WO2017186005A1 - 一种云桌面认证的方法、服务器及终端 - Google Patents

一种云桌面认证的方法、服务器及终端 Download PDF

Info

Publication number
WO2017186005A1
WO2017186005A1 PCT/CN2017/080697 CN2017080697W WO2017186005A1 WO 2017186005 A1 WO2017186005 A1 WO 2017186005A1 CN 2017080697 W CN2017080697 W CN 2017080697W WO 2017186005 A1 WO2017186005 A1 WO 2017186005A1
Authority
WO
WIPO (PCT)
Prior art keywords
login
information
user
terminal
authentication server
Prior art date
Application number
PCT/CN2017/080697
Other languages
English (en)
French (fr)
Inventor
仝森太
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2017186005A1 publication Critical patent/WO2017186005A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90—Details of database functions independent of the retrieved data types
    • G06F16/95—Retrieval from the web
    • G06F16/955—Retrieval from the web using information identifiers, e.g. uniform resource locators [URL]
    • G06F16/9554—Retrieval from the web using information identifiers, e.g. uniform resource locators [URL] by using bar codes
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
    • H04L9/3213—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority using tickets or tokens, e.g. Kerberos
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2111—Location-sensitive, e.g. geographical location, GPS

Definitions

  • the present application relates to, but is not limited to, the field of communications, for example, to a method, server and terminal for cloud desktop authentication.
  • cloud desktop technology Due to the significant reduction in maintenance costs and ease of management, cloud desktop technology has been widely used in many fields.
  • the login system of the cloud desktop can be simply described as the combination mode of the terminal and the host. The full desktop is then pushed to the terminal for display by the display protocol.
  • Cloud desktop technology relies on Internet technology to provide users with a wealth of applications in the Internet field.
  • the technology of cloud desktop has a strong advantage, the current cloud desktop login mainly adopts password interactive login mode, and its security will naturally attract great attention.
  • cloud desktops are mainly based on thin terminal login. Although they can log in to their desktops remotely, they are not really mobile.
  • the related art provides a cloud terminal identity authentication method, which generates a first ciphertext by using a preset cryptographic algorithm based on a user's account and password, and generates a two-dimensional corresponding to the first ciphertext by using a two-dimensional code tool.
  • the code image which is fixed and has a security risk.
  • the related technology also provides a virtual desktop cloud connection method based on out-of-band authentication.
  • the solution needs to log in a virtual desktop to generate a two-dimensional code, and then switch to out-of-band operation, and the two-dimensional code is based on user information and device information. And permission generation, is fixed, there is a security risk.
  • the embodiments of the present disclosure provide a method, a server, and a terminal for cloud desktop authentication to improve the security of cloud desktop login authentication.
  • the embodiment of the present disclosure provides a method for cloud desktop authentication, including:
  • the authentication server verifies the user information in response to the user login request
  • the virtual desktop connection parameter information is obtained from the login server.
  • the verifying, by the authentication server, the user information in response to the user login request includes: after the authentication server receives the user login request message sent by the terminal, verifying the user information;
  • the method further includes: sending a login page of the two-dimensional code to the terminal.
  • the verifying the user information includes:
  • the user login request message carries the user login information.
  • the user login information includes user login time information and/or user login location information.
  • An authentication server that includes:
  • a verification module configured to verify user information in response to a user login request
  • An obtaining module configured to obtain a virtual desktop connection parameter from the login server after the verification module passes the verification
  • the generating module is configured to generate a login page of the two-dimensional code according to the user login information and the virtual desktop connection parameter.
  • the verification module is configured to: after receiving the user login request message sent by the terminal, verify the user information;
  • the generating module is further configured to send a login page of the two-dimensional code to the terminal.
  • the authentication server of this embodiment further includes a storage module.
  • the verification module when verifying the user information, includes: when the user is a registered user, returning a first token having a validity period to the terminal, and sending the first token to the login server; Determining whether the second token is valid by using the user login information and the second token sent by the terminal;
  • the storage module is configured to store the user login information when the verification module verifies that the second token is valid, and the user login information includes user login time information and/or user login location information.
  • a method for cloud desktop authentication including:
  • the terminal initiates a user login request to the authentication server according to the login cloud desktop application.
  • the terminal acquires a login page of the two-dimensional code of the authentication server.
  • the terminal initiating a user login request to the authentication server according to the login cloud desktop application includes: after the terminal starts to log in to the cloud desktop application, sending, by the terminal, a user login request message to the authentication server;
  • the obtaining, by the terminal, the login page of the two-dimensional code of the authentication server includes: the terminal receiving a login page of the two-dimensional code sent by the authentication server.
  • the user login request message carries pre-stored registered user information.
  • the user login request message carries user login information.
  • the method further includes:
  • the authentication server Receiving, by the terminal, the authentication server to send a verification message, if the verification is successful, acquiring a first token with a validity period carried in the verification message;
  • the user login information is encrypted by using the first token, and the encrypted user login information and the second token are sent to the authentication server.
  • the terminal after receiving the login page of the two-dimensional code sent by the authentication server, the terminal further includes:
  • the terminal After receiving the parsing instruction, the terminal parses time information and/or location information in the two-dimensional code;
  • the login cloud desktop request message is sent to the login server.
  • a terminal comprising:
  • the startup module is configured to initiate a user login request to the authentication server according to the login cloud desktop application
  • the receiving module is configured to acquire a login page of the two-dimensional code of the authentication server.
  • the startup module is configured to send a user login request message to the authentication server after the login to the cloud desktop application is started;
  • the receiving module is configured to receive a login page of the two-dimensional code sent by the authentication server.
  • the startup module carries the user login request message sent to the authentication server. Pre-stored registered user information.
  • an encryption module is further included,
  • the receiving module is further configured to receive the verification message sent by the authentication server, and if the verification is successful, obtain the first token with the validity period carried in the verification message;
  • the encryption module is configured to encrypt the user login information by using the first token, and send the encrypted user login information and the second token to the authentication server.
  • it also includes:
  • the parsing module is configured to parse the time information and/or the location information in the two-dimensional code after receiving the parsing instruction;
  • the sending module is configured to send a login cloud desktop request message to the login server when the parsed time information and/or location information meets the specified condition.
  • a method for cloud desktop authentication including:
  • the login server receives the virtual desktop connection parameter request message of the authentication server
  • the virtual desktop connection parameter information is sent to the authentication server.
  • the method further includes:
  • the login server compares the second token carried in the obtaining the virtual desktop connection parameter request message with the pre-stored first token, and sends the virtual desktop connection parameter information to the authentication server.
  • the method further includes:
  • the login server After receiving the login cloud desktop request message of the terminal, the login server pushes the virtual desktop to the terminal.
  • a login server that includes:
  • a receiving module configured to receive a virtual desktop connection parameter request message of the authentication server
  • the sending module is configured to send the virtual desktop connection parameter information to the authentication server.
  • it also includes:
  • the comparison module compares the second token carried in the obtaining the virtual desktop connection parameter request message with the pre-stored first token, and if the same, triggers the sending module to send the virtual desktop connection parameter information to the authentication server. .
  • it also includes:
  • the push module is configured to: after receiving the login cloud desktop request message of the terminal, push the virtual desktop to the terminal.
  • a non-transitory computer readable storage medium storing computer executable instructions arranged to perform the above method.
  • An electronic device comprising:
  • At least one processor At least one processor
  • the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to cause the at least one processor to perform the method described above.
  • the embodiments of the present disclosure provide a cloud desktop authentication method, a server, and a terminal, which can improve the security performance of the cloud terminal identity authentication, and greatly reduce the risk of user information leakage.
  • FIG. 1 is a flowchart of a method for authenticating a cloud desktop authentication on a server side according to an embodiment of the present disclosure
  • FIG. 2 is a flowchart of a method for cloud desktop authentication on a terminal side according to an embodiment of the present disclosure
  • FIG. 3 is a flowchart of a method for logging in to a cloud desktop authentication on a server side according to an embodiment of the present disclosure
  • FIG. 5 is a flowchart of an intranet login according to an embodiment of the present disclosure.
  • FIG. 6 is a flowchart of an external network login according to an embodiment of the present disclosure.
  • FIG. 7 is a schematic diagram of an authentication server according to an embodiment of the present disclosure.
  • FIG. 8 is a schematic diagram of a terminal according to an embodiment of the present disclosure.
  • FIG. 9 is a schematic diagram of a login server according to an embodiment of the present disclosure.
  • FIG. 10 is a schematic structural diagram of an electronic device according to an embodiment of the present disclosure.
  • FIG. 1 is a flowchart of a method for authenticating a cloud desktop authentication on an authentication server side according to an embodiment of the present disclosure. As shown in FIG. 1 , the method in this embodiment includes:
  • Step 11 After receiving the user login request message sent by the terminal, the authentication server verifies the user information.
  • Step 12 After the verification is passed, obtain virtual desktop connection parameter information from the login server.
  • Step 13 Generate a login page of the two-dimensional code according to the user login information and the virtual desktop connection parameter information, and send the login page of the two-dimensional code to the terminal.
  • verifying the user information in step 11 includes:
  • the user login request message may also carry user login information.
  • the user login information includes user login time information and/or user login location information.
  • the embodiment of the present disclosure provides a method for cloud desktop authentication, which can improve the security and convenience of cloud desktop authentication.
  • FIG. 2 is a flowchart of a method for cloud desktop authentication on a terminal side according to an embodiment of the present disclosure. As shown in FIG. 2, the method in this embodiment includes:
  • Step 21 After the terminal starts to log in to the cloud desktop application, the terminal sends a user login request message to the authentication server.
  • Step 22 The terminal receives a login page of the two-dimensional code sent by the authentication server.
  • the user login request message carries pre-stored registered user information.
  • the user login request message may carry user login information.
  • the method may further include:
  • the authentication server Receiving, by the terminal, the authentication server to send a verification message, if the verification is successful, acquiring a first token with a validity period carried in the verification message;
  • the user login information is encrypted by using the first token, and the encrypted user login information and the second token are sent to the authentication server.
  • the method may further include:
  • the terminal After receiving the parsing instruction, the terminal parses time information and/or location information in the two-dimensional code;
  • the login cloud desktop request message is sent to the login server.
  • FIG. 3 is a flowchart of a method for logging in to the cloud desktop authentication on the server side according to an embodiment of the present disclosure. As shown in FIG. 3, the method in this embodiment includes:
  • Step 31 The login server receives the virtual desktop connection parameter request message of the authentication server.
  • Step 32 Send virtual desktop connection parameter information to the authentication server.
  • the method may further include:
  • the login server compares the second token carried in the obtaining the virtual desktop connection parameter request message with the pre-stored first token, and sends the virtual desktop connection parameter information to the authentication server.
  • the method further includes:
  • the login server After receiving the login cloud desktop request message of the terminal, the login server pushes the virtual desktop to the terminal.
  • Embodiments of the present disclosure may include two processes of registration and login authentication.
  • the registration process of the embodiment of the present disclosure includes the following steps as shown in FIG. 4:
  • the administrator assigns the virtual desktop to the designated user through the management platform, and the user account and the virtual table The face information is associated so that the user has access to the desktop.
  • step Z1 the user performs remote registration through the mobile terminal.
  • the IP address of the authentication server needs to be input, and the user name and password of the corresponding user need to be input.
  • the authentication server determines whether to allow registration according to the password of the user. Return to allow registration to the mobile terminal; if registration is not allowed, refuse registration, return the rejection registration information to the mobile terminal;
  • Step Z2 After receiving the information that allows the registration, the mobile terminal encrypts the successfully registered user name information into the mobile terminal, and at the same time, the authentication server end simultaneously puts information in the registration request, such as the user name and the mobile terminal.
  • the device number is stored in the specified database; when receiving the information rejecting the user registration, the user is prompted, the authentication server rejects the user registration, and prompts the reason for the rejected registration.
  • Step D1 The user opens the cloud desktop login application software on the mobile terminal. At this time, the cloud desktop login application software can automatically bring the encrypted storage user name and the device number of the device, and actively send the requested two-dimensional display to the authentication server S1.
  • Step D2 After receiving the request of the user, the authentication server S1 decrypts the device number of the user according to the previously agreed encryption and decryption algorithm, and finds the specified device number in the database, and finds the specified device number to determine whether it corresponds to the specified user. If the matching is successful, the token (token) 1 that randomly generates the validity period is returned to the mobile terminal, and the authentication server S1 saves the token1 and transmits the value of the token1 to the login server S2. If the specified device number is not found, the information for rejecting the login is returned to the mobile terminal.
  • Step D3 After receiving the token1, the mobile terminal encrypts the time and location of the login according to the specified encryption algorithm according to the specified encryption algorithm, and transmits the time and location of the login to the authentication server S1; when receiving the information for rejecting the login, the mobile terminal may prompt the login authentication to fail. Information.
  • Step D4 The authentication server S1 receives the time and place information transmitted by the terminal, first checks whether the value of token1 is valid, and if valid, saves the time location to the corresponding account, and sends the uploaded token1 to the login server S2. Get the connection parameter request; if token1 is invalid, return the login failure information to the mobile terminal, prompting the login failure.
  • Step D5 The login server S2 receives the request sent by the authentication server S1, and verifies whether the passed token1 is the same as the saved token1, and returns the string of the virtual desktop connection to the authentication server S1; if the verification is different, the acquisition fails. The information is given to the authentication server S1.
  • Step D6 When the authentication server S1 receives the information transmitted by the login server S2, it determines whether the connection parameter of the virtual desktop is successfully obtained. If it fails, the failure information returned by the login server S2 is directly returned to the mobile terminal, and the terminal prompts to log in. If the connection parameter of the virtual desktop is successfully obtained, the authentication server S1 generates a QR code page by uploading the desktop connection parameter information, the pre-stored time, the location, and the token1, and returns the page to the mobile terminal.
  • Step D7 The mobile terminal receives the two-dimensional code page transmitted by the authentication server S1.
  • the user can long-press the two-dimensional code to scan, and solve the time and place information in the two-dimensional code, and determine whether the time is within the specified validity period. And if the location is within the range of change, if yes, the request is sent to the login server S2 with the solved string; if it is not at the valid time or a valid place, the user is prompted to invalidate the login session, please log in again.
  • Step D8 After receiving the request of the mobile terminal, the login server S2 pushes the virtual desktop to the mobile terminal through the display protocol, and the user can experience the operation of the virtual desktop.
  • the security of the user's login cloud desktop is ensured, which saves the user's trouble of inputting the user name and password, and uses the mobile terminal to log in to the cloud desktop, thereby saving not only the method described in the embodiment of the present disclosure. Resource costs and increased work efficiency.
  • a cloud desktop authentication method is provided in an internal network environment, and the mobile client has a function of acquiring a two-dimensional code.
  • the main modules can be divided into: a mobile client, an authentication server, and a desktop login server.
  • the operation process of this embodiment is as shown in FIG. 5, and includes the following steps:
  • Step 101 The login server allocates a virtual desktop to the user usr1, and the virtual desktop name is win7-1;
  • the administrator uses the administrative user account to log in to the management platform, and assigns a virtual desktop to the user usr1 in the background.
  • the virtual desktop name is win7-1, and the password of the user usr1 is set to passwd.
  • Step 102 The mobile terminal starts the cloud desktop login application software, and receives the user name usr1 and the password passwd input by the user to register the device and register the device, and send the user registration information to the authentication server S1.
  • Step 103 The authentication server S1 receives the user registration information transmitted by the mobile terminal, compares the user name and the device number in the user registration information, and if the device information has been bound to the user name, prompts the user “the device has been registered”. If the device is not registered, the username is usr1 and the device name is device1. The data is stored in the database, and a registration success message (OK) is returned to the mobile terminal, and the mobile terminal stores the user name locally.
  • Step 104 When the mobile terminal switches to the login interface, it automatically sends an HTTP (Hyper Text Transfer Protocol) request to the authentication server S1 to obtain a two-dimensional code display page, where the HTTP request includes the user name usr1 and the device information device1.
  • HTTP Hyper Text Transfer Protocol
  • Step 105 After receiving the HTTP request, the authentication server S1 decrypts the user name usr1 and the device name device1, and performs matching between the device and the user name in the registered database. If the matching fails, the user returns no device registration and refuses. The login information is displayed to the mobile terminal. If the matching is successful, the success information and the token (key) value key1 are returned to the mobile terminal, and the key1 transmission value is registered to the server S2 for storage.
  • Step 106 After receiving the key1 value, the mobile terminal encrypts and transmits the current device time t1 and/or the location latitude and longitude p1 to the authentication server S1 according to the key1.
  • Step 107 After receiving the token request, the authentication server decrypts the corresponding key1 and compares it with the previously stored key1. If the key1 is invalid, the login request of the user usr1 is rejected, and the “usr1 login failure” message is returned to the mobile terminal for display; key1 is valid. Then, the key1 is sent to the login server S2 to send a request to obtain the desktop connection parameter.
  • Step 108 After receiving the HTTP request of the authentication server, the login server S2 compares whether the previously stored key1 is valid. If it is invalid, returns a message “Failed to obtain the desktop connection parameter” to the authentication server S1, and the authentication server S1 transmits the message. Display to the mobile terminal. If the authentication is successful, the desktop connection parameter is transmitted to the authentication server S1, such as a string: --192.168.11.11 1021 key1.
  • Step 109 After receiving the desktop connection parameter sent by the login server S2, the authentication server S1 generates a two-dimensional code by using the string 192.168.11.11 1021 key1 and the pre-stored time t1, the location p1, and the key1. The page is returned to the mobile terminal for display.
  • Step 110 After receiving the instruction of the user to press and hold the two-dimensional code page to perform the scanning of the two-dimensional code, the mobile terminal extracts the string connecting the desktop--192.168.11.11 1021 key1, time t2, location p2, and t2. T1 is compared with p2 and p1. If the time difference exceeds the allowable range or the location exceeds the allowable range, the message “Session is invalid, please log in again”; if the time difference does not exceed the allowable range and the location does not exceed the allowable range, it will be directly A cloud desktop request is initiated to the login server S2.
  • Step 111 After receiving the cloud desktop request, the login server transmits the virtual desktop to the mobile terminal. display.
  • a cloud desktop authentication method is provided in an external network environment, and the mobile client has a function of acquiring a two-dimensional code.
  • the main module functions can be divided into: mobile client, gateway server, authentication server and desktop login server.
  • Step 201 The login server allocates a virtual desktop to the user usr2, and the virtual desktop name is win7-2.
  • the administrator uses the administrative user account to log in to the management platform, and assigns a virtual desktop to the user usr2 in the background.
  • the virtual desktop name is win7-2, and the password of the user usr2 is set to passwd2.
  • Step 202 The mobile terminal starts the cloud desktop login application software, and receives the user input user name usr2 and password passwd2 to register the device and register the device, and send the user registration information to the gateway server.
  • the gateway server receives the user registration information transmitted by the mobile terminal, and forwards the user registration information to the authentication server S1 for authentication.
  • Step 203 The authentication server S1 receives the user registration information transmitted by the mobile terminal, compares the user name and the device number in the user registration information, and if the device information has been bound to the user name, prompts the user “the device has been registered”. If the device is not registered, the user name usr2 and the device name device2 are stored in the database, and OK is returned to the mobile terminal, and the mobile terminal stores the user name locally.
  • Step 204 When the mobile terminal switches to the login interface, it automatically sends an HTTP request to the gateway server, and forwards the request to the authentication server S1 for authentication.
  • Step 205 The authentication server S1 receives the HTTP request to obtain a two-dimensional code display page, where the HTTP request includes the user name usr2 and the device information device2.
  • the verification server S1 After receiving the HTTP request, the verification server S1 decrypts the user name usr2 and the device name device2, and matches the device and the user name in the registered database. If the matching fails, the system returns "The user has not registered the device and refuses to log in”. The information is sent to the gateway server and forwarded to the mobile terminal for display. If the matching is successful, the success information and the token2 value key2 are returned to the gateway server, and forwarded to the mobile terminal, and the key2 transmission value is also logged into the server S2 for storage.
  • Step 206 After receiving the key2 value, the mobile terminal encrypts and transmits the current device time t1 and the location latitude and longitude p1 to the gateway server according to the key2.
  • Step 207 The gateway server forwards the request to the authentication server. After receiving the HTTP request, the authentication server decrypts the corresponding key2 and compares it with the pre-stored key2. If the key2 is invalid, the login request of the user usr2 is rejected, and the “usr2 login failure” is returned. The information is sent to the gateway server and forwarded to the mobile terminal for display; if key2 is valid, the key2 is sent to the login server S2 to send a request to obtain the desktop connection parameter.
  • Step 208 After receiving the http request of the authentication server, the login server S2 compares whether the pre-stored key2 is valid. If it is invalid, returns a message “Failed to obtain the desktop connection parameter” to the authentication server S1, and the authentication server S1 transmits the message. To the gateway server, the network management server forwards it to the mobile terminal for display. If the authentication is successful, the string information is transmitted to the authentication server S1, such as a string: --192.168.11.11 1022 key2.
  • Step 209 After receiving the login string transmitted by the login server S2, the authentication server S1 generates a two-dimensional code page by using the string 192.168.11.11 1022 key2 and the pre-stored time t1, the location p1, and the key2, and the page is generated. Return to the gateway server and forward it to the mobile terminal for display.
  • Step 210 The mobile terminal receives an instruction of the user to press and hold the two-dimensional code page to scan the two-dimensional code, and extracts a string connecting the desktop--192.168.11.11 1022 key2, time t2, location p2, t2, t1 Compare with p2 and p1. If the time difference exceeds the allowable range or the location exceeds the allowable range, the message “Session is invalid, please log in again”; if the time difference does not exceed the allowable range and the location does not exceed the allowable range, it will directly The login server initiates a request for a desktop request.
  • Step 211 After receiving the desktop request forwarded by the gateway server, the login server transmits the desktop to the mobile terminal for display.
  • FIG. 7 is a schematic diagram of an authentication server according to an embodiment of the present disclosure. As shown in FIG. 7, the authentication server in this embodiment includes:
  • the verification module is configured to: after receiving the user login request message sent by the terminal, verify the user information
  • An obtaining module configured to obtain a virtual desktop connection parameter from the login server after the verification module passes the verification
  • the generating module is configured to generate a login page of the two-dimensional code according to the user login information and the virtual desktop connection parameter, and send the login page of the two-dimensional code to the terminal.
  • the authentication server in this embodiment may further include: a storage module,
  • the verification module when verifying the user information, includes: when the user is a registered user, returning a first token having a validity period to the terminal, and sending the first token to the login server; Determining whether the second token is valid by using the user login information and the second token sent by the terminal;
  • the storage module is configured to store the user login information when the verification module verifies that the second token is valid, and the user login information includes user login time information and/or user login location information.
  • FIG. 8 is a schematic diagram of a terminal according to an embodiment of the present disclosure. As shown in FIG. 8, the terminal in this embodiment includes:
  • the startup module is configured to send a user login request message to the authentication server after the login to the cloud desktop application is started;
  • the receiving module is configured to receive a login page of the two-dimensional code sent by the authentication server.
  • the startup module sends the pre-stored registered user information to the user login request message sent to the authentication server.
  • the terminal in this embodiment may further include: an encryption module,
  • the receiving module is further configured to receive the verification message sent by the authentication server, and if the verification is successful, obtain the first token with the validity period carried in the verification message;
  • the encryption module is configured to encrypt the user login information by using the first token, and send the encrypted user login information and the second token to the authentication server.
  • the terminal in this embodiment may further include:
  • the parsing module is configured to parse the time information and/or the location information in the two-dimensional code after receiving the parsing instruction;
  • the sending module is configured to send a login cloud desktop request message to the login server when the parsed time information and/or location information meets the specified condition.
  • FIG. 9 is a schematic diagram of a login server according to an embodiment of the present disclosure. As shown in FIG. 9, the login server of this embodiment includes:
  • a receiving module configured to receive a virtual desktop connection parameter request message of the authentication server
  • the sending module is configured to send the virtual desktop connection parameter information to the authentication server.
  • the login server of this embodiment may further include:
  • the comparison module compares the second token carried in the obtaining the virtual desktop connection parameter request message with the pre-stored first token, and if the same, triggers the sending module to send the virtual desktop connection parameter information to the authentication server. .
  • the login server of this embodiment may further include:
  • the push module is configured to: after receiving the login cloud desktop request message of the terminal, push the virtual desktop to the terminal.
  • Embodiments of the present disclosure also provide a non-transitory computer readable storage medium storing computer executable instructions arranged to perform the method of any of the above embodiments.
  • the embodiment of the present disclosure further provides a schematic structural diagram of an electronic device.
  • the electronic device includes:
  • At least one processor 100 which is exemplified by a processor 100 in FIG. 11; and a memory 101, may further include a communication interface 102 and a bus 103.
  • the processor 100, the communication interface 102, and the memory 101 can complete communication with each other through the bus 103.
  • Communication interface 102 can be configured for information transfer.
  • the processor 100 can call logic instructions in the memory 101 to perform the methods of the above-described embodiments.
  • logic instructions in the memory 101 described above may be implemented in the form of a software functional unit and sold or used as a stand-alone product, and may be stored in a computer readable storage medium.
  • the memory 101 is a computer readable storage medium that can be configured to store a software program, a computer executable program, a program instruction/module corresponding to a method in an embodiment of the present disclosure.
  • the processor 100 executes the function application and the data processing by executing the software program, the instruction and the module stored in the memory 101, that is, the method for implementing the cloud desktop authentication in the above method embodiment.
  • the memory 101 may include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application required for at least one function; the storage data area may store data created according to usage of the terminal device, and the like.
  • the memory 101 may include a high speed random access memory, and may also Includes non-volatile memory.
  • the technical solution of the embodiments of the present disclosure may be embodied in the form of a software product stored in a storage medium, including one or more instructions for causing a computer device (which may be a personal computer, a server, or a network) The device or the like) performs all or part of the steps of the method described in the embodiments of the present disclosure.
  • the foregoing storage medium may be a non-transitory storage medium, including: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and the like.
  • the method, the server and the terminal for cloud desktop authentication provided by the embodiments of the present disclosure can improve the security performance of the cloud terminal identity authentication, and greatly reduce the risk of leakage of user information.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Signal Processing (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Databases & Information Systems (AREA)
  • Software Systems (AREA)
  • Computing Systems (AREA)
  • Data Mining & Analysis (AREA)
  • Information Transfer Between Computers (AREA)
  • Computer And Data Communications (AREA)

Abstract

本公开实施例提供一种云桌面认证的方法、服务器及终端，该方法包括：认证服务器响应用户登录请求对用户信息进行验证；验证通过后，向登录服务器获取虚拟桌面连接参数信息；根据用户登录信息和所述虚拟桌面连接参数信息生成二维码的登录页面。该方案能够提高云终端身份认证的安全性能，极大地降低了用户信息的泄漏风险。

Description

一种云桌面认证的方法、服务器及终端 技术领域
本申请涉及但不限于通信领域，例如涉及一种云桌面认证的方法、服务器及终端。
背景技术
由于维护费用的大幅度减少和管理方便等优势，云桌面技术已经在多个领域有广泛的应用。云桌面的登录***可以简单的描述为，终端和主机的组合模式。然后通过显示协议将完整的桌面推送至终端供用户使用。云桌面技术依托于互联网技术，为用户提供互联网领域丰富的应用。虽然云桌面的技术有很强大的优势，但是目前云桌面登录主要采用密码交互式登录方式，其安全性自然会引起极大的关注。目前云桌面主要是基于瘦终端方式登录，虽然可以实现异地登录自己的桌面，但是并不是真正意义的移动办公。
相关技术提供一种云终端身份认证方法，该方案是基于用户的账号和密码通过预设的密码算法生成第一密文，再通过二维码工具生成与所述第一密文对应的二维码图像，该二维码图像是固定不变的，存在安全风险。
相关技术还提供一种基于带外认证的虚拟桌面云连接方法，该方案需要在带内登录虚拟桌面生成二维码，再切换至带外进行操作，且二维码是根据用户信息，设备信息和权限生成，是固定不变的，存在安全风险。
发明内容
本公开实施例提供一种云桌面认证的方法、服务器及终端，以提高云桌面登录认证的安全性。
本公开实施例提供了一种云桌面认证的方法，包括：
认证服务器响应用户登录请求对用户信息进行验证；
验证通过后，向登录服务器获取虚拟桌面连接参数信息；
根据用户登录信息和所述虚拟桌面连接参数信息生成二维码的登录页面。
可选地，所述认证服务器响应用户登录请求对用户信息进行验证包括：认证服务器接收到终端发送的用户登录请求消息后，对用户信息进行验证；
生成所述二维码的登录页面后，还包括：将所述二维码的登录页面发送给所述终端。
可选地，所述对用户信息进行验证包括：
验证用户为已注册用户时，向所述终端返回具有有效期的第一令牌，并将所述第一令牌发送给所述登录服务器；
接收所述终端发送的用户登录信息和第二令牌，验证所述第二令牌有效时，存储所述用户登录信息。
可选地，所述用户登录请求消息携带所述用户登录信息。
可选地，所述用户登录信息包括用户登录时间信息和/或用户登录地点信息。
一种认证服务器，包括：
验证模块，被配置为响应用户登录请求对用户信息进行验证；
获取模块，被配置为在所述验证模块验证通过后，向登录服务器获取虚拟桌面连接参数；
生成模块，被配置为根据用户登录信息和所述虚拟桌面连接参数生成二维码的登录页面。
可选地，所述验证模块，被配置为接收到终端发送的用户登录请求消息后，对用户信息进行验证；
所述生成模块，还被配置为将所述二维码的登录页面发送给所述终端。
可选地，本实施例的认证服务器还包括存储模块，
所述验证模块，对用户信息进行验证包括：验证用户为已注册用户时，向所述终端返回具有有效期的第一令牌，并将所述第一令牌发送给所述登录服务器；接收所述终端发送的用户登录信息和第二令牌，验证所述第二令牌是否有效；
所述存储模块，被配置为在所述验证模块，验证所述第二令牌有效时存储所述用户登录信息，所述用户登录信息包括用户登录时间信息和/或用户登录地点信息。
一种云桌面认证的方法，包括：
终端根据登录云桌面应用向认证服务器发起用户登录请求；
所述终端获取所述认证服务器的二维码的登录页面。
可选地，所述终端根据登录云桌面应用向认证服务器发起用户登录请求包括：终端启动登录云桌面应用后，向认证服务器发送用户登录请求消息；
所述终端获取所述认证服务器的二维码的登录页面包括：所述终端接收所述认证服务器发送的二维码的登录页面。
可选地，所述用户登录请求消息携带预存的已注册的用户信息。
可选地，所述用户登录请求消息携带用户登录信息。
可选地，所述方法还包括：
所述终端接收所述认证服务器发送验证消息，如验证成功，则获取所述验证消息中携带的具有有效期的第一令牌；
利用所述第一令牌对用户登录信息进行加密，将加密后的用户登录信息和第二令牌发送给所述认证服务器。
可选地，所述终端接收所述认证服务器发送的二维码的登录页面之后，还包括：
所述终端接收到解析指令后，解析出所述二维码中的时间信息和/或地点信息；
当所述时间信息和/或地点信息满足指定条件时，向登录服务器发送登录云桌面请求消息。
一种终端，包括：
启动模块，被配置为根据登录云桌面应用向认证服务器发起用户登录请求；
接收模块，被配置为获取所述认证服务器的二维码的登录页面。
可选地，所述启动模块，被配置为启动登录云桌面应用后，向认证服务器发送用户登录请求消息；
所述接收模块，被配置为接收所述认证服务器发送的二维码的登录页面。
可选地，所述启动模块，向认证服务器发送的所述用户登录请求消息携带 预存的已注册的用户信息。
可选地，还包括加密模块，
所述接收模块，还被配置为接收所述认证服务器发送验证消息，如验证成功，则获取所述验证消息中携带的具有有效期的第一令牌；
所述加密模块，被配置为利用所述第一令牌对用户登录信息进行加密，将加密后的用户登录信息和第二令牌发送给所述认证服务器。
可选地，还包括：
解析模块，被配置为接收到解析指令后，解析出所述二维码中的时间信息和/或地点信息；
发送模块，被配置为当解析出的所述时间信息和/或地点信息满足指定条件时，向登录服务器发送登录云桌面请求消息。
一种云桌面认证的方法，包括：
登录服务器接收认证服务器的获取虚拟桌面连接参数请求消息；
将虚拟桌面连接参数信息发送给所述认证服务器。
可选地，所述登录服务器将虚拟桌面连接参数信息发送给所述认证服务器之前，还包括：
所述登录服务器将所述获取虚拟桌面连接参数请求消息携带的第二令牌与预存的第一令牌进行对比，如相同，再将虚拟桌面连接参数信息发送给所述认证服务器。
可选地，所述登录服务器将虚拟桌面连接参数信息发送给所述认证服务器之后，还包括：
所述登录服务器接收到终端的登录云桌面请求消息后，将虚拟桌面推送给所述终端。
一种登录服务器，包括：
接收模块，被配置为接收认证服务器的获取虚拟桌面连接参数请求消息；
发送模块，被配置为将虚拟桌面连接参数信息发送给所述认证服务器。
可选地，还包括：
对比模块，将所述获取虚拟桌面连接参数请求消息携带的第二令牌与预存的第一令牌进行对比，如相同，再触发所述发送模块将虚拟桌面连接参数信息发送给所述认证服务器。
可选地，还包括：
推送模块，被配置为接收到终端的登录云桌面请求消息后，将虚拟桌面推送给所述终端。
一种非暂态计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令设置为执行上述方法。
一种电子设备，包括：
至少一个处理器；以及
与所述至少一个处理器通信连接的存储器；其中，
所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器执行上述的方法。
综上，本公开实施例提供一种云桌面认证的方法、服务器及终端，能够提高云终端身份认证的安全性能，极大地降低了用户信息的泄漏风险。
附图概述
图1为本公开实施例的认证服务器侧的云桌面认证的方法的流程图；
图2为本公开实施例的终端侧的云桌面认证的方法的流程图；
图3为本公开实施例的登录服务器侧的云桌面认证的方法的流程图；
图4为本公开实施例的用户注册的流程图；
图5为本公开实施例的内网登录的流程图；
图6为本公开实施例的外网登录的流程图；
图7为本公开实施例的一种认证服务器的示意图；
图8为本公开实施例的终端的示意图；
图9为本公开实施例的登录服务器的示意图；以及
图10为本公开实施例的电子设备的结构示意图。
具体实施方式
为使本公开的技术方案和优点更加清楚明白，下文中将结合附图对本公开的实施例进行详细说明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互任意组合。
图1为本公开实施例的认证服务器侧的云桌面认证的方法的流程图，如图1所示，本实施例的方法包括：
步骤11、认证服务器接收到终端发送的用户登录请求消息后，对用户信息进行验证；
步骤12、验证通过后，向登录服务器获取虚拟桌面连接参数信息；
步骤13、根据用户登录信息和所述虚拟桌面连接参数信息生成二维码的登录页面，将所述二维码的登录页面发送给所述终端。
可选地，步骤11中对用户信息进行验证包括：
验证用户为已注册用户时，向所述终端返回具有有效期的第一令牌，并将所述第一令牌发送给所述登录服务器；
接收所述终端发送的用户登录信息和第二令牌，验证所述第二令牌有效时，存储所述用户登录信息。
可选地，所述用户登录请求消息也可以携带用户登录信息。
其中，所述用户登录信息包括用户登录时间信息和/或用户登录地点信息。
本公开实施例提供一种的云桌面认证的方法，能提高云桌面认证的安全性和方便性。
图2为本公开实施例的终端侧的云桌面认证的方法的流程图，如图2所示，本实施例的方法包括：
步骤21、终端启动登录云桌面应用后，向认证服务器发送用户登录请求消息；
步骤22、所述终端接收所述认证服务器发送的二维码的登录页面。
可选地，所述用户登录请求消息携带预存的已注册的用户信息。
可选地，所述用户登录请求消息可以携带用户登录信息。
可选地，步骤21之后，还可以包括：
所述终端接收所述认证服务器发送验证消息，如验证成功，则获取所述验证消息中携带的具有有效期的第一令牌；
利用所述第一令牌对用户登录信息进行加密，将加密后的用户登录信息和第二令牌发送给所述认证服务器。
可选地，步骤22之后，还可以包括：
所述终端接收到解析指令后，解析出所述二维码中的时间信息和/或地点信息；
当所述时间信息和/或地点信息满足指定条件时，向登录服务器发送登录云桌面请求消息。
图3为本公开实施例的登录服务器侧的云桌面认证的方法的流程图，如图3所示，本实施例的方法包括：
步骤31、登录服务器接收认证服务器的获取虚拟桌面连接参数请求消息；
步骤32、将虚拟桌面连接参数信息发送给所述认证服务器。
可选地，步骤32之前还可以包括：
所述登录服务器将所述获取虚拟桌面连接参数请求消息携带的第二令牌与预存的第一令牌进行对比，如相同，再将虚拟桌面连接参数信息发送给所述认证服务器。
可选地，步骤32之后还可以包括：
所述登录服务器接收到终端的登录云桌面请求消息后，将虚拟桌面推送给所述终端。
以下对本公开实施例的方法进行详细的说明。本公开实施例可以包括注册和登录认证两个过程。
本公开实施例的注册过程如图4所示包括以下步骤：
管理员通过管理平台将虚拟桌面分配给指定的用户，将用户账号与虚拟桌 面信息进行关联，使用户具有访问桌面的权限。
步骤Z1，用户通过移动终端进行远程注册，此时需要输入认证服务器的IP地址，且需要输入对应用户的用户名和密码，认证服务器接收到请求后根据用户的密码判断是否允许注册，如果允许注册，返回允许注册给移动终端；如果不允许注册，拒绝注册，返回拒绝注册信息给移动终端；
步骤Z2，移动终端接收到允许注册的信息之后，则将注册成功的用户名信息加密存入到移动终端，与此同时，认证服务器端将同时把注册请求里面的信息，如用户名、移动终端的设备号存入指定的数据库；接收到拒绝用户注册的信息时，提示用户，认证服务端决拒绝该用户注册，并且提示拒绝的注册的原因。
本公开实施例的登录认证过程包括以下步骤：
步骤D1、用户打开移动终端上的云桌面登录应用软件，此时，云桌面登录应用软件可以自动带上已加密存储的用户名和该设备的设备号，主动向认证服务器S1发送请求展现的二维码页面；
步骤D2、认证服务器S1接收到用户的请求后，根据之前约定的加解密算法解密出用户的设备号，并且在数据库中找到指定的设备号，找到指定的设备号之后判断是否对应指定的用户，如匹配成功则返回随机生成有效期的token(令牌)1，返回给移动终端，认证服务器S1保存token1并将token1的值传送给登录服务器S2。如未找到指定的设备号，会返回拒绝登录的信息给移动终端。
步骤D3、移动终端收到token1之后，利用token1的值根据指定的加密算法将登录的时间和地点进行加密，传到认证服务器S1；收到拒绝登录的信息的时候，移动终端会提示登录认证失败的信息。
步骤D4、认证服务器S1收到终端传过来的时间地点信息，首先校验token1的值是否有效，如果有效，则将时间地点存到对应的账户下，同时带上传过来的token1向登录服务器S2发送获取连接参数请求；token1无效则返回登录失败的信息给移动终端，提示登录失败。
步骤D5、登录服务器S2接收到认证服务器S1发送的请求，验证传过来的token1与保存的token1是否相同，相同则将虚拟桌面连接的字符串返回给认证服务器S1；验证不一样，则返回获取失败的信息给认证服务器S1。
步骤D6、认证服务器S1接收到登录服务器S2传过来的信息的时候判断是否成功获取虚拟桌面的连接参数，如果失败，则将登录服务器S2返回的失败信息直接返回给移动终端，并在终端提示登录失败；若成功获取虚拟桌面的连接参数成功，则认证服务器S1会将桌面连接参数信息，预存的时间，地点，以及token1生成二维码页面，并将该页面返回给移动终端。
步骤D7、移动终端接收到认证服务器S1传过来的二维码页面，此时用户可以长按二维码进行扫描，解出二维码中的时间地点信息，并判断时间是否在指定的有效期内和地点是否在变化的范围内，若是，则带着解出的字符串向登录服务器S2发起请求；若不在有效的时间或者有效的地点，则会提示用户该次登录会话失效，请重新登录。
步骤D8、登录服务器S2收到移动终端的请求后，通过显示协议将虚拟桌面推送至移动终端，此时用户可以体验虚拟桌面的操作。
采用本公开实施例所述方法，与相关技术相比，在用户的登录云桌面的安全性方面得到了保障，节省了用户输入用户名和密码的麻烦，同时用移动终端来登录云桌面，不仅节省了资源成本，而且提高了工作效率。
下面以两个实施例对本申请的方法进行详细的说明。
实施例一
本实施例中在内网环境中提供了一种云桌面认证的方法，移动客户端具有采集二维码功能。主要模块可分为：移动客户端，认证服务器和桌面登录服务器，本实施例的操作流程如图5所示，包括以下步骤：
步骤101、登录服务器给用户usr1分配虚拟桌面，虚拟桌面名称为win7-1；
管理员使用管理用户账号登录管理平台，在后台给用户usr1分配虚拟桌面，虚拟桌面名称为win7-1，并且设置用户usr1的密码为passwd。
步骤102、移动终端启动云桌面登录应用软件，接收用户输入的用户名usr1和密码passwd进行设备的注册和设备的登记，将用户注册信息发送给认证服务器S1。
步骤103、认证服务器S1接收移动终端传递过来的用户注册信息，将用户注册信息中的用户名和设备号进行比较，若设备信息已经绑定用户名，则提示用户“该设备已经注册”。若设备没有注册过，则将用户名usr1，设备名device1 存入数据库，同时返回注册成功消息(OK)给移动终端，移动终端将用户名存入本地。
步骤104、移动终端切换到登录界面时，自动向认证服务器S1发送HTTP(Hyper Text Transfer Protocol，超文本传输协议)请求获取二维码显示页面，HTTP请求中包含用户名usr1和设备信息device1。
步骤105、认证服务器S1在接收到HTTP请求后，解密出用户名usr1和设备名device1，在已注册的数据库中进行设备和用户名的匹配，匹配失败则返回“该用户未进行设备注册，拒绝登录”信息给移动终端显示，匹配成功则会返回成功信息和token(令牌)值key1给移动终端，同时将key1传送值登录服务器S2进行保存。
步骤106、移动终端接收到key1值后，根据key1将当前设备的时间t1和/或地点经纬度p1进行加密传送至认证服务器S1。
步骤107、认证服务器收到token请求后，会解密出对应的key1，与事先存的key1进行比较，key1无效则拒绝用户usr1的登录请求，返回“usr1登录失败”信息给移动终端显示；key1有效，则将key1带上向登录服务器S2发送请求获取桌面连接参数。
步骤108、登录服务器S2接收到认证服务器的HTTP请求后，比较事先存的key1是否有效，如果无效，则返回“获取桌面连接参数失败”的消息给认证服务器S1，同时认证服务器S1将该消息传送至移动终端进行显示。若认证成功，则将桌面连接参数传送给认证服务器S1，比如字符串：--192.168.11.11 1021 key1。
步骤109、认证服务器S1收到登录服务器S2传过来的桌面连接参数后，将字符串--192.168.11.11 1021 key1后，将该字符串和预存的时间t1，地点p1，以及key1生成二维码页面，并将该页面返回给移动终端进行显示。
步骤110、移动终端接收用户长按住二维码页面进行扫面展示的二维码的指令后，提取出连接桌面的字符串--192.168.11.11 1021 key1，时间t2，地点p2，将t2、t1和p2、p1进行比较，若时间差超过允许的范围或者地点超过允许的范围，则提示“会话失效，请重新登录”；若时间差未超过允许的范围并且地点未超过允许的范围，则将直接向登录服务器S2发起云桌面请求。
步骤111、登录服务器接收到云桌面请求后，把虚拟桌面传给移动终端进行 显示。
实施例二
本实施例中在外网环境中提供了一种云桌面认证的方法，移动客户端具有采集二维码功能。主要模块功能可分为：移动客户端，网关服务器、认证服务器和桌面登录服务器。
步骤201、登录服务器给用户usr2分配虚拟桌面，虚拟桌面名称为win7-2；
管理员使用管理用户账号登录管理平台，在后台给用户usr2分配虚拟桌面，虚拟桌面名称为win7-2，并且设置用户usr2的密码为passwd2。
步骤202、移动终端启动云桌面登录应用软件，接收用户输入用户名usr2和密码passwd2进行设备的注册和设备的登记，将用户注册信息发送给网关服务器。
网关服务器接收到移动终端传过来的用户注册信息，转发该用户注册信息到认证服务器S1进行认证。
步骤203、认证服务器S1接收移动终端传递过来的用户注册信息，将用户注册信息中的用户名和设备号进行比较，若设备信息已经绑定用户名，则提示用户“该设备已经注册”。若设备没有注册过，则将用户名usr2，设备名device2存入数据库，同时返回OK给移动终端，移动终端将用户名存入本地。
步骤204、移动终端切换到登录界面时，自动向网关服务器发送HTTP请求，并将此请求转发至认证服务器S1进行认证。
步骤205、认证服务器S1接收HTTP请求获取二维码显示页面，HTTP请求中包含用户名usr2和设备信息device2。
验证服务器S1在接收到HTTP请求后，会解密出用户名usr2和设备名device2，在已注册的数据库中进行设备和用户名的匹配，匹配失败则返回“该用户未进行设备注册，拒绝登录”信息给网关服务器，并且转发至移动终端显示，匹配成功则会返回成功信息和token2值key2给网关服务器，并且转发至移动终端，同时会将key2传送值登录服务器S2进行保存。
步骤206、移动终端接收到key2值后，根据key2将当前设备的时间t1和地点经纬度p1进行加密传送至网关服务器。
步骤207、网关服务器向认证服务器转发该请求，认证服务器收到HTTP请求后，会解密出对应的key2，与预先存的key2进行比较，key2无效则拒绝用户usr2的登录请求，返回“usr2登录失败”信息给网关服务器，并且转发至移动终端显示；key2有效，则将key2带上向登录服务器S2发送请求获取桌面连接参数。
步骤208、登录服务器S2接收到认证服务器的http请求后，比较预先存的key2是否有效，如果无效，则返回“获取桌面连接参数失败”的消息给认证服务器S1，同时认证服务器S1将该消息传送给网关服务器，网管服务器转发至移动终端进行显示。若认证成功，则将字符串信息传送给认证服务器S1，比如字符串：--192.168.11.11 1022 key2。
步骤209、认证服务器S1收到登录服务器S2传过来的登录字符串后，将字符串--192.168.11.11 1022 key2和预存的时间t1，地点p1，以及key2生成二维码页面，并将该页面返回给网关服务器，并且转发至移动终端进行显示。
步骤210、移动终端接收用户长按住二维码页面进行扫面展示的二维码的指令，提取出连接桌面的字符串--192.168.11.11 1022 key2，时间t2，地点p2，将t2、t1和p2、p1进行比较，若时间差超过允许的范围或者地点超过允许的范围则提示“会话失效，请重新登录”；若时间差未超过允许的范围并且地点未超过允许的范围，则将会直接向登录服务器发起请求桌面请求。
步骤211、登录服务器接收到网关服务器转发的桌面请求后会把桌面传给移动终端进行显示。
图7为本公开实施例的一种认证服务器的示意图，如图7所示，本实施例的认证服务器包括：
验证模块，被配置为接收到终端发送的用户登录请求消息后，对用户信息进行验证；
获取模块，被配置为在所述验证模块验证通过后，向登录服务器获取虚拟桌面连接参数；
生成模块，被配置为根据用户登录信息和所述虚拟桌面连接参数生成二维码的登录页面，将所述二维码的登录页面发送给所述终端。
可选地，本实施例的认证服务器还可以包括：存储模块，
所述验证模块，对用户信息进行验证包括：验证用户为已注册用户时，向所述终端返回具有有效期的第一令牌，并将所述第一令牌发送给所述登录服务器；接收所述终端发送的用户登录信息和第二令牌，验证所述第二令牌是否有效；
所述存储模块，被配置为在所述验证模块，验证所述第二令牌有效时存储所述用户登录信息，所述用户登录信息包括用户登录时间信息和/或用户登录地点信息。
图8为本公开实施例的终端的示意图，如图8所示，本实施例的终端包括：
启动模块，被配置为启动登录云桌面应用后，向认证服务器发送用户登录请求消息；
接收模块，被配置为接收所述认证服务器发送的二维码的登录页面。
可选地，所述启动模块，向认证服务器发送的所述用户登录请求消息携带预存的已注册的用户信息。
可选地，本实施例的终端还可以包括：加密模块，
所述接收模块，还被配置为接收所述认证服务器发送验证消息，如验证成功，则获取所述验证消息中携带的具有有效期的第一令牌；
所述加密模块，被配置为利用所述第一令牌对用户登录信息进行加密，将加密后的用户登录信息和第二令牌发送给所述认证服务器。
可选地，本实施例的终端还可以包括：
解析模块，被配置为接收到解析指令后，解析出所述二维码中的时间信息和/或地点信息；
发送模块，被配置为当解析出的所述时间信息和/或地点信息满足指定条件时，向登录服务器发送登录云桌面请求消息。
图9为本公开实施例的登录服务器的示意图，如图9所示，本实施例的登录服务器包括：
接收模块，被配置为接收认证服务器的获取虚拟桌面连接参数请求消息；
发送模块，被配置为将虚拟桌面连接参数信息发送给所述认证服务器。
可选地，本实施例的登录服务器还可以包括：
对比模块，将所述获取虚拟桌面连接参数请求消息携带的第二令牌与预存的第一令牌进行对比，如相同，再触发所述发送模块将虚拟桌面连接参数信息发送给所述认证服务器。
可选地，本实施例的登录服务器还可以包括：
推送模块，被配置为接收到终端的登录云桌面请求消息后，将虚拟桌面推送给所述终端。
本公开实施例还提供了一种非暂态计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令设置为执行上述任一实施例中的方法。
本公开实施例还提供了一种电子设备的结构示意图。参见图10，该电子设备包括：
至少一个处理器(processor)100，图11中以一个处理器100为例；和存储器(memory)101，还可以包括通信接口(Communications Interface)102和总线103。其中，处理器100、通信接口102、存储器101可以通过总线103完成相互间的通信。通信接口102可以被配置为信息传输。处理器100可以调用存储器101中的逻辑指令，以执行上述实施例的方法。
此外，上述的存储器101中的逻辑指令可以通过软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。
存储器101作为一种计算机可读存储介质，可被配置为存储软件程序、计算机可执行程序，如本公开实施例中的方法对应的程序指令/模块。处理器100通过运行存储在存储器101中的软件程序、指令以及模块，从而执行功能应用以及数据处理，即实现上述方法实施例中的云桌面认证的方法。
存储器101可包括存储程序区和存储数据区，其中，存储程序区可存储操作***、至少一个功能所需的应用程序；存储数据区可存储根据终端设备的使用所创建的数据等。此外，存储器101可以包括高速随机存取存储器，还可以 包括非易失性存储器。
本公开实施例的技术方案可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括一个或多个指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本公开实施例所述方法的全部或部分步骤。而前述的存储介质可以是非暂态存储介质，包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等多种可以存储程序代码的介质，也可以是暂态存储介质。
本领域普通技术人员可以理解上述方法中的全部或部分步骤可通过程序来指令相关硬件(例如处理器)完成，所述程序可以存储于计算机可读存储介质中，如只读存储器、磁盘或光盘等。可选地，上述实施例的全部或部分步骤也可以使用一个或多个集成电路来实现。相应地，上述实施例中的每个模块/单元可以采用硬件的形式实现，例如通过集成电路来实现其相应功能，也可以采用软件功能模块的形式实现，例如通过处理器执行存储于存储器中的程序/指令来实现其相应功能。本公开实施例不限制于任何特定形式的硬件和软件的结合。
虽然本公开实施例所揭露的实施方式如上，但所述的内容仅为便于理解本公开实施例而采用的实施方式，并非用以限定本申请。任何本申请所属领域内的技术人员，在不脱离本公开所揭露的实施例的前提下，可以在实施的形式及细节上进行任何的修改与变化，但本申请的专利保护范围，仍须以所附的权利要求书所界定的范围为准。
工业实用性
本公开实施例提供的云桌面认证的方法、服务器及终端，能够提高云终端身份认证的安全性能，极大地降低了用户信息的泄漏风险。

Claims (28)

  1. 一种云桌面认证的方法，包括：
    认证服务器响应用户登录请求对用户信息进行验证；
    验证通过后，向登录服务器获取虚拟桌面连接参数信息；
    根据用户登录信息和所述虚拟桌面连接参数信息生成二维码的登录页面。
  2. 如权利要求1所述的方法，其特征在于，
    所述认证服务器响应用户登录请求对用户信息进行验证包括：认证服务器接收到终端发送的用户登录请求消息后，对用户信息进行验证；
    生成所述二维码的登录页面后，还包括：将所述二维码的登录页面发送给所述终端。
  3. 如权利要求2所述的方法，其特征在于：所述对用户信息进行验证包括：
    验证用户为已注册用户时，向所述终端返回具有有效期的第一令牌，并将所述第一令牌发送给所述登录服务器；
    接收所述终端发送的用户登录信息和第二令牌，验证所述第二令牌有效时，存储所述用户登录信息。
  4. 如权利要求2所述的方法，其特征在于：
    所述用户登录请求消息携带所述用户登录信息。
  5. 如权利要求1至3任一项所述的方法，其特征在于：
    所述用户登录信息包括用户登录时间信息和/或用户登录地点信息。
  6. 一种认证服务器，其特征在于，包括：
    验证模块，被配置为响应用户登录请求对用户信息进行验证；
    获取模块，被配置为在所述验证模块验证通过后，向登录服务器获取虚拟桌面连接参数；
    生成模块，被配置为根据用户登录信息和所述虚拟桌面连接参数生成二维码的登录页面。
  7. 如权利要求6所述的认证服务器，其特征在于，
    所述验证模块，被配置为接收到终端发送的用户登录请求消息后，对用户信息进行验证；
    所述生成模块，还被配置为将所述二维码的登录页面发送给所述终端。
  8. 如权利要求7所述的认证服务器，其特征在于：还包括存储模块，
    所述验证模块，对用户信息进行验证包括：验证用户为已注册用户时，向所述终端返回具有有效期的第一令牌，并将所述第一令牌发送给所述登录服务器；接收所述终端发送的用户登录信息和第二令牌，验证所述第二令牌是否有效；
    所述存储模块，被配置为在所述验证模块，验证所述第二令牌有效时存储所述用户登录信息，所述用户登录信息包括用户登录时间信息和/或用户登录地点信息。
  9. 一种云桌面认证的方法，包括：
    终端根据登录云桌面应用向认证服务器发起用户登录请求；
    所述终端获取所述认证服务器的二维码的登录页面。
  10. 如权利要求9所述的方法，其特征在于，
    所述终端根据登录云桌面应用向认证服务器发起用户登录请求包括：终端启动登录云桌面应用后，向认证服务器发送用户登录请求消息；
    所述终端获取所述认证服务器的二维码的登录页面包括：所述终端接收所述认证服务器发送的二维码的登录页面。
  11. 如权利要求10所述的方法，其特征在于：
    所述用户登录请求消息携带预存的已注册的用户信息。
  12. 如权利要求10所述的方法，其特征在于：
    所述用户登录请求消息携带用户登录信息。
  13. 如权利要求10所述的方法，其特征在于：所述终端向认证服务器发送用户登录请求消息之后，还包括：
    所述终端接收所述认证服务器发送验证消息，如验证成功，则获取所述验证消息中携带的具有有效期的第一令牌；
    利用所述第一令牌对用户登录信息进行加密，将加密后的用户登录信息和第二令牌发送给所述认证服务器。
  14. 如权利要求10至13任一项所述的方法，其特征在于：所述方法还包括：
    所述终端接收到解析指令后，解析出所述二维码中的时间信息和/或地点信息；
    当所述时间信息和/或地点信息满足指定条件时，向登录服务器发送登录云桌面请求消息。
  15. 一种终端，其特征在于，包括：
    启动模块，被配置为根据登录云桌面应用向认证服务器发起用户登录请求；
    接收模块，被配置为获取所述认证服务器的二维码的登录页面。
  16. 如权利要求15所述的终端，其特征在于，
    所述启动模块，被配置为启动登录云桌面应用后，向认证服务器发送用户登录请求消息；
    所述接收模块，被配置为接收所述认证服务器发送的二维码的登录页面。
  17. 如权利要求16所述的终端，其特征在于：
    所述启动模块，向认证服务器发送的所述用户登录请求消息携带预存的已注册的用户信息。
  18. 如权利要求16所述的终端，其特征在于：还包括加密模块，
    所述接收模块，还被配置为接收所述认证服务器发送验证消息，如验证成功，则获取所述验证消息中携带的具有有效期的第一令牌；
    所述加密模块，被配置为利用所述第一令牌对用户登录信息进行加密，将加密后的用户登录信息和第二令牌发送给所述认证服务器。
  19. 如权利要求16至18任一项所述的终端，其特征在于：还包括：
    解析模块，被配置为接收到解析指令后，解析出所述二维码中的时间信息和/或地点信息；
    发送模块，被配置为当解析出的所述时间信息和/或地点信息满足指定条件 时，向登录服务器发送登录云桌面请求消息。
  20. 一种云桌面认证的方法，包括：
    登录服务器接收认证服务器的获取虚拟桌面连接参数请求消息；
    将虚拟桌面连接参数信息发送给所述认证服务器。
  21. 如权利要求20所述的方法，其特征在于：所述登录服务器将虚拟桌面连接参数信息发送给所述认证服务器之前，还包括：
    所述登录服务器将所述获取虚拟桌面连接参数请求消息携带的第二令牌与预存的第一令牌进行对比，如相同，再将虚拟桌面连接参数信息发送给所述认证服务器。
  22. 如权利要求20或21所述的方法，其特征在于：所述登录服务器将虚拟桌面连接参数信息发送给所述认证服务器之后，还包括：
    所述登录服务器接收到终端的登录云桌面请求消息后，将虚拟桌面推送给所述终端。
  23. 一种登录服务器，其特征在于，包括：
    接收模块，被配置为接收认证服务器的获取虚拟桌面连接参数请求消息；
    发送模块，被配置为将虚拟桌面连接参数信息发送给所述认证服务器。
  24. 如权利要求23所述的登录服务器，其特征在于：还包括：
    对比模块，将所述获取虚拟桌面连接参数请求消息携带的第二令牌与预存的第一令牌进行对比，如相同，再触发所述发送模块将虚拟桌面连接参数信息发送给所述认证服务器。
  25. 如权利要求24或25所述的登录服务器，其特征在于：还包括：
    推送模块，被配置为接收到终端的登录云桌面请求消息后，将虚拟桌面推送给所述终端。
  26. 一种非暂态计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令设置为执行权利要求1-5中任一项的方法。
  27. 一种非暂态计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令设置为执行权利要求9-14中任一项的方法。
  28. 一种非暂态计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令设置为执行权利要求20-22中任一项的方法。
PCT/CN2017/080697 2016-04-29 2017-04-17 一种云桌面认证的方法、服务器及终端 WO2017186005A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610283279.8 2016-04-29
CN201610283279.8A CN107332808B (zh) 2016-04-29 2016-04-29 一种云桌面认证的方法、服务器及终端

Publications (1)

Publication Number Publication Date
WO2017186005A1 true WO2017186005A1 (zh) 2017-11-02

Family

ID=60160723

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/080697 WO2017186005A1 (zh) 2016-04-29 2017-04-17 一种云桌面认证的方法、服务器及终端

Country Status (2)

Country Link
CN (1) CN107332808B (zh)
WO (1) WO2017186005A1 (zh)

Cited By (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108632387A (zh) * 2018-05-15 2018-10-09 网易（杭州）网络有限公司 生成游戏预约消息的方法、装置和终端
CN109783357A (zh) * 2018-12-14 2019-05-21 深圳壹账通智能科技有限公司 测试应用程序的方法及装置、计算机设备、存储介质
CN111310140A (zh) * 2020-02-05 2020-06-19 Tcl移动通信科技（宁波）有限公司 应用登录鉴权方法、电子设备、移动终端和存储介质
CN111460423A (zh) * 2020-03-03 2020-07-28 深圳市思迪信息技术股份有限公司 一种二维码扫描登录的方法及装置
CN113094438A (zh) * 2021-04-19 2021-07-09 沈阳展威电力科技有限公司 基于二维码图像识别技术的内外网数据隔离及传输方法
CN113407448A (zh) * 2021-06-18 2021-09-17 杭州遥望网络科技有限公司 Grafana功能管控方法、装置、电子设备及介质
CN114143114A (zh) * 2022-01-12 2022-03-04 福建省海峡信息技术有限公司 一种基于智能终端的网络安全通信方法
CN114244548A (zh) * 2021-04-12 2022-03-25 无锡江南计算技术研究所 一种面向云ide的动态调度和用户认证方法
CN114567510A (zh) * 2022-03-21 2022-05-31 上海商汤智能科技有限公司 登录认证方法、装置、设备及存储介质
CN114615329A (zh) * 2022-03-08 2022-06-10 北京从云科技有限公司 一种无客户端sdp架构实现方法及***
CN114979235A (zh) * 2022-04-22 2022-08-30 福建升腾资讯有限公司 一种基于云桌面数据共享的方法及服务器
CN115278559A (zh) * 2022-07-29 2022-11-01 上海千随信息技术有限公司 基于近场通信的信息推广方法、装置、***及存储介质
CN117215710A (zh) * 2023-11-07 2023-12-12 江西联创精密机电有限公司 云桌面训练席位控制方法、装置、存储介质及电子设备
CN117579674A (zh) * 2024-01-17 2024-02-20 之江实验室 一种远程控制***及方法

Families Citing this family (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107911363A (zh) * 2017-11-14 2018-04-13 福建中金在线信息科技有限公司 用户信息保存方法、装置和服务器
CN109873805B (zh) * 2019-01-02 2021-06-25 平安科技（深圳）有限公司 基于云安全的云桌面登陆方法、装置、设备和存储介质
CN110191158A (zh) * 2019-05-09 2019-08-30 厦门网宿有限公司 一种云桌面服务实现方法和***
CN110532752A (zh) * 2019-09-03 2019-12-03 山东超越数控电子股份有限公司 一种登录云桌面***的方法、设备及可读介质
CN111193776B (zh) * 2019-12-11 2022-02-25 福建升腾资讯有限公司 云桌面环境下客户端自动登录方法、装置、设备和介质
CN111585745A (zh) * 2020-07-07 2020-08-25 珠海雷特科技股份有限公司 一种智能家居控制面板入网的方法及智能家居***
CN114091002A (zh) * 2020-08-24 2022-02-25 中兴通讯股份有限公司 云桌面访问认证方法、电子设备和计算机可读存储介质
CN114385052B (zh) * 2020-10-19 2023-10-20 聚好看科技股份有限公司 一种Tab栏的动态展示方法及三维显示设备
CN112291269B (zh) * 2020-11-30 2023-03-03 南方电网科学研究院有限责任公司 一种云桌面认证方法、装置、电子设备和可读存储介质
CN112748831A (zh) * 2020-12-23 2021-05-04 湖南麒麟信安科技股份有限公司 一种通过桌面快捷方式打开虚拟应用的方法、装置及介质
CN112948800B (zh) * 2021-02-26 2024-04-12 北京北大千方科技有限公司 一种二维码登录信号机管理平台方法、装置、设备及介质
CN113010822A (zh) * 2021-04-21 2021-06-22 上海交通大学 信息处理方法、服务器以及电子设备
CN113709113A (zh) * 2021-08-03 2021-11-26 中国大唐集团科学技术研究总院有限公司 一种基于三端分离设计的云桌面的安全可信认证方法
CN117676772A (zh) * 2022-08-29 2024-03-08 中兴通讯股份有限公司 云桌面接入方法、电子设备、计算机可读介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130347071A1 (en) * 2011-03-10 2013-12-26 Orange Method and system for granting access to a secured website
CN104618402A (zh) * 2015-03-10 2015-05-13 四川省宁潮科技有限公司 基于带外认证的虚拟桌面云连接方法
CN105162774A (zh) * 2015-08-05 2015-12-16 深圳市方迪科技股份有限公司 虚拟机登陆方法、用于终端的虚拟机登陆方法及装置
CN105162775A (zh) * 2015-08-05 2015-12-16 深圳市方迪科技股份有限公司 虚拟机登陆方法及装置

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8812687B2 (en) * 2011-09-15 2014-08-19 Microsoft Corporation Managing user state of cloud desktops
CN103067371A (zh) * 2012-12-24 2013-04-24 广州杰赛科技股份有限公司 云终端身份认证方法和***

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130347071A1 (en) * 2011-03-10 2013-12-26 Orange Method and system for granting access to a secured website
CN104618402A (zh) * 2015-03-10 2015-05-13 四川省宁潮科技有限公司 基于带外认证的虚拟桌面云连接方法
CN105162774A (zh) * 2015-08-05 2015-12-16 深圳市方迪科技股份有限公司 虚拟机登陆方法、用于终端的虚拟机登陆方法及装置
CN105162775A (zh) * 2015-08-05 2015-12-16 深圳市方迪科技股份有限公司 虚拟机登陆方法及装置

Cited By (20)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108632387B (zh) * 2018-05-15 2021-11-23 网易（杭州）网络有限公司 生成游戏预约消息的方法、装置和终端
CN108632387A (zh) * 2018-05-15 2018-10-09 网易（杭州）网络有限公司 生成游戏预约消息的方法、装置和终端
CN109783357A (zh) * 2018-12-14 2019-05-21 深圳壹账通智能科技有限公司 测试应用程序的方法及装置、计算机设备、存储介质
CN111310140A (zh) * 2020-02-05 2020-06-19 Tcl移动通信科技（宁波）有限公司 应用登录鉴权方法、电子设备、移动终端和存储介质
CN111460423A (zh) * 2020-03-03 2020-07-28 深圳市思迪信息技术股份有限公司 一种二维码扫描登录的方法及装置
CN114244548B (zh) * 2021-04-12 2023-10-13 无锡江南计算技术研究所 一种面向云ide的动态调度和用户认证方法
CN114244548A (zh) * 2021-04-12 2022-03-25 无锡江南计算技术研究所 一种面向云ide的动态调度和用户认证方法
CN113094438A (zh) * 2021-04-19 2021-07-09 沈阳展威电力科技有限公司 基于二维码图像识别技术的内外网数据隔离及传输方法
CN113094438B (zh) * 2021-04-19 2023-10-27 沈阳展威电力科技有限公司 基于二维码图像识别技术的内外网数据隔离及传输方法
CN113407448A (zh) * 2021-06-18 2021-09-17 杭州遥望网络科技有限公司 Grafana功能管控方法、装置、电子设备及介质
CN114143114A (zh) * 2022-01-12 2022-03-04 福建省海峡信息技术有限公司 一种基于智能终端的网络安全通信方法
CN114615329A (zh) * 2022-03-08 2022-06-10 北京从云科技有限公司 一种无客户端sdp架构实现方法及***
CN114567510A (zh) * 2022-03-21 2022-05-31 上海商汤智能科技有限公司 登录认证方法、装置、设备及存储介质
CN114979235A (zh) * 2022-04-22 2022-08-30 福建升腾资讯有限公司 一种基于云桌面数据共享的方法及服务器
CN114979235B (zh) * 2022-04-22 2024-01-30 福建升腾资讯有限公司 一种基于云桌面数据共享的方法及服务器
CN115278559A (zh) * 2022-07-29 2022-11-01 上海千随信息技术有限公司 基于近场通信的信息推广方法、装置、***及存储介质
CN117215710A (zh) * 2023-11-07 2023-12-12 江西联创精密机电有限公司 云桌面训练席位控制方法、装置、存储介质及电子设备
CN117215710B (zh) * 2023-11-07 2024-01-26 江西联创精密机电有限公司 云桌面训练席位控制方法、装置、存储介质及电子设备
CN117579674A (zh) * 2024-01-17 2024-02-20 之江实验室 一种远程控制***及方法
CN117579674B (zh) * 2024-01-17 2024-03-15 之江实验室 一种远程控制***及方法

Also Published As

Publication number Publication date
CN107332808B (zh) 2021-06-29
CN107332808A (zh) 2017-11-07

Similar Documents

Publication Publication Date Title
WO2017186005A1 (zh) 一种云桌面认证的方法、服务器及终端
US11323441B2 (en) System and method for proxying federated authentication protocols
CN108092776B (zh) 一种基于身份认证服务器和身份认证令牌的***
US10530582B2 (en) Method and device for information system access authentication
CN110582768B (zh) 用于提供安全数据库访问的装置和方法
US9979719B2 (en) System and method for converting one-time passcodes to app-based authentication
US20180332019A1 (en) Password-less authentication system and method
US11539690B2 (en) Authentication system, authentication method, and application providing method
US20170244555A1 (en) Active authentication session transfer
TW201706900A (zh) 終端的認證處理、認證方法及裝置、系統
WO2020140407A1 (zh) 基于云安全的云桌面登陆方法、装置、设备和存储介质
KR102137122B1 (ko) 보안 체크 방법, 장치, 단말기 및 서버
US20150039884A1 (en) Secure Configuration of Authentication Servers
CN106230594B (zh) 一种基于动态口令进行用户认证的方法
US8732460B2 (en) System and method for providing a one-time key for identification
JP5489775B2 (ja) 秘密鍵共有システム、方法、データ処理装置、管理サーバ、及びプログラム
CN104580256A (zh) 通过用户设备登录和验证用户身份的方法及设备
CN111327629B (zh) 身份验证方法、客户端和服务端
WO2014048769A1 (en) Single sign-on method, proxy server and system
CN106796630A (zh) 用户认证
CN113852681B (zh) 一种网关认证方法、装置及安全网关设备
US12041173B2 (en) Whitelisting clients accessing resources via a secure web gateway with time-based one time passwords for authentication
CN108809927B (zh) 身份认证方法及装置
KR101651607B1 (ko) 익명 아이디를 사용하는 원클릭 사용자 인증 방법 및 시스템
US20220417020A1 (en) Information processing device, information processing method, and non-transitory computer readable storage medium

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17788657

Country of ref document: EP

Kind code of ref document: A1

122 Ep: pct application non-entry in european phase

Ref document number: 17788657

Country of ref document: EP

Kind code of ref document: A1