain network to verify whether the certificate is valid according to the verification of the certificate;

Receiving the first verification response sent by the blockchain network;

In the case that the first verification response indicates that the certificate is valid, the login credential is sent to the terminal device, and the log-in credential is written to the blockchain network according to the authority information of the terminal device. access permission.
The method according to claim 1, characterized in that, before sending the first verification request to the blockchain network, the method further comprises:

Receiving a registration request sent by the terminal device, the registration request carrying user information;

Generating the certificate according to the user profile and the authority information;

Send the certificate to the terminal device, and write the verification of the certificate into the blockchain network.
The method according to claim 2, wherein after sending the certificate to the terminal device and writing the verification of the certificate into the blockchain network, the method further comprises: deleting The certificate generated by the user profile and the authority information.
The method according to any one of claims 1-3, wherein the method further comprises:

In a case where the first verification response indicates that the certificate is invalid, sending prompt information to the terminal device;

Wherein, the prompt information is used to prompt that the certificate of the terminal device is invalid.
A single sign-on method applied to a target application server in a single sign-on system SSO, characterized in that the method includes:

Receiving an access request sent by a terminal device, where the access request carries login credentials;

Send a second verification request to the blockchain network, the second verification request is used to request the blockchain network to verify whether the terminal device has the permission to access the target application server according to the access permissions corresponding to the login credentials ；

Receiving a second verification response sent by the blockchain network;

In a case where the second verification response indicates that the terminal device has the authority to access the target application server, the terminal device is allowed to access.
The method of claim 5, wherein the method further comprises:

If the second verification response indicates that the terminal device does not have the authority to access the target application server, the terminal device is denied access.
A single sign-on method, characterized in that it comprises:

The terminal device sends a login request to the identity authentication server; the login request carries the certificate of the terminal device, and is used to request to obtain the login credentials for logging in to the single sign-on system SSO;

Sending, by the identity authentication server, a first verification request to a blockchain network, the first verification request being used to request the blockchain network to verify whether the certificate is valid according to the verification of the certificate;

The identity authentication server receives the first verification response sent by the blockchain network;

In the case that the first verification response indicates that the certificate is valid, the identity authentication server sends the login credential to the terminal device, and writes the login credentials to the blockchain network according to the authority information of the terminal device. Describe the access rights corresponding to the login credentials;

An access request sent by the terminal device to the target application server in the SSO, where the access request carries login credentials;

The target application server sends a second verification request to the blockchain network, and the second verification request is used to request the blockchain network to verify whether the terminal device has access to the The permissions of the target application server;

The target application server receives the second verification response sent by the blockchain network;

In a case where the second verification response indicates that the terminal device has the authority to access the target application server, the target application server allows the terminal device to access.
The method according to claim 7, wherein before the terminal device sends a login request to the identity authentication server, the method further comprises:

The terminal device sends a registration request to the identity authentication server, and the registration request carries user information;

The identity authentication server generates the certificate according to the user profile and the authority information;

The identity authentication server sends the certificate to the terminal device, and writes the verification of the certificate into the blockchain network.
The method according to claim 8, characterized in that, after the identity authentication server sends the certificate to the terminal device, and writes the verification of the certificate into the blockchain network, the method Also includes:

The identity authentication server deletes the certificate generated according to the user profile and the authority information.
The method according to any one of claims 7-9, wherein:

In a case where the first verification response indicates that the certificate is invalid, the identity authentication server sends prompt information to the terminal device;

Wherein, the prompt information is used to prompt that the certificate of the terminal device is invalid.
The method according to any one of claims 7-10, wherein in the case that the second verification response indicates that the terminal device does not have the right to access the target application server, the target application server rejects the Said terminal device for access.
A single sign-on device applied to an identity authentication server, characterized in that it includes:

The receiving unit is configured to receive a login request sent by a terminal device; the login request carries a certificate of the terminal device, and is used to request to obtain a login credential for logging in to a single sign-on system SSO;

A sending unit, configured to send a first verification request to a blockchain network, the first verification request being used to request the blockchain network to verify whether the certificate is valid according to the verification of the certificate;

The receiving unit is further configured to receive the first verification response sent by the blockchain network;

The sending unit is further configured to send the login credential to the terminal device when the first verification response indicates that the certificate is valid;

The writing unit is configured to write the access authority corresponding to the login credential to the blockchain network according to the authority information of the terminal device when the first verification response indicates that the certificate is valid.
A single sign-on device applied to an application server, wherein the application server is an application server in a single sign-on system SSO, and the single sign-on device includes:

A receiving unit, configured to receive an access request sent by a terminal device, where the access request carries login credentials;

The sending unit is configured to send a second verification request to the blockchain network, and the second verification request is used to request the blockchain network to verify whether the terminal device has access to the application according to the access authority corresponding to the login credential Server permissions;

The receiving unit is further configured to receive a second verification response sent by the blockchain network;

The processing unit is configured to allow the terminal device to access when the second verification response indicates that the terminal device has the authority to access the application server.
An identity authentication server, comprising: a memory and a processor, the memory is used to store a computer program; the processor is used to execute the single sign-on method according to any one of claims 1 to 4 when the computer program is called.
An application server, characterized by comprising: a memory and a processor, the memory is used to store a computer program; the processor is used to execute the single sign-on method of claim 5 or 6 when the computer program is called.
A computer-readable storage medium, characterized in that a computer program is stored thereon, and when the computer program is executed by a processor, the single sign-on method according to any one of claims 1-11 is realized.