WO2023029138A1

WO2023029138A1 - Login method, electronic device and computer-readable storage medium

Info

Publication number: WO2023029138A1
Application number: PCT/CN2021/121317
Authority: WO
Inventors: 林俊洪
Original assignee: 网宿科技股份有限公司
Priority date: 2021-08-31
Filing date: 2021-09-28
Publication date: 2023-03-09
Also published as: CN113922982B; CN113922982A

Abstract

A login method, an electronic device, and a computer-readable storage medium, which relate to the technical field of cybersecurity. A login management server deployed in a public network: after determining a user to be a valid user of a service server, obtains an identity identifier of the user by means of the service server, and communicates with the service server on the basis of a VPN network; determines, on the basis of the identity identifier of the user, whether the user is a valid user of the VPN service, so as to generate a login response indicating whether the user successfully logs into the service server and the VPN service through a browser of a terminal device; and sends the login response to the terminal device.

Description

Login method, electronic device, and computer-readable storage medium

cross reference

This application is based on the Chinese patent application with the application number "202111012706.6" and the filing date is August 31, 2021, and claims the priority of the Chinese patent application. The entire content of the Chinese patent application is hereby incorporated by reference. Apply.

technical field

The present application relates to the technical field of network security, in particular to a login method, electronic equipment and a computer-readable storage medium.

Background technique

With the rapid development of Internet technology, each enterprise establishes an enterprise internal network and uses the enterprise internal network to deploy various business systems to improve office efficiency. Common business systems include mail systems, office automation systems (office automation, referred to as OA), and so on.

Usually, when the user is working in the company, if the user wants to access a certain business system, he needs to enter the account password of the business system for verification, and the business access can only be performed after the verification is passed. However, sometimes users need to work while they are on a business trip and at home. In order to facilitate public network users to access various systems in the enterprise internal network while ensuring access security, a virtual private network (Virtual Private Network, referred to as VPN) came into being. Considering factors such as operating costs and service professionalism, most enterprises will choose Purchase VPN services from network service providers to enable public network users to access intranet services.

In this application scenario, in order to identify the legitimacy of the user, the network service provider will verify the user's identity, and the business system in the intranet itself also needs to verify the legitimacy of the user's identity. As a result, if enterprise users access various business systems in the intranet through the public network, they need to enter login information at least twice to access smoothly. The process is cumbersome, error-prone, and user experience is poor.

Contents of the invention

The embodiment of the present application provides a login method, electronic equipment, and computer-readable storage medium, so that the user can log in to the VPN service and the service server at the same time only by entering the account password for logging in to the service server once, simplifying the login process and reducing the error rate. , to improve user experience.

In the first aspect, the embodiment of the present application provides a login method, which is applied to a login management server deployed in a public network. The method includes: after determining that the user is a legitimate user of the service server, obtaining the The identity of the user, the communication between the login management server and the service server is based on the VPN network; based on the identity of the user, it is determined whether the user is a legal user of the VPN service to generate a login response, and the login The response is used to indicate whether the user successfully logs in the service server and the VPN service through the browser of the terminal device; and the login response is sent to the terminal device.

In an embodiment, after determining that the user is a legal user of the service server, obtaining the identity of the user through the service server includes: receiving a login page request sent by the user through the browser, and the The login page request is used to request to log in the service server and the VPN service; sending a redirection response to the terminal device, so that the browser sends the login page to the service server according to the redirection response request, and submit login information based on the login page fed back by the service server, so that the service server can confirm whether the user is legal; receive an adaptation page request from the browser that carries parameters for successful login; The browser sends a data stream for displaying an adaptation page, so that the browser displays the adaptation page, and requests the service server for the identity of the user according to the login success parameter.

In an embodiment, the determining whether the user is a legal user of the VPN service based on the user's identity to generate a login response includes: verifying the user's identity based on locally stored legal user information, Generate the login response based on the verification result; or, send a trust request to a virtual private network VPN server deployed in the public network, the trust request carries the identity of the user, and the VPN server is used to provide the VPN service: receiving a trust response from the VPN server, and generating the login response according to the trust response.

In an embodiment, the sending the login response to the terminal device includes: when the trust response carries a token for the user, sending to the browser an Displaying a login response of a successful login page, the token is used to indicate that the user is a legitimate user of the VPN service.

In the second aspect, the embodiment of the present application provides a login method, which is applied to a virtual private network VPN server deployed in the public network, and the method includes: receiving a trust request from a login management server deployed in the public network, the The trust request carries the identity of the user, and the trust request is sent by the login management server after determining that the user is a legal user of the service server; the user is verified based on the identity to obtain a legal A validity verification result, the legality verification result is used to indicate whether the user is a legitimate user of the VPN service; and a trust response carrying the legality verification result is sent to the login management server.

In an embodiment, the method further includes: when the legitimacy verification result indicates that the user is a legitimate user of the VPN service, generating a token for the user, and carrying the token in the trust response. said token.

In an embodiment, after sending the trust response carrying the legality verification result to the login management server, it further includes: receiving an authentication request sent by the terminal device through the VPN client application, the authentication request to carry the token; verify whether the token is legal to obtain a feedback result, the feedback result is used to indicate whether the user has successfully logged in the service server and the VPN service through the VPN client application; The application program VPN client application of the terminal device sends the feedback result.

In one embodiment, the verifying whether the token is valid to obtain a feedback result includes: verifying whether the token is generated by the VPN server, and whether the state of the token is normal; if the If the token is generated by the VPN server and the status is normal, then generate a feedback result indicating that the token is legal; otherwise, generate a feedback result indicating that the token is invalid.

In an embodiment, after sending the feedback result to the VPN client application, it further includes: if the feedback result indicates that the VPN client application has successfully logged in to the service server and the VPN service, communicating with the VPN client application The VPN client application establishes a VPN tunnel, so as to receive the service request sent by the user through the VPN client application through the VPN tunnel.

In a third aspect, an embodiment of the present application provides a login method, which is applied to a service server deployed on an intranet. The method includes: receiving a login page request sent by a user through a browser on a terminal device, wherein the login The page request is generated and sent by the browser based on the redirection response sent by the login management server; sending the data stream for displaying the login page to the terminal device; receiving the login information submitted by the terminal device based on the login page ; Verify the validity of the user according to the login information; if the user is a legal user of the service server, send a redirection response carrying a successful login parameter to the terminal device, and the redirection response uses Instructing the browser of the terminal device to send an adaptation page request carrying the login success parameter to the login management server.

In a fourth aspect, an embodiment of the present application provides a login method applied to a terminal device. The method includes: obtaining a data stream for displaying a login page through a browser and displaying the login page. The login page is used to log in to a service server and VPN service; send login information to the business server based on the login page; receive a redirection response carrying a successful login parameter from the business server; send a redirection response carrying the login success parameter to the login management server through the browser The adaptation page request of the login success parameter; receive the data flow for displaying the adaptation page from the login management server and display the adaptation page; receive the login response from the login management server, the login response It is used to indicate whether the user successfully logs in the service server and the VPN service through the browser.

In the fifth aspect, the embodiment of the present application provides an electronic device, including: a processor, a memory, and a computer program stored on the memory and operable on the processor, and when the processor executes the computer program, the The electronic device implements the above first aspect or the method described in various possible implementations of the first aspect; or, when the processor executes the computer program, the electronic device implements the above second aspect or each of the second aspect the method described in one possible implementation manner; or, when the processor executes the computer program, the electronic device implements the method described in the above third aspect or various possible implementation manners of the third aspect; or, the When the processor executes the computer program, the electronic device implements the method described in the fourth aspect or various possible implementation manners of the fourth aspect.

In the sixth aspect, the embodiment of the present application provides a computer-readable storage medium, the computer-readable storage medium stores computer instructions, and the computer instructions are used to implement the above first aspect or the first aspect when executed by a processor. The method described in various possible implementations of the second aspect; or, the computer instructions are used to implement the method described in the second aspect above or various possible implementations of the second aspect when executed by a processor; or, the When executed by a processor, the computer instructions are used to implement the method described in the above third aspect or various possible implementations of the third aspect; or, when the computer instructions are executed by a processor, they are used to implement the above fourth aspect or The method described in various possible implementation manners of the fourth aspect.

In the seventh aspect, the embodiments of the present application provide a computer program product including a computer program, and when the computer program is executed by a processor, the method described in the above first aspect or various possible implementation modes of the first aspect is implemented; or, When the computer program is executed by the processor, it realizes the method described in the above second aspect or various possible implementation modes of the second aspect; or, when the computer program is executed by the processor, it realizes the above third aspect or the methods of the third aspect. The method described in one possible implementation manner; or, when the computer program is executed by the processor, implement the method described in the fourth aspect or various possible implementation manners of the fourth aspect.

In the login method, electronic equipment, and computer-readable storage medium provided by the embodiments of the present application, after the login management server determines that the user is a legal user of the service server, the user's identity is obtained through the service server, and the VPN service deployed in the public network is provided. The end sends a trust request carrying an identity. The VPN server verifies the legitimacy of the user according to the identity and sends a trust response carrying the legitimacy verification result to the login management server. The login management server sends a login response to the user's terminal device according to the trust response, and the login response is used to indicate whether the user successfully logs in to the service server and the VPN service through the browser. With this solution, through the interaction between the login management server, business server and VPN server, the user only needs to enter the account password for logging in to the business server once to log in to the VPN service and the business server at the same time, simplifying the login process and reducing the error rate , improve user experience. Moreover, the login information is independently managed by the business server, and the business server does not need to synchronize the user login information to the VPN server, thereby ensuring the security of the customer's internal data.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings that need to be used in the description of the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present application. For those skilled in the art, other drawings can also be obtained based on these drawings without creative effort.

FIG. 1 is a schematic diagram of an implementation environment of a login method provided by an embodiment of the present application;

Fig. 2 is a flow chart of the login method provided by the embodiment of the present application;

Fig. 3 is a schematic diagram of the interface change process of the terminal device in the login method provided by the embodiment of the present application;

Fig. 4 is a schematic diagram of the authentication process of the token in the login method provided by the embodiment of the present application;

Fig. 5 is a schematic diagram of the process of the login method provided by the embodiment of the present application;

FIG. 6 is a schematic structural diagram of an electronic device provided by an embodiment of the present application.

Detailed ways

In order to make the purpose, technical solution and advantages of the present application clearer, the implementation manners of the present application will be further described in detail below in conjunction with the accompanying drawings.

In the application scenario where enterprise customers purchase VPN services from network service providers, in order to ensure data security, the VPN system and the business system manage their own account systems independently. The function module for user authentication is carried out to authenticate the user. After the identity authentication is passed, the user can use the VPN service. Wherein, the VPN client application includes an Android (Android) client application, an IOS client application, a window PC client application, and the like.

After a user in the public network logs in to the VPN system, when accessing the business system in the intranet through the VPN service, the business system also needs to verify the legality of the user's identity.

In the above process of logging into the business system, the login information is input for the first time for authentication of the VPN system, and the login information is input for the second time for authentication of the business system. Take the user accessing the business system in the company's intranet from the public network as an example. During the access process, first, enter the authentication information such as the account number and password of the VPN service to log in to the VPN server. After successfully logging in to the VPN service, enter the homepage of some business systems of the company, and select the business system to be accessed on the homepage to log in. For example, when accessing the OA system, at this time, a login page will pop up to ask the user to input the authentication information of the OA system.

Obviously, the above login method is cumbersome, error-prone, poor user experience, and inconvenient for users to manage login information.

Based on this, an embodiment of the present application provides a login method, electronic equipment, and a computer-readable storage medium, which receive and process user login requests through the login management server, so that users only need to input the login information of the business server once to log in at the same time. VPN services and business servers simplify the login process, reduce error rates, and improve user experience.

FIG. 1 is a schematic diagram of an implementation environment of a login method provided by an embodiment of the present application. Please refer to Fig. 1, this implementation environment includes: the login management server 11 that is deployed in the public network, the virtual private network (Virtual Private Network, be called for short VPN) server end 12 that is deployed in the public network, deploy in the intranet (such as the customer's local area network) ) in the service server 13 and the user's terminal equipment 14. Wherein, the login management server 11 and the VPN server 12 are connected through a network, and the login management server 11 and the business server 13 communicate based on the VPN network. There is at least one VPN server 12, and the VPN server 12 and the business server 13 are connected through a network.

In some embodiments, between the login management server 11 and the business server 13, between the login management server 11 and the VPN server 12, and between the VPN server 12 and the business server 13, communication is based on a VPN network to ensure data transmission security. In some implementations, the VPN network can be constructed based on software-defined wide area network (Software Defined Wide Area Network, referred to as SD-WAN) technology, and the VPN server 12 is deployed at a network service provider point (point-of-presence, referred to as POP) on the node server.

Please refer to FIG. 1 , the login management server 11 is a service application deployed in the public network by a network service provider for receiving and processing user login requests. The VPN server 12 is a service application deployed in the public network by a network service provider for providing VPN services. In an actual application scenario, the number of VPN servers 12 may be many. Wherein, the VPN service may include forwarding the user's intranet request to the requested intranet server through the VPN tunnel.

In an application scenario, the service server 13 is, for example, a server of a single sign-on (Single Sign-On, SSO) system, that is, the VPN client has realized the single sign-on function for its business service based on the SSO service. When the business server 13 is the server of the SSO system, the user can successfully log in to the server of the VPN service and the SSO system at the same time by inputting the account password of the SSO system once, and then can directly access the SSO system based on the successful login status of the SSO system. Business systems, such as Office Automation (OA) system, mail system, attendance system, performance system, etc.

In another application scenario, the service server 13 may be a server of an OA system, a server of a mail system, or the like. Taking the OA system as an example, the user can log in to the VPN service and the server of the OA system at the same time by entering the account password of the OA system once, and then can access the OA system.

In addition, if a VPN customer has purchased VPN services for multiple business systems in the intranet and has not yet introduced the SSO system, for each business system, the user can log in to the VPN service at the same time by entering the account number and password of the business system once. and business servers. After the login management server 11 determines that the user is a legal user of the service system, when further verifying whether the user is a legal user of the VPN service, the user's identity is obtained from the service server 13, and it can be verified based on the user's identity whether it is a VPN legitimate users of the service. After the verification is legal, the login management server 11 provides the VPN server 12 with the information of the service server the user has logged in, so that the VPN service terminal determines whether to provide VPN service for the user request based on the received service server information.

The terminal device 14 is, for example, an electronic device such as a mobile phone, a tablet computer, and a personal computer installed with an Android operating system, a Microsoft operating system, a Symbian operating system, a Linux operating system, or an Apple iOS operating system. Browser and VPN client application are installed on the terminal device 14, such as Android (Android) client application, IOS client application or window PC client application etc.

Fig. 2 is a flow chart of the login method provided by the embodiment of the present application. This embodiment is described from the perspective of interaction between a login management server, a VPN server, a service server, and a terminal device. This example includes:

Step 201, the login management server determines that the user is a legal user of the service server.

Step 202, the login management server acquires the user's identity through the service server, and the login management server communicates with the service server based on the VPN network.

It is worth noting that the login method provided by the embodiment of the present application can be applied to the scenario where the user logs in through the VPN client application, as shown in Figure 3 for details; it can also be applied to the scenario where the user logs in directly based on the browser, that is, the user The login page can be accessed directly through the browser.

FIG. 3 is a schematic diagram of an interface change process of a terminal device in a login method provided by an embodiment of the present application. Referring to FIG. 3 , after the user clicks the VPN client application on the desktop of the electronic device, the VPN client application is opened. The user interface of the VPN client application displays two buttons of joint login and common login. The common login mode is a login mode in which login information is input at least twice, and the joint login mode is the login mode provided in this embodiment of the application.

The user clicks the joint login button to select the login method provided by this embodiment of the application. Afterwards, the VPN client application automatically invokes the browser. The terminal device requests a login page from the login management server through the browser. The login management server redirects the browser to the service server based on replying to the browser with a 302 jump, etc., so that the browser obtains the data stream for displaying the login page from the service server and displays the login page.

It is understandable that, in the scenario where the user logs in directly through the browser, the access address of the login management server can be directly entered in the browser, and the login management server will respond to the user browser by replying with a 302 response after receiving the access request. , to redirect the browser to the business server.

It is worth noting that since the business server is deployed in the intranet, and the user browser needs to request a login page from the business server, the business server needs to provide a public network IP. In the implementation provided by this application, in order to ensure that the intranet For the security of the business server, the business server can be set in advance so that it only responds to the login page request sent to the public network IP, and refuses to respond to other requests. Furthermore, when the login management server sends a redirection request to the browser, it can carry a dynamically generated verification parameter for the business server to verify and identify. If the verification passes, the request is responded to, otherwise it is discarded.

After the browser displays the login page, the user inputs login information on the login page by voice, touch, etc. and sends it to the service server. The login information includes a login account, a password, etc., and may also include a verification code, an enterprise logo, and the like. Among them, the login account and password are independently maintained by the business server. Generally speaking, the login account and password are registered and generated when the user logs in to the business server for the first time. For enterprise users, the login account can also be assigned by the enterprise for employees. .

During the user registration process, the business server can collect and store the login information (except the verification code) and identification and other relevant information of the legal user. The relevant information of the user can also be managed by the enterprise and sent to the business server. The identity mark is the information used by the enterprise to identify the user's identity, such as the user's mobile phone number, ID number, job number, etc. The specific form can be set according to the actual situation of the enterprise customer, and the present invention is not limited thereto.

When a user requests to log in to the service server and VPN service through a browser, the login management server redirects the browser to the service server, and the service server provides a login page to the user browser. After that, the user enters and submits login information such as an account password on the login page, and the service server verifies whether the user is a legitimate user according to the login information submitted by the user and sends feedback to the terminal device, and at the same time, redirects the browser to the login management server. Afterwards, the browser reports to the login management server whether the user is a legitimate user of the service server.

Specifically, in the process of determining whether the user is a legitimate user of the business server, the business server compares the stored legitimate user information with the login information submitted by the user when logging in. If the stored information contains the login information submitted by the user, then Determine that the user is a legitimate user of the service server. In addition, the service server can also verify the verification code submitted by the user to further ensure the legitimacy of the operator.

If the user is a legitimate user of the service server, the service server redirects the browser to the login management server server by replying to the browser with a 302 response, etc., and carries the login success parameter in the 302 response message. Based on the 302 response message, the browser sends an adaptation page request carrying parameters of successful login to the login management server. The login management server obtains the identity of the user from the service server according to the login success parameter. In one embodiment, the login success parameter includes the service server information and the user login identifier, wherein the service server information is used to indicate the legality verification of the user. The address of the business server, such as the intranet IP, and the user login ID are the unique IDs generated by the business server based on this login record. After receiving the successful login parameters, the login management server can parse them to obtain the business server information and user Login ID, and based on the VPN network, request the service server pointed to by the service server information for the user's identity corresponding to the user's login ID. When the business server receives the request from the login management server, it can determine the user's identity based on the user's login ID. And send it to the login management server through the VPN network. Based on this, the data interaction between the login management server and the business server is transmitted based on the VPN network, which can ensure the security of data transmission, prevent information leakage, and ensure the security of user information of enterprise customers.

If the user is not a legitimate user of the service server, the service server triggers the browser to pop up a prompt message to prompt the user that the login fails, cannot be logged in through a joint login method, and the like.

It should be noted that although in the above FIG. 3 , two buttons of joint login and common login are displayed on the user interface of the VPN client application at the same time. However, this embodiment of the present application is not limited. In other feasible implementation manners, only a joint login button is displayed on the user interface of the VPN client application, that is, the VPN client application only provides the login method described in the embodiment of the present application. At this time, after the user clicks the VPN client application on the desktop of the electronic device and requests to log in, the VPN client application invokes a browser to request a login page from the login management server. Users are not required to choose a federated login method.

Step 203: Determine whether the user is a legal user of the VPN service based on the identity of the user, so as to generate a login response, and the login response is used to indicate whether the user has successfully logged in to the VPN service through the browser of the terminal device. business server and the VPN service.

Exemplarily, after the login management server determines that the user is a legal user of the service server, it interacts with the service server to obtain the identity of the user. Afterwards, the login management server determines whether the user is a legitimate user of the VPN service based on the user's identity, or the login management server sends the user's identity to the VPN server that provides the VPN service for the user, and the VPN server determines whether the user is a VPN service. Legitimate users of VPN services.

Step 204, the login management server sends the login response to the terminal device of the user.

Exemplarily, if the user is a legal user of the VPN service, the login response is a data flow for generating a login success page, and the login response is used to indicate that the user successfully logs in to the service server and the VPN service through a browser. If the user is not a legitimate user of the VPN service, the login response is a data flow for generating a login failure page, and the login response is used to indicate that the user failed to successfully log in to the service server and the VPN service through the browser.

If the login is successful, it means that the user can access the business server through the VPN service.

In the login method provided by the embodiment of this application, after the login management server determines that the user is a legal user of the service server, the user's identity is obtained through the service server, and based on the user's identity, it is determined whether the user is a legal user of the VPN service to generate a login Response and send to the terminal device. The login response is used to indicate whether the user successfully logs in to the service server and VPN service through the browser.

With this solution, through the interaction between the login management server, business server and VPN server, the user only needs to enter the login information of the business server once to log in to the VPN service and the business server at the same time, simplifying the login process and reducing the error rate. Improve user experience. Moreover, the login information is independently managed by the business server, and the business server does not need to synchronize the user login information to the VPN server, thereby ensuring the security of the customer's internal data. The login management server or VPN server can directly verify the legitimacy of the user based on the user identity, and there is no need to maintain a separate set of user login accounts, which reduces the processing pressure.

Optionally, in step 203 in FIG. 2 above, the login management server verifies the identity of the user according to the legal user information, and generates the login response based on the verification result.

Specifically, legal user information may be pre-provided by enterprise customers who purchase VPN services to VPN service providers (i.e., network service providers), and VPN service providers may store them on their own servers, such as login management server, VPN server, or other servers or clusters used to manage legitimate user information. Legitimate user information may include user identity and access rights and other related information, where access rights refer to the user's rights to access VPN services. It is understandable that when legal user information changes, corporate customers can provide the changed information to VPN Service providers to update saved legitimate user information.

Based on this, when the legal user information is stored on the login management server, the login management server can verify the user identity obtained from the business server based on the locally stored user legal information to determine whether the user corresponding to the user identity is Have access to the VPN service.

In another implementation, the login management server may also request to verify whether the user has the right to access the VPN service by sending the user identity to other servers storing legitimate user information.

In one example, after the login management server determines that the user is a legitimate user of the service server and obtains the user's identity through the service server, it sends the identity to the VPN server in the trust request. After the VPN server receives the trust request, it compares the identity identifier in the trust request with the legal user information stored locally. If the identity identifier exists in the legitimate user information, it determines that the user is a legitimate user of the VPN service; if the stored If there is no identity identifier in the legal user information, it is determined that the user is not a legal user of the VPN service.

It is worth noting that, in order to ensure the security of data transmission, the trust request sent by the login management server needs to be transmitted based on the VPN network, which is deployed between the VPN server and the login management server. Moreover, the login management server may encrypt the user identity carried in the trust request based on an encryption method pre-negotiated with the VPN server, so as to further prevent leakage of user information. Correspondingly, when the VPN server receives the encrypted user ID, it needs to decrypt it first.

Optionally, in the above embodiment, the login response is used to indicate whether the user has successfully logged in to the service server and the VPN service through a browser. Since the browser and the VPN client application are two different programs, in order to improve For security, in the scenario where the user logs in through the VPN client application, the login verification on the VPN client application side needs to be further completed. For this reason, after the login management server or the VPN server determines that the user is a legal user of the VPN service, a token can be generated for the verification flow authentication shown in FIG. 4 .

For example, please refer to FIG. 4 , which is a schematic diagram of a token authentication process in the login method provided by the embodiment of the present application. This example includes:

Step 401, the VPN server receives a trust request from the login management server. Wherein, the trust request carries the identity of the user.

In step 402, the VPN server verifies the legality of the user based on the identity to obtain a legality verification result. The validity verification result is used to indicate whether the user is a legal user of the VPN service.

Step 403, the VPN server generates a token for the user.

Exemplarily, after the VPN server finds that the user is a legal user of the VPN service, it generates a token (token) for the user, and the token is used to verify the legitimacy of the VPN client application.

Step 404, the VPN server sends a trust response carrying the token to the login management server.

Step 405, the login management server sends a login response carrying the token to the terminal device.

Exemplarily, the login management server sends the token in the login response to the browser of the terminal device.

Step 406, the browser of the terminal device displays a login success page.

Step 407, the browser of the terminal device uses the login success page to activate the VPN client application, and sends the token to the VPN client application.

In the embodiment of the present application, the browser activates the VPN client application by means of running a script on the successful login page or the like. For example, the terminal device displays a successful login page through a browser. After displaying a preset duration, the script in the successful login page is automatically run to activate the VPN client. The preset duration is, for example, 3 seconds or 4 seconds. Not limited.

For another example, the terminal device displays a successful login page through the browser, and the user clicks the close button on the successful login page to trigger the script to run, thereby activating the VPN client.

Step 408, the VPN client application sends an authentication request carrying the token to the VPN server providing the VPN service.

Exemplarily, the address information of the VPN server that provides the VPN service can be pre-configured in the VPN client application. After the VPN client application is activated by the browser, it will automatically send an authentication request to the VPN service based on the received token. In another example, the address of the VPN server may be selected by the login management server based on a proximity principle or a load balancing policy and delivered to the user.

Step 409, the VPN server verifies the authentication request to obtain a feedback result.

Exemplarily, the VPN server itself verifies the token carried in the authentication request.

For example, the VPN server generates a token and stores the token. When the VPN server receives the authentication request sent by the VPN client application to the VPN server, the VPN server verifies the token carried in the authentication request based on the stored token to obtain a feedback result. Wherein, the feedback result is used to indicate whether the user successfully logs in the service server and the VPN service through the VPN client application.

In the embodiment shown in Figure 4, the legality of the user is verified by the VPN server, and in the embodiment where the legality of the user is directly verified by the login management server, the operation of generating the token can also be completed by the login management server. After logging in to the management server to generate a token, on the one hand, the token will be passed to the VPN client application of the user in the same way as above, and on the other hand, the token will be sent to the VPN server, so that the VPN server receives the VPN client application. In this embodiment, the user's legitimacy verification, generation and delivery of tokens are all implemented by the login management server, and the VPN server only needs to verify the token according to the received command. It only needs to verify the VPN client application with the card, thereby reducing the processing pressure on the VPN server and ensuring the processing resources of the VPN service.

In addition, the authentication request probably does not carry a token. At this time, the VPN server directly determines that the VPN client application is illegal, that is, the user fails to successfully log in to the business server and VPN service through the VPN application.

With this solution, the token carried in the authentication request can be verified by the VPN server to ensure the validity of the VPN client application, thereby completing the login process of the user through the VPN client application.

Optionally, in the above embodiment, after the token is generated by the login management server or the VPN server, the state of the token can be set based on the validity period or other information and the token can be stored. For example, if the token has expired, the token will be set to the invalid state, and the VPN server will set the token to the invalid state when it receives the notification that the user has expired sent by the VPN client application; If the VPN service has expired, the token is set to an invalid state. Hereinafter, the token generated and stored by the VPN server is referred to as the first token.

Afterwards, the VPN client application sends an authentication request carrying a token to the VPN server, and the VPN server verifies the token carried in the authentication request according to the previously generated and stored token. Hereinafter, the previously generated and stored token is referred to as the first token, and the token carried in the authentication request is referred to as the second token. If the VPN service end determines the same token as the second token from a plurality of stored first tokens, then determine that the second token is a token generated by the VPN service end, and further judge the state of the second token Is it normal. If the state of the second token is normal, the VPN server generates a feedback result indicating that the second token is legal. If the second token is not generated by the VPN server or the status is abnormal, such as invalid, the VPN server generates a feedback result indicating that the second token is illegal.

By adopting this scheme, by further verifying whether the status of the token is normal, the purpose of real-time and accurate verification of the legitimacy of the token can be realized.

Step 410, the VPN server sends the feedback result to the VPN client application of the terminal device.

The VPN server determines whether to provide the VPN service for the VPN client application based on the feedback result. Specifically, if the feedback result indicates that the user has successfully logged in the service server and the VPN service through the VPN client application, step 411 is executed.

Step 411, the VPN server establishes a VPN tunnel with the VPN client application.

The VPN server normally responds to the VPN tunnel establishment request sent by the VPN client application to establish a VPN tunnel between the VPN client application and the VPN server. service request from the service server; or, the VPN tunnel will be used to transmit the service request sent by the user to other service servers connected to the service server through the VPN client application. After the VPN server receives the service request from the VPN tunnel, it can Send the service request to the service server.

It can be understood that, in the scenario where the service server is an SSO system server, the service request sent by the user to the service server includes service requests sent by the user for all services accessing the SSO system server.

If the feedback result indicates that the user has not successfully logged into the service server and the VPN service through the VPN client application, the VPN service end will refuse to establish a VPN tunnel with the VPN client application, thereby refusing to receive the user's intranet access request . At the same time, the VPN client application of the terminal device pops up a prompt message to prompt the user to fail to log in, and refuses to establish a VPN tunnel with the VPN client application.

In the above-mentioned embodiment, after the user successfully logs in to the service server and VPN service through the browser, the VPN client application is invoked, and the legitimacy of the VPN client application is confirmed based on the token, thereby determining whether the user successfully logs in to the service through the VPN client application. Server and VPN service, during the whole operation process, the switching between the VPN client application and the browser is automatically realized, without manual switching by the user. It is easy to operate and has a good experience for the user, and the user only needs to enter one login information, you can log in to the VPN service and business server through the VPN client application.

The complete process of implementing login based on the VPN client application will be illustrated below with reference to FIG. 5 .

Fig. 5 is a schematic diagram of the process of the login method provided by the embodiment of the present application. Please refer to Fig. 5, the present embodiment includes:

Step 501 , the terminal device recognizes the user's click operation on the VPN client application, and determines that the user selects a joint login mode.

Exemplarily, the user opens the VPN client application on the desktop of the terminal device, and clicks on the user interface of the VPN client application to select the unified login mode. For details, refer to the description of FIG. 3 , which will not be repeated here.

Step 502, the terminal device pops up a browser.

Exemplarily, the VPN client application responds to the joint login mode operation selected by the user, automatically invokes the browser, and designates it to access the login management server, and the login management server is deployed in the public network.

Step 503, the browser sends a login page request to the login management server, and the login page request is used to request to log in to the service server and VPN service.

Step 504, the browser receives a redirection response from the login management server.

Exemplarily, the login management server sends a redirection response to the browser based on replying to the browser with an http 302 jump, etc., thereby providing the browser with the access address of the business server to redirect the browser to the business server.

Step 505, the browser sends the login page request to the service server according to the redirection response. Exemplarily, the browser sends a login page request to the service server based on the received 302 redirection, that is, the above-mentioned redirection response.

Step 506, the browser receives the data stream for displaying the login page from the service server and displays the login page.

Exemplarily, the service server feeds back the data flow to the browser after receiving the login page request. After the browser receives the data stream, it renders and displays the login page.

Step 507, the browser acquires the login information input by the user on the login page.

Exemplarily, the user enters login information such as account number, password, enterprise ID, and verification code on the login page.

Step 508, the browser submits the login information to the service server.

Step 509, the service server performs legality verification on the user according to the login information.

Exemplarily, if the user is a valid user of the service server, step 510 is performed; if the user is not a valid user of the service server, the service server triggers the browser to display a prompt message to prompt the user that the login fails.

Step 510, the service server sends a redirection response carrying parameters of successful login to the browser.

Exemplarily, if the user is a legitimate user of the service server, the service server sends a 302 redirect to the browser, that is, a redirection response carrying a successful login parameter, thereby redirecting the browser to the login management server.

Step 511, the browser sends an adaptation page request carrying the login success parameter to the login management server.

After receiving the 302 jump in step 510, the browser sends an adaptation page request to the login management server with the received login success parameter. The login success parameter includes the user login ID generated by the business server according to the current user login, and is used to uniquely identify the user login record.

Step 512, the browser receives the data stream for displaying the adaptation page from the login management server and displays the adaptation page.

Exemplarily, the browser displays "authentication in progress" and the like.

Step 513, the login management server acquires the user's identity from the service server.

Exemplarily, the login management server acquires the user's identity from the service server according to the login success parameter, and the identity includes the user name and the like.

Step 514, for the legal user of the service server, log in to the management server and the VPN server to perform mutual trust authentication.

Exemplarily, after the login management server obtains the user's identity from the service server, it considers that the user is a legitimate user of the service server, but cannot determine whether the user is a legitimate user of the VPN service. Therefore, for a legitimate user of the service server, the login management server further performs mutual trust authentication with the VPN server to determine whether the user is a legitimate user of the VPN service.

The VPN server verifies the legality of the user according to the user's identity. If the user has VPN authority, that is, the user is a legal user of the VPN service, then the VPN server executes step 515 to generate a token. If the user does not have the VPN authority, the VPN server sends a prompt message to the login management server, and the login management server sends the prompt message to the terminal device to be displayed by the terminal device, thereby prompting the user to fail to log in.

Step 515, the VPN server generates a token for the user and sends a trust response carrying the token to the login management server, where the token is used to verify the validity of the VPN client application of the terminal device.

Exemplarily, the VPN server generates a token for this user login, and carries it to the login management server in the trust response.

The VPN server generates a token based on the user's identity, and the token is, for example, a character string generated according to the user's identity. Furthermore, the VPN server sets a valid period for each token, and the token is only valid within the valid period, so as to avoid security problems caused by token loss.

Step 516, the login management server sends a login response carrying the token to the browser.

Step 517, the browser activates the VPN client application based on the successful login page.

After the browser displays the successful login page, activate the VPN client application by running the script on the page, wherein the script on the successful login page uses the built-in method of the browser to invoke the VPN client application and bring the token, so as to pass the token to the VPN client application. Among them, the browser built-in method example is as follows: appName://truthLogin? Token=123456.

Step 518, the VPN client application sends an authentication request carrying the token to the VPN server providing the VPN service.

Exemplarily, after the VPN client application is activated, it receives the token passed by the browser, and automatically carries the token in the authentication request and sends it to the VPN server.

After the VPN server receives the authentication request, the VPN server verifies the validity of the token and obtains a feedback result to determine whether the VPN client application is legal.

Step 519, the VPN server sends the feedback result to the VPN client application to complete the login. If the feedback result indicates that the VPN client application has successfully logged in to the business server and VPN service, the VPN client application can display the successful login information and display the business service access interface for the user to operate; if the feedback result indicates that the login fails, the VPN client application Display the login failure information to the user, and reject the user's request or operation on the business access interface.

FIG. 6 is a schematic structural diagram of an electronic device provided by an embodiment of the present application. As shown in FIG. 6, the electronic device 600 is, for example, one of the above-mentioned login management server, VPN authentication terminal, VPN server end, service server or terminal device, and the electronic device 600 includes: a processor 601 and a memory 602;

The memory 602 stores computer instructions;

The processor 601 executes the computer instructions stored in the memory 602, so that the processor 601 executes the login method implemented by the above login management server, VPN authentication end, VPN server end, service server or terminal equipment.

For the specific implementation process of the processor 601, reference may be made to the foregoing method embodiments, and the implementation principles and technical effects thereof are similar, and details are not repeated here in this embodiment.

Optionally, the electronic device 600 further includes a communication component 603 . Wherein, the processor 601 , the memory 602 and the communication component 603 may be connected through a bus 604 .

The embodiment of the present application also provides a computer-readable storage medium, where computer instructions are stored in the computer-readable storage medium, and when the computer instructions are executed by a processor, they are used to implement the above login management server, VPN authentication terminal, and VPN service The login method implemented by the client, service server or terminal device.

The embodiment of the present application also provides a computer program product, the computer program product includes a computer program, and when the computer program is executed by the processor, the login method implemented by the login management server, the VPN authentication terminal, the VPN server terminal, the service server or the terminal equipment is implemented as above .

Other embodiments of the present application will be readily apparent to those skilled in the art from consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any modification, use or adaptation of the application, these modifications, uses or adaptations follow the general principles of the application and include common knowledge or conventional technical means in the technical field not disclosed in the application . The specification and examples are to be considered exemplary only, with a true scope and spirit of the application indicated by the following claims.

It should be understood that the present application is not limited to the precise constructions which have been described above and shown in the accompanying drawings, and various modifications and changes may be made without departing from the scope thereof. The scope of the application is limited only by the appended claims.

Claims

A login method applied to a login management server deployed in a public network, the method comprising:

After determining that the user is a legitimate user of the service server, the identity of the user is obtained through the service server, and the login management server communicates with the service server based on a VPN network;

Based on the identity of the user, determine whether the user is a legal user of the VPN service to generate a login response, and the login response is used to indicate whether the user successfully logs in to the service server and the VPN service;

Send the login response to the terminal device.
The method according to claim 1, wherein after determining that the user is a legal user of the service server, obtaining the identity of the user through the service server includes:

receiving a login page request sent by the user through the browser, where the login page request is used to request to log in to the service server and the VPN service;

sending a redirection response to the terminal device, so that the browser sends the login page request to the service server according to the redirection response, and submits login information based on the login page fed back by the service server, for The service server confirms whether the user is legal;

receiving an adaptation page request from the browser carrying successful login parameters;

Sending a data stream for displaying an adaptation page to the browser, so that the browser displays the adaptation page, and requests the service server for the identity of the user according to the login success parameter.
The method according to claim 1, wherein the determining whether the user is a legal user of the VPN service based on the identity of the user to generate a login response includes:

Verifying the identity of the user based on legal user information stored locally, and generating the login response based on the verification result; or,

Send a trust request to a virtual private network VPN service end deployed in the public network, the trust request carries the identity of the user, and the VPN service end is used to provide the VPN service; receive the trust from the VPN service end Response, generating the login response according to the trust response.
The method according to claim 3, wherein the sending the login response to the terminal device comprises:

When the trust response carries a token for the user, send a login response carrying the token to the browser for displaying a successful login page, the token is used to indicate that the user is the Legitimate users of VPN services.
A login method applied to a virtual private network (VPN) service end deployed in a public network, said method comprising:

Receive a trust request from a login management server deployed in the public network, the trust request carries the identity of the user, and the trust request is sent by the login management server after determining that the user is a legal user of the service server;

performing legality verification on the user based on the identity to obtain a legality verification result, where the legality verification result is used to indicate whether the user is a legal user of the VPN service;

Sending a trust response carrying the legality verification result to the login management server.
The method according to claim 5, said method further comprising:

When the legitimacy verification result indicates that the user is a legal user of the VPN service, generate a token for the user, and carry the token in the trust response.
The method according to claim 6, wherein after sending the trust response carrying the legitimacy verification result to the login management server, further comprising:

receiving the authentication request sent by the terminal device through the VPN client application, the authentication request carrying the token;

Verifying whether the token is valid to obtain a feedback result, the feedback result is used to indicate whether the user has successfully logged in the service server and the VPN service through the VPN client application;

Send the feedback result to the application VPN client application of the terminal device.
The method according to claim 7, wherein said verifying whether said token is legal to obtain a feedback result comprises:

verifying whether the token is generated by the VPN server, and whether the state of the token is normal;

If the token is generated by the VPN server and the status is normal, then generate a feedback result indicating that the token is legal;

Otherwise, generate a feedback result indicating that the token is invalid.
The method according to claim 7 or 8, wherein, after sending the feedback result to the VPN client application, further comprising:

If the feedback result indicates that the VPN client application has successfully logged into the service server and the VPN service, then establish a VPN tunnel with the VPN client application, so as to receive the user through the VPN tunnel through the VPN client. The service request sent by the application.
A login method applied to a service server deployed in an intranet, the method comprising:

receiving a login page request sent by the user through a browser on the terminal device, wherein the login page request is generated and sent by the browser based on the redirection response sent by the login management server;

sending a data stream for displaying a login page to the terminal device;

receiving login information submitted by the terminal device based on the login page;

Verifying the legitimacy of the user according to the login information;

If the user is a legal user of the service server, send a redirection response carrying a login success parameter to the terminal device, and the redirection response is used to instruct the browser of the terminal device to log in to the management server Send an adaptation page request carrying the login success parameter.
A login method applied to a terminal device, the method comprising:

Obtaining a data stream for displaying a login page through a browser and displaying the login page, the login page being used to log in to the service server and the VPN service;

sending login information to the service server based on the login page;

Receiving a redirection response from the service server that carries a successful login parameter;

sending an adaptation page request carrying the login success parameter to the login management server through the browser;

receiving a data stream for displaying an adaptation page from the login management server and displaying the adaptation page;

Receive a login response from the login management server, where the login response is used to indicate whether the user has successfully logged in the service server and the VPN service through the browser.
The method according to claim 11, wherein said obtaining the data stream for displaying the login page through the browser and displaying the login page comprises:

Send a login page request to the login management server through the browser, and the login page request is used to request the login service server and VPN service;

receiving a redirection response from the login management server;

sending the login page request to the service server according to the redirection response;

receiving the data stream for displaying the login page from the service server and displaying the login page.
The method according to claim 11 or claim 12, wherein, after receiving the login response from the login management server, further comprising:

When the login response carries a token, switch from the adaptation page to a successful login page according to the login response, and the successful login page carries the token;

Activate the application VPN client application using the login success page;

Using the VPN client application to send an authentication request carrying the token to the VPN server providing the VPN service;

Receive a feedback result from the VPN server, where the feedback result is used to indicate whether the user has successfully logged in the service server and the VPN service through the VPN client application.
The method according to claim 13, wherein, after receiving the feedback result from the VPN server, further comprising:

If the feedback result indicates that the user successfully logs in to the service server and the VPN service through the VPN client application, request to establish a VPN tunnel with the VPN server through the VPN client application;

Sending a service request to the VPN server through the VPN tunnel.
An electronic device, comprising a processor, a memory, and a computer program stored on the memory and operable on the processor, when the processor executes the computer program, the electronic device realizes claim 1 to the method described in any one of 14.
A computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the method according to any one of claims 1 to 14 is implemented.