1249931 玖、發明說明： 【發明所屬之技術領域】 本發明係關於一種以目錄伺服器之電子目錄服務為基礎之單一簽入服 務系統，特別是指一種使用者只須輸入一次帳號密碼即可進入多個資訊系 統的以目錄伺服器之電子目錄服務為基礎之單一簽入服務系統。 【先前技術】 以目前使用者在登入企業内部資訊系統與一般網際網路上的入口網站 時，都需要經過身分認證機制認證成功後才能進入到資訊系統與入口網 站’而使用者面對這麼多的資訊系統與入口網站，除了要記住登入每個資 訊系統與入口網站的帳號與密碼外，還必須需要每到一個資訊系統就需要 重複輸入帳號與密碼，實在是不方便，而目前為了要解決這問題，目前既 有的解決方案大都是將使用者帳號與密碼暫存紀錄在關連式資料庫 (Relationd Database)或本機觀(L〇calFile)，供合法與信任的資訊系統或網 站來提供SQL 或疋其他方式查詢，甚至有些是暫存在應用祠服器 (APPHCationS㈣_ Sessi〇n變數裡。但由於這些方式具有以下缺點： L都會暫存姻者的帳號與密碼蚊，對純㈣安全性來說，會 造成一定的風險與低安全性。 .偶若Server被侵入了，那使用者的相關重要資訊就被看穿了 由此可知前述方法仍有諸衫適的地方，還有改善的地方。本案 人鑑於上_方式崎生的各_，乃Μ相改_，並經 苦心麟潛心深人研究後，終於成功研發完成本件以目錄娜器之電- 錄服務為基礎之單一簽入服務系統。 【發明内容】 本發明之目的即在於提供一種以目錄伺服器之電子目錄服務為基礎之 單一簽入服務系統’係改善目前各資訊系統須個別處理使用者的登入與驗 證密碼的情況。 本發明之目的二即在於提供一種以目錄伺服器之電子目錄服務為基礎 之單一簽入服務系統’係可根據使用者的密碼長度與各資訊系統的相互配 合’來判斷是否可進入高安全性等級的資訊系統。 本發明之目的三即在於提供一簡易架構、尤其適用於以LDAP協定的 目錄伺服器之電子目錄服務做為身分認證與授權的資訊系統單一簽入的架 構。 達成上述發明目的之以目錄伺服器之電子目錄服務為基礎之單一簽入 服^務系統’係利用LDAP協定的目錄伺服器之電子目錄服務為暫時儲存媒 體，其原因是因為它具有❶單一命名(Naming)❷快速簡易的搜尋功能❸分散 式架構(Distributed)❹參考重導(referrai)等特性，可當作使用者身分認證機制 由此單一簽入服務機制產生之唯一單一簽入值(此丨―sign〇nKey)的暫 時儲存媒體，來達到單一簽入的服務。且本發明之另一功能為可根據使用 者的岔碼長度與各資訊系統的相互配合，來判斷是否可進入高安全性等級 的資訊系統。 【實施方式】 本發明係為改善傳統使用者欲登入各資訊系統，都須重複輸入使用者 1249931 帳號舆密碼以及資訊系統都須重複開發判斷使用者帳號密碼的登入網頁架 構。在以目錄伺服器之電子目錄服務為基礎之單一簽入服務系統中，使用 者只須輸入一次帳號密碼。本發明則提供一簡易，尤其適用於利用LDAp協 疋之目錄伺服态之電子目錄服務來做使用者身分帳號密碼認證的資訊系 統。 本發明適用的整體環境如圖一所示，使用者可透過單一簽入服務伺服器 與目錄伺服器之電子目錄服務來達到使用者只須輸入一次帳號與密碼，即 可遊走各資訊糸統的情境。其步驟如下所述·· •使用者1點選欲登入資訊系統或入口網站3，則單一簽入服務伺服器2 會呈現一須使用者輸入帳號密碼網頁，係使用澍覽器η連接 上單一簽入服務伺服器2。 二·經單一簽入服務伺服器2判斷使用者帳號密碼無誤後，將會把唯一單一 簽入值存入目錄伺服器並將此值重導至後端資訊系統或入口網站3。 二·後端貧訊系統或入口網站3利用簽入服務伺服器2所帶過來的唯一單一 簽入值與目錄伺服器之電子目錄服務做一查詢，如果無誤，則可進入 此資訊系統或入口網站3。 四·若使用者欲前往另一資訊系統或入口網站4，則單一簽人服務祠服器2 將、、’I由判辦得知使用者已有唯一單一簽入值，並將此值重導至使用者 4人别在的負訊系統或入口網站4。 本發明的重要核心單一簽入服務伺服器，整體細部流程示意圖如圖二 所示，其步驟如下所述： 1249931 年入）- .〇· - 一·使用者1第一次開啟www瀏覽器Η，欲前往登入資訊系統3。 一·育訊系統3的首頁31將使用者無條件重導至單一簽入服務程式5頁 面，並帶入資訊系統3的第二頁URL32,準備進行單一簽入服務。 二·由於使用者1第一次進入單一簽入服務程式5頁面，單一簽入服務程式 5呈現給使用者輸入帳號密碼網頁51。 四·待使用者1輸入正確的帳號與密碼後，單一簽入服務程式5將會至後端 目錄伺服器6之電子目錄服務判斷其使用者帳號與密碼正確性。 五.如果目錄祠服器6判斷帳號密碼正確無誤，則會回傳”，，訊息，代 表認證成功。 丨〜早-簽入服務程式5接收到目錄伺服器6回傳的”訊息，接著 會產生唯-單-簽入值，並齡在目錄祠服器6上使用者i的個人£卿 裡。 七. 早-簽入服務程式5並且將唯一單一簽入值寫入使用者w驟瀏覽器 11 的 cookie 〇 八. 早—簽人服務程式5將使用者1重導至資訊純3的第二頁32，並夾 帶唯一單一簽入值給資訊系統3的第二頁32。 九. 資訊系統3的第二頁32將收到的唯一單一簽入值，資訊系統3將利用 專屬程式至目錄飼服器6做搜尋，查看此值是否存在目錄伺服器^之 電子目錄服務上。 十.如准一單—簽入值存在目錄他器6之電子目錄服務，資訊系統3的第 二頁32將可制制者丨基本:雜，社此魏錢3就可允許使 1249931 用者且入此貝λ系統3 ’並且可加人各資訊祕所需要的流程與其他步 驟。 十-·接著，如果制者！欲前往f訊系統4。 十二.資訊祕4的首頁^也將使用者i祕件重導至單_簽人服務程式 5 〇 十二·早-簽入服務程式5可由使用者ww職器U的C感e/Sessi〇n 抓取到唯單簽入值，則代表使用者j剛剛有經由單一簽入服務程 式5成功登入過。 十四·由於使用者Cookie/Sesskm已有唯一單一簽入值，故單一簽入服務程 式5將不會出現使用者輸人帳號密碼網頁5卜而會重導至資訊系統4 的第一頁42，並夹帶由到的唯一單一簽入值給資訊 系統4的第二頁42。 十五·資訊系統4第二頁42將收到的唯一單一簽入值，去查詢是否存在目 錄飼服器6之電子目錄服務(同步驟九）。 十六·如唯一單一簽入值存在目錄伺服器6之電子目錄服務，資訊系統4的 第一頁42將得到使用者基本資料，而資訊系統4就可允許使用者登 入此資訊系統4 (同步驟十）。 本發明的另一重要重點如圖一所示，資訊系統可與單一簽入服務伺服 器與目錄飼服器6之電子目錄服務來配合，達到各資訊系統輕易的可判斷 使用者㊆、碼安全等級的魏，其概念如圖三所示，其步驟如下所述： 一、使用者1點選欲登入資訊系統3，則資訊系統3會利用^HTTP需 1249931 求多重重導單元將使用者丨重導至單人服務伺服器2，這時單‘ 一簽入服務程式會呈現讓使用者輸入帳號密碼網頁。 二、帳號密碼判斷無誤後，產生内含「具有使用者密瑪長度」屬性的唯 單一簽入值並存入目錄伺服器6，並將此唯一單一簽入值重導至 資訊系統3。 f 二、㈣系統利用簽入服務飼服器2所帶過來的「具有使用者密碼長度」 屬性唯一單一簽入值與目錄飼服器6之電子目錄服務查詢，並且與 貝訊系統本身預設的密碼等級作判斷，如果兩者都判斷無誤，則可鲁 進入此資訊系統。 本發明所提供之以目錄伺服器之電子目錄服務為基礎之單—簽入服務 系統，與其他習用技術互相比較時，更具備下列優點： 1.本發明可大幅減低各f訊系統_發維運時程，提供使用者更便利 與更友善的操作介面。 2·本發明可避免其他資訊系統重複的開發身分認證機制，更可確保使 用者且入日^女全性與便利性而提高行政效率，其競爭力與經濟雜· 更加顯著。 歹K羊、、、田說明乃針對本發明之一可行實施例進行具體說明，惟該實施 i非用以限制本發明之專利範圍，凡未脫離本發明技藝精神所為之等效 實施或變更，均應包含於本案之專職财。 、斤述本案不僅於技術思想上確屬創新，並具備習用之方法所不 述夕項功效’已充分符合新穎性及進步性之法定發明專利要件，爰 1249931 依法提出申請，懇請貴 【圖式簡單說明】 局核准本件發明專财請案以勵發明，至感德便 凊參閱以下有關本發明之詳細說明及其附圖，將可進一步瞭解本發明之 技術内容及其目的功效：有關附圖為·· 圖一為本發明以目錄飼服器之電子目錄服務為基礎之單一簽入服務架 構整體示意圖；1249931 发明, invention description: [Technical field of invention] The present invention relates to a single check-in service system based on an electronic directory service of a directory server, in particular, a user only needs to input an account password once to enter A single check-in service system based on the electronic directory service of the directory server of multiple information systems. [Prior Art] When users log in to the internal information system of the enterprise and the portal on the general Internet, they need to pass the identity authentication mechanism and successfully authenticate before they can enter the information system and the portal. In addition to remembering the account and password of each information system and portal, the information system and the portal must also need to input the account and password repeatedly for each information system. It is inconvenient, but currently it is to be solved. This problem, the current solution is mostly to record user accounts and passwords in the Relational Database or L〇calFile for legitimate and trusted information systems or websites. SQL or other methods of query, and even some are temporarily stored in the application server (APPHCationS (4) _ Sessi〇n variables. But because these methods have the following disadvantages: L will temporarily store the account of the marriage and password mosquito, for pure (four) security comes Said, it will cause certain risks and low security. Even if Server is invaded, the user is related When the information is seen, it can be seen that there are still some places where the above methods are suitable, and there are areas for improvement. In view of the _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ After the research, the single check-in service system based on the catalogue service of the catalogue was finally successfully developed. [Invention] The object of the present invention is to provide a single based on the electronic catalog service of the directory server. The check-in service system is to improve the current situation in which each information system has to handle the user's login and verification passwords individually. The second object of the present invention is to provide a single check-in service system based on the electronic directory service of the directory server. It is possible to judge whether or not the information system of the high security level can be accessed according to the interaction between the length of the user's password and the information system. The third object of the present invention is to provide a simple architecture, particularly suitable for directory protocol with LDAP protocol. The electronic directory service is a single sign-in architecture for identity authentication and authorization information systems. The single sign-in service system based on the electronic directory service of the directory server is an electronic directory service that uses the directory server of the LDAP protocol to temporarily store the media because it has a single name (Naming) and is fast. Simple search function, distributed, reference, referrai, etc., can be used as the unique single check-in value generated by the user's identity authentication mechanism and thus a single check-in service mechanism (this 丨-sign〇nKey Temporarily storing media to achieve a single check-in service. Another function of the present invention is to determine whether a high security level information system can be entered according to the user's weight length and the cooperation of various information systems. [Embodiment] The present invention is to improve the traditional user to log in to each information system, and must repeatedly input the user 1249931 account password and the information system must repeatedly develop the login webpage structure for judging the user account password. In a single sign-in service system based on the directory server's electronic directory service, the user only has to enter the account password once. The present invention provides an information system that is simple and suitable for use in an electronic directory service of a directory servo state of the LDAp protocol for user identity account password authentication. The overall environment to which the present invention is applicable is as shown in FIG. 1. The user can use the single directory service server and the directory server's electronic directory service to achieve the user's need to input the account number and password once, and then the information system can be accessed. Situation. The steps are as follows: • If the user clicks to log in to the information system or portal 3, the single sign-in service server 2 will present a user-entered account password page, which is connected to the single page using the browser n. Check in to service server 2. 2. After the single sign-in service server 2 determines that the user account password is correct, the unique single check-in value will be stored in the directory server and the value will be redirected to the back-end information system or portal 3. 2. The backend poor messaging system or portal 3 uses the unique single check-in value brought by the check-in service server 2 to make an inquiry with the directory server's electronic directory service. If it is correct, it can enter the information system or portal. Website 3. 4. If the user wants to go to another information system or portal 4, the single sign-off service server 2 will, 'I be judged that the user has a unique single check-in value, and the value is heavy Lead to the negative system or portal 4 of the user's 4 people. The important core of the present invention is a single check-in service server. The overall detailed process diagram is shown in Figure 2. The steps are as follows: 1249931 Enter)- .〇· - A User 1 opens the www browser for the first timeΗ , I want to go to the login information system 3. The first page 31 of the communication system 3 unconditionally redirects the user to a single check-in service program 5 page and brings it to the second page URL 32 of the information system 3 to prepare for a single check-in service. 2. Since the user 1 enters the single check-in service program 5 page for the first time, the single check-in service program 5 presents the user input account password page 51. 4. After the user 1 enters the correct account number and password, the single check-in service program 5 will go to the electronic directory service of the back-end directory server 6 to determine the correctness of the user account and password. 5. If the directory server 6 determines that the account password is correct, it will return ",, the message, indicating that the authentication is successful. 丨 ~ early - the check-in service program 5 receives the message sent back from the directory server 6, and then A unique-single-check-in value is generated and is aged in the user's personal account on the directory server 6. 7. Early-check in the service program 5 and write the unique single check-in value to the user's browser 11 cookie. 八. The early-signer service program 5 redirects user 1 to the second of the information pure 3 Page 32, and entraps a unique single check-in value to the second page 32 of the information system 3. The second page 32 of the information system 3 will receive the unique single check-in value, and the information system 3 will use the proprietary program to search the directory feeder 6 to see if the value exists on the electronic directory service of the directory server. . X. If the order is the same - the value of the check-in exists in the electronic catalogue service of the catalogue. The second page 32 of the information system 3 will be able to make the basics: the miscellaneous, the social Wei 3 can allow 1249931 users. And enter this λ system 3 ' and can add the process and other steps required by each information secret. Ten--then, if the maker! Want to go to the f system 4. 12. The first page of the information secret 4 ^ also redirects the user i secret to the single_signer service program 5 〇 twelve early - check in the service program 5 can be used by the user ww server U C feel e / Sessi 〇n Grab the only check-in value, which means that user j has just successfully logged in via a single check-in service program 5. 14. Since the user cookie/Sesskm has a unique single check-in value, the single check-in service program 5 will not appear on the user's account password page 5 and will be redirected to the first page of the information system 4 42 And entraining the unique single check-in value to the second page 42 of the information system 4. The second single page 42 of the information system 4 will receive the unique single check-in value to check whether there is an electronic directory service of the directory feeder 6 (same step 9). 16. If the only single check-in value exists in the electronic directory service of the directory server 6, the first page 42 of the information system 4 will get the user basic information, and the information system 4 can allow the user to log in to the information system 4 (the same Step ten). Another important point of the present invention is shown in Figure 1. The information system can be matched with the electronic directory service of the single check-in service server and the directory feeder 6 to achieve easy identification of users and code security. The level of Wei, its concept is shown in Figure 3, the steps are as follows: First, the user chooses to log in to the information system 3, the information system 3 will use the ^HTTP needs 1249931 to find the multi-redirect unit to the user丨Redirected to the single-player server 2, then the single-check-in service program will present the user with the account password page. 2. After the account password is judged correctly, a single check-in value containing the attribute "with user mil length" is generated and stored in the directory server 6, and the unique single check-in value is redirected to the information system 3. f. (4) The system uses the “user password length” attribute brought by the check-in service feeder 2 to uniquely check the value and the electronic directory service query of the directory feeder 6 and preset with the Beixun system itself. The password level is used for judgment. If both are judged correctly, then Rulu enters the information system. The single-check-in service system based on the electronic directory service of the directory server provided by the invention has the following advantages when compared with other conventional technologies: 1. The invention can greatly reduce each of the f-systems Time-honored, providing users with a more convenient and more friendly interface. 2. The invention can avoid the repeated development of the identity authentication mechanism of other information systems, and can ensure the administrative efficiency of the users and the fullness and convenience of the Japanese, and the competitiveness and economics are more prominent. The description of the present invention is not intended to limit the scope of the invention, and is not intended to limit the scope of the invention. All should be included in the full-time financial resources of this case. This case is not only innovative in terms of technical thinking, but also has the method of using the method of the past. It has fully complied with the statutory invention patent requirements of novelty and progress. 爰1249931 Brief Description: The Office approves the invention of the invention and seeks to invent the invention. The following is a detailed description of the present invention and its accompanying drawings. The technical contents of the present invention and its effects can be further understood. Figure 1 is a schematic diagram of a single check-in service architecture based on the electronic catalog service of the catalogue feeder;
圖二為本單一簽入服務整體細部流程示意圖； I 圖二為該單〆簽入服矛务與各資訊系統依據密石馬長度，判斷是否可進入 此資訊系統的實際運作流程示意圖。 【主要部分代表符號】 1使用者 2單·^簽入服務伺服器 3資訊系統 4資訊系統 5單，簽入服務程式 _ 6目錄祠服器 11㈣W瀏覽器 31資訊系統3的首頁 32資訊系統3的第二頁URL 42資訊糸統*的第一頁 41資訊系統4的首頁 1249931 51輸入帳號密碼網頁Figure 2 is a schematic diagram of the overall detailed process of the single sign-in service. I Figure 2 is a schematic diagram of the actual operation process of the information system based on the length of the stone and the length of the information system. [Main part representative symbol] 1 user 2 single · ^ check-in service server 3 information system 4 information system 5 single, check-in service program _ 6 directory server 11 (four) W browser 31 information system 3 home page 32 information system 3 The second page of the URL 42 information system * the first page 41 information system 4 home page 1249931 51 enter the account password page
1212