KR102389714B1 - SSO authentication and API service system and method using authentication token API and shared database - Google Patents

Abstract

The present invention relates to a single sign-on (SSO) authentication and API service system and method using an authentication token API and a shared database. Checking whether there is a login request from the terminal to the second application program, and when there is a login request from the user terminal to the second application program, requesting generation of an authentication token from the authentication database server from the first application program; , generating an authentication token in the authentication database server and transmitting it to the first application program; Single sign-on (SSO) from the first application program to the second application program using the site URL together with the authentication token received from the authentication database server Requesting authentication, receiving a single sign-on (SSO) authentication request of a first application program in a second application program, confirming an authentication token in a second application program, and a first in a second application program requesting verification of the authentication token from the application program; requesting verification of the authentication token from the authentication database server in the first application program; and verifying the authentication token in the authentication database server and transmitting the result to the first application program And, transmitting the authentication token verification result from the first application program to the second application program, and allowing single sign-on (SSO) login of the user terminal in the second application program using the verification result transmitted from the first application program This is done including the step of accepting or rejecting.

Description

SSO authentication and API service system and method using authentication token API and shared database}

The present invention relates to a single sign-on (hereinafter abbreviated as 'SSO') authentication and API service system and method using an authentication token API (Application Programming Interface) and a shared database, and more Specifically, when logging in from the first application program to the second application program, single sign-on (SSO) authentication is possible using the authentication token API of the system server related to the first application program, and When one application program wants to use API data for the second application program, it enables single sign-on (SSO) authentication using the authentication token of the shared database server. It relates to a single sign-on (SSO) authentication and API service system and method using an authentication token API and a shared database that does not require installation.

Single sign-on (SSO) is a system that allows you to use multiple sites with one ID. This method was developed in response to the need for integrated management of individual members by large corporations or Internet-related companies operating multiple sites. IBM developed it in 1997 and Korea.com first introduced it in Korea in 2000. After that, Samsung Electronics and SK were introduced and activated, and various sites such as Anypass, OK Cashback, Lotte Town, and solution providers such as Netigritity and Dow Technology were established.

In the case of individuals, the inconvenience of having to record personal information such as name and phone number as well as ID and password to access the site is completed with one operation, and the company provides integrated management of members. This has the advantage of maximizing marketing. In particular, when used together with an EAM, it can be used as an integrated authentication system with both security and efficiency, so it is expected to become more popular in the future.

However, the conventional single sign-on (SSO) has the inconvenience of having to install a separate single sign-on (SSO) module.

On the other hand, API is a language or message format used for communication between the operating system and application programs, and public data portals, securities companies, online large bookstores Aladdin, KakaoTalk, etc. is provided to users, and users can use APIs to bring data from public data portals, securities companies, large online bookstores Aladdin, KakaoTalk, etc. Therefore, application programs can exchange data with each other using API.

API authentication methods include API authentication token method, API key method, TLS method, and the like.

In the API authentication token method, an API provider authenticates an API user through a user ID and password, and provides an authentication token with an expiration date to the authenticated API user. method of issuance.

An authentication token is a two-factor authentication method that uses a personal identification number (PIN) and a token device (hardware or software). In terms of hardware, there is a smart card with a programmed password, and in terms of software, if a PIN is entered, the Generate an authentication password with the software. Two-factor authentication is more secure and stronger than single-password authentication. In token authentication, there are an asynchronous method in which the server sends a challenge message to the token device to match the password, and a synchronous authentication method in which the server and the token device process the challenge message at the same time.

For reference, providing a one-time authentication token generation information and a general API authentication token to a user device, and generating the one-time API authentication token as an API is called from the user device Two apis ( API) API authentication method using authentication token "API authentication device and method using two API tokens" of Korean Patent Publication No. 10-2017-0067527 (published on June 16, 2017) has been disclosed in

However, the above publication No. 10-2017-0067527 has a problem in that it is not easy to apply to single sign-on (SSO) authentication.

Laid-Open Patent Publication No. 10-2017-0067527

An object of the present invention is to solve the problems of the related art as described above, and when a user wants to log in from a first application program to a second application program, the authentication token API of the system server related to the first application program is Single sign-on (SSO) authentication using authentication token API (API) and shared database that does not require the installation of a separate single sign-on (SSO) module by enabling single sign-on (SSO) authentication using (API) to provide a service system and method.

Another object of the present invention is to enable single sign-on (SSO) authentication using an authentication token of a shared database server when a first application program wants to use API data for a second application program. An object of the present invention is to provide a single sign-on (SSO) authentication and API service system and method using an authentication token API (API) and a shared database that does not require installation of a single sign-on (SSO) module.

As a means for achieving the above object, the configuration of the method of the present invention includes the steps of: checking whether there is a login request from the user terminal to the second application program in the first application program; When there is a login request, the first application program requests the authentication database server to generate an authentication token, the authentication database server generates an authentication token and transmits it to the first application program, and the authentication received from the authentication database server A step of requesting single sign-on (SSO) authentication from a first application program to a second application program using a site URL (Uniform Source Locator) together with a token, and single sign-on (SSO) of the first application program from the second application program Receiving an authentication request, confirming an authentication token in a second application program, requesting verification of an authentication token from a second application program to a first application program, and authentication from the first application program to the authentication database server requesting token verification; verifying the authentication token in the authentication database server and transmitting the result to the first application program; transmitting the authentication token verification result from the first application program to the second application program; It is preferable to include the step of allowing or rejecting single sign-on (SSO) login of the user terminal in the second application program using the verification result transmitted from the first application program.

The configuration of the method of the present invention includes the steps of checking whether there is an API service request for a second application program from a user terminal in a first application program, and an API service request for a second application program from the user terminal. If there is, the step of requesting generation of an authentication token from the shared database server in the first application program, the steps of generating an authentication token in the shared database server and transmitting it to the first application program, and the authentication token transmitted from the shared database server Using the first application program to request an API service to a second application program, the second application program to receive an API service request from the first application program; Checking the authentication token in the program, requesting the authentication token verification from the shared database server in the second application program, verifying the authentication token in the shared database server, and transmitting the result to the second application program; A step of providing or rejecting API data in the second application program according to the authentication token verification result, and the API data provided by the second application program in the first application program ) It is preferable to further include the step of processing the service.

In the configuration of the method of the present invention, the first application program is any one of a personnel management program and a production management program, and the second application program is any one of the personnel management program and the production management program that is different from the first application program desirable.

The configuration of the method of the present invention includes the steps of, when API data is returned by the second application program, the first application program acquires data using web crawling from a website of the same type as the second application program It is preferable if it is made to further include.

The configuration of the system of the present invention includes a first system server that performs the above method and is connected to a network and provides a first application program, an authentication database server connected to the first system server, and the authentication database server An authentication database connected to and having an authentication token table for single sign-on (SSO) authentication, a second system server connected to a network and providing a second application program, a shared database server connected to the network; It is preferable to include a shared database connected to the shared database server and having an authentication token table for API services, and a user terminal connected to a network through a first application program and a second application program.

In the configuration of the system of the present invention, the shared database is duplicated, and when one database is in active service, the other database is in the standby state. It is desirable if is automatically activated.

The present invention enables single sign-on (SSO) authentication by using the authentication token API of the system server related to the first application program when logging in from the first application program to the second application program, Separate single sign-on (SSO) module by enabling single sign-on (SSO) authentication using the authentication token of the shared database server when the first application program wants to use API data for the second application program It does not require the installation of, and has the effect.

1 is a block diagram of a single sign-on (SSO) authentication and API service system using an authentication token API and a shared database according to an embodiment of the present invention.
2 is a flowchart of a single sign-on (SSO) authentication and API service method using an authentication token API and a shared database according to an embodiment of the present invention.

Hereinafter, a preferred embodiment of the present invention will be described in detail with reference to the accompanying drawings in order to describe in detail enough that a person of ordinary skill in the art can easily carry out this invention. Other objects, features, and operational advantages, including the object, action, effect, and other objects of this invention will become clearer by the description of the preferred embodiment.

For reference, the embodiments disclosed herein are only presented by selecting and presenting the most preferred embodiments in order to help those skilled in the art understand from among various possible examples, and the technical spirit of the present invention is not necessarily limited or limited only by the presented embodiments. No, various changes, additions, and modifications including equivalents or substitutes are possible without departing from the technical spirit of the present invention.

In addition, the terms or expressions used in the specification and claims of the present application are defined based on the principle that the inventor can appropriately define the concept of the term in order to best describe his invention. , should not be construed as being limited only to the ordinary or dictionary meaning, but should be interpreted as meaning and concept consistent with the technical idea of this invention. As an example, the singular expression includes a plural expression unless the context clearly indicates otherwise, and the expression regarding the direction is set based on the position expressed on the drawing for convenience of description, and is "connected" or "connected" The expression "to be" includes not only a direct connection or connection, but also a connection or connection through another element in the middle.

1 is a block diagram of a single sign-on (SSO) authentication and API service system using an authentication token API and a shared database according to an embodiment of the present invention.

As shown in FIG. 1, the configuration of the single sign-on (SSO) authentication and API service system using an authentication token API and a shared database according to an embodiment of the present invention is a network 10 ) and a first system server 20 that provides a first application program 51, an authentication database server 21 connected to the first system server 20, and the authentication database server 21 ) and an authentication database 22 having an authentication token table for single sign-on (SSO) authentication, and a second system server 30 connected to the network 10 and providing a second application program 52 ), the shared database server 40 connected to the network 10, the shared database 41 connected to the shared database server 40 and having an authentication token table for API services, and the first The user terminal 50 is connected to the network 10 through the application program 51 and the second application program 52 .

The network 10 is based on the Internet, and in addition to WAN (Wide Area Network), LAN (Local Area Network), Wi-Fi, Bluetooth, 3G, 4G, 5G Long Term Evolution (LTE), etc. may include

The shared database 41 is duplicated, so that if one database is in active service, the other database is in the standby state. is made up of a structure that becomes

The first application program 51 is any one of a personnel management program and a production management program, and the second application program 52 is any one different from the first application program among the personnel management program and the production management program.

The first system server 2 and the second system server 30 may be provided within one company or may be provided by different companies.

The user terminal 50) is connected to at least one, and is composed of a computer, a smart phone, a Portable Multimedia Player (PMP), a Personal Digital Assistants (PDA), and other electronic devices that can be connected to the network through a wireless or wired network.

2 is a flowchart of a single sign-on (SSO) authentication and API service method using an authentication token API and a shared database according to an embodiment of the present invention.

As shown in FIG. 2, the single sign-on (SSO) authentication and API service method using an authentication token API and a shared database according to an embodiment of the present invention, the user in the first application program Step (S10) of confirming whether there is a login request from the terminal to the second application program, and when there is a login request from the user terminal to the second application program, the first application program requests the authentication database server to generate an authentication token (S20), generating an authentication token from the authentication database server and transmitting it to the first application program (S30), and using the site URL (UNIFORM Source Locator) together with the authentication token received from the authentication database server The step of requesting single sign-on (SSO) authentication from the first application program to the second application program (S40), and the step of receiving the single sign-on (SSO) authentication request of the first application program from the second application program (S50); Confirming the authentication token in the second application program (S60), requesting the authentication token verification from the first application program in the second application program (S70), and verifying the authentication token from the authentication database server in the first application program requesting (S80), verifying the authentication token in the authentication database server and transmitting the result to the first application program (S90), and transmitting the authentication token verification result from the first application program to the second application program step (S100), allowing or rejecting single sign-on (SSO) login of the user terminal in the second application program using the verification result transmitted from the first application program (S110), and the user in the first application program Checking whether there is an API service request for the second application program from the terminal (S120), and the second application program from the user terminal (S120) 2 When there is an API service request for the application program, the step of requesting generation of an authentication token from the shared database server in the first application program (S130), and generating an authentication token from the shared database server and transmitting it to the first application program Step (S140), the first application program requesting an API service to the second application program using the authentication token transmitted from the shared database server (S150), and the first application in the second application program Steps of receiving the API service request of the program (S160), checking the authentication token in the second application program (S170), and requesting the authentication token verification from the shared database server in the second application program (S180), the step of verifying the authentication token in the shared database server and transmitting the result to the second application program (S190), and according to the authentication token verification result, the second application program provides API data or The step of rejecting (S200) and the step of processing the API (API) service in the first application program using the API data provided by the second application program (S210) are included.

The first application program is any one of a personnel management program and a production management program, and the second application program is any one different from the first application program among the personnel management program and the production management program.

If the second application program rejects API data, the first application program may further include the step of obtaining data by web crawling from a website of the same type as the second application program. it was

The operation of the single sign-on (SSO) authentication and API service system and method using an authentication token API and a shared database according to an embodiment of the present invention by the above configuration is as follows.

After the user terminal 50 connects to the first application program 51 provided by the first system server 20 through the network 10 , while working using the first application program 51 , the first When it is desired to access the second application program 52 linked to the application program 51 , a login request is made to the second application program 52 .

The first application program 51 is, for example, a personnel management program, the second application program 52 is, for example, a production management program, and the first application program 51 is the first system server 20 . , and the second application program 52 is provided by the second system server 30 .

The first application program 51 checks whether there is a login request from the user terminal 50 to the second application program 52 (S10), and logs in from the user terminal 50 to the second application program 52 (S10). When there is a request, the first application program 51 requests the authentication database server 21 to generate an authentication token (S20).

When there is a request for generating an authentication token from the first application program 51, the authentication database server 21 generates an authentication token from the authentication token table of the authentication database 22 and transmits it to the first application program 51 ( S30).

The first application program 51 requests single sign-on (SSO) authentication to the second application program 52 by using the site URL (Uniform Source Locator) together with the authentication token transmitted from the authentication database server 21 (S40). ).

The second application program 52 checks the authentication token received from the first application program 51 after receiving the single sign-on (SSO) authentication request of the first application program 51 (S50) (S60).

Next, the second application program 52 requests the first application program 51 to verify the authentication token (S70).

When the authentication token verification request from the second application program 52 is received, the first application program 51 requests the authentication database server 21 to verify the authentication token (S80).

When the authentication token verification request from the first application program 51 is received, the authentication database server 21 verifies the authentication token from the authentication token table of the authentication database 22 and returns the result to the first application program 51 . to (S90).

When the authentication token verification result is received from the authentication database server 21, the first application program 51 transmits the authentication token verification result to the second application program 52 (S100).

The second application program 52 permits or rejects the login of the user terminal 50 using the authentication token verification result transmitted from the first application program 51 (S110).

When the login of the user terminal 50 is permitted in the second application program 52 , the user terminal 50 does not go through a new registration or login procedure from the first application program 51 to the second application program 52 . It is possible to perform single sign-on (SSO) authentication by logging in to the second application program without any need.

On the other hand, when the user terminal 50 desires to use API data provided by the second application program 52 while working using the first application program 51 , yes For example, when working in the personnel management program and needing API production management data provided by the production management program, API service requests are made.

The first application program 51 checks whether there is an API service request for the second application program from the user terminal 50 (S120), When there is a request for an API service, the first application program 51 requests the shared database server 40 to generate an authentication token (S130).

When there is a request for generating an authentication token from the first application program 51, the shared database server 40 generates an authentication token from the authentication token table of the shared database 41 and transmits it to the first application program 51 ( S140).

The first application program 51 requests an API service to the second application program 52 using a UNIFORM Resource Locator (URL) together with the authentication token transmitted from the shared database server 40 (S150). ).

After receiving the API service request of the first application program 51 ( S160 ), the second application program 52 checks the authentication token received from the first application program 51 ( S170 ).

Next, the second application program 52 directly requests the authentication token verification to the shared database server 40 (S180).

When the authentication token verification request from the second application program 52 is received, the shared database server 40 verifies the authentication token from the authentication token table of the shared database 41 and sends the result to the second application program 52 transmit (S190).

The second application program 52 provides or rejects API data to the first application program 51 according to the verification result of the authentication token received from the first application program 51 ( S200 ).

When API data is provided from the second application program 51, the first application program 51 can process the API service by using the data (S210).

If the second application program rejects API data, the first application program may acquire data from a website of the same type as the second application program by web crawling.

10: network 20: first system server
21: authentication database server 22: authentication database
30: second system server 40: shared database server
41: shared database 50: user terminal
51: first application program 52: second application program

Claims (6)

delete Checking whether there is a login request from the user terminal to the second application program in the first application program;
When there is a login request from the user terminal to the second application program, the step of requesting to generate an authentication token from the authentication database server in the first application program;
Generating an authentication token in the authentication database server and transmitting it to the first application program;
requesting single sign-on (SSO) authentication from a first application program to a second application program using a site URL (Uniform Source Locator) together with an authentication token transmitted from an authentication database server;
Receiving a single sign-on (SSO) authentication request of the first application program in the second application program;
Checking the authentication token in the second application program;
requesting verification token verification from the first application program in the second application program;
A step of requesting authentication token verification from the authentication database server in the first application program;
Verifying the authentication token in the authentication database server and transmitting the result to the first application program;
transmitting the authentication token verification result from the first application program to the second application program;
Comprising the step of allowing or rejecting single sign-on (SSO) login of the user terminal in a second application program using the verification result transmitted from the first application program,
Checking whether there is an API service request for a second application program from the user terminal in the first application program;
When there is an API service request for the second application program from the user terminal, requesting the generation of an authentication token from the first application program to the shared database server;
Generating an authentication token in the shared database server and transmitting it to the first application program;
A first application program requesting an API service to a second application program using the authentication token received from the shared database server;
Receiving the API service request of the first application program in the second application program;
Checking the authentication token in the second application program;
Requesting authentication token verification from the shared database server in the second application program;
Verifying the authentication token in the shared database server and transmitting the result to a second application program;
providing or rejecting API data in the second application program according to the authentication token verification result;
An authentication token API and a shared database comprising the step of processing an API service in a first application program using API data provided by a second application program Single sign-on (SSO) authentication and API service method using. 3. The method of claim 2,
The first application program is any one of a personnel management program, a production management program,
The second application program is a single sign-on (SSO) authentication using an authentication token API (API) and a shared database, characterized in that it is different from the first application program among the personnel management program and the production management program. API) service method. 3. The method of claim 2,
In the case where the second application program rejects API data, the first application program further comprises the step of acquiring data by using web crawling from a website of the same type as the second application program. Single sign-on (SSO) authentication and API service method using the authentication token API and shared database. Carrying out the method of claim 2,
A first system server connected to the network and providing a first application program;
an authentication database server connected to the first system server;
an authentication database connected to the authentication database server and having an authentication token table for single sign-on (SSO) authentication;
a second system server connected to the network and providing a second application program;
a shared database server connected to the network;
A shared database connected to the shared database server and having an authentication token table for API services,
Single sign-on (SSO) authentication and API using an authentication token API and a shared database, characterized in that it includes a user terminal connected to a network through a first application program and a second application program service system. 6. The method of claim 5,
The shared database is duplicated, so that if one database is servicing in an active state, the other database is in a standby state, and when a failure occurs in the active database, the database in standby automatically becomes active. Single sign-on (SSO) authentication and API service system using the authentication token API (API) and shared database.

Images