Patent Application
20130185781
1. Technical Field
The present disclosure relates to computer technologies and, particularly, to a method and a device for realizing remote login.
2. Description of Related Art
Remote application publication belongs to application virtualization technology, which separates the human-machine interactive logic (application interfaces, operations of keyboard and mouse, audio inputs and outputs, card readers, and printouts) from computational logic; when users access one application with the server thereof being virtualized, the user end only needs to send the remote desktop protocol to the server end via RDP/ICA (Remote Desktop Protocol/ Independent computing Architecture) to the server end. The server end thereafter creates independent conversation space for the user in which the computation logic of the application program is executed to send the changed human-machine interactive logic to devices of the user end. The changed human-machine interactive logic can be displayed in the corresponding display of the user end, allowing the user to feel like accessing the local application program.
As the internal applications in the company increases, hundreds of business systems are used within a large-scale company. Thus, the same employee in the company may use dozens of, even hundreds of accounts and passwords, which brings forward standard authentication plans of the different kinds of business systems. Among the standard authentication methods, single sign-on (SSO) and user bind are the two most commonly used kinds of authentication methods.
In the traditional SSO authentication, after the user logs in and is centrally authenticated, the control in the client is used to simulate the user input or the server end is used for inserting authentication data flow which can simulate the user input when the user is accessing other applications, which saves the user the trouble of inputting the user name and the password again when accessing the other applications. Another traditional SSO authentication replaces the manual input by plug-ins in the client after the information of the application program is recorded. In this type of SSO authentication, a central authentication issued server is required and the plug-ins are installed in the client. However, after using the remote application, there is no authentication issued server and there are various clients, making it impossible to add plug-ins which can be initiated as the application program is started in the client or terminal sever to simulate the user input. The traditional user bind authentication logs in to and gets access to the business systems by analyzing the data flow of the client on aspect of the data flow of the client. Since the traditional SSO authentication and the traditional user bind authentication cannot analyze the data flow in the terminal server, therefore, remote login cannot be finished by using the SSO authentication and the user bind authentication on the aspect of data flow of the terminal server.
The present disclosure provides a method for realizing remote login which can realize the remote login on the aspect of data flow by matching and analyzing the data flow in the terminal server.
The method for realizing remote login includes:
step 01, a terminal server responding to a login request to an internal system from an end user, and recording and saving login information of the end user for logging in to the internal system; and
step 02, the terminal server judging and analyzing the way the end user logs in to the internal system according to the recorded and saved login information and according to pre-configured rule, and allowing the end user to log in to and access the internal system if the analyzed result matches the pre-configured rule.
Preferably, the method further includes the following step:
step S03, the terminal server showing an access result to the end user.
Preferably, the in the step S02, the terminal server judges the way the end user logs in to the internal system by judging whether the end user logs in to the internal system by SSO authentication.
Preferably, the step S02 specifically includes:
the terminal server judging whether there is SSO information in the internal system according to the recorded and saved login information and according to the pre-configured rule, and automatically inputting the login information of the end user if there is SSO information in the internal system, otherwise requiring the end user to manually input the login information;
analyzing the data flow and judging whether the analyzed result matches the pre-configured rule or not after the login information is successfully input, and allowing the end user to log in to and access the internal system if the analyzed result matches the pre-configured rule.
Preferably, the terminal sever records and saves the login information by determining a respective unique number of a user name input box, a password input box, and an OK button in the corresponding program in the terminal server when the end user logs in to the internal system.
The present disclosure further provides a device for realizing remote login, including:
a login recording module, configured for responding to a login request to an internal system from an end user, and recording and saving login information of the end user for logging in to the internal system; and
a central authentication module, configured for judging and analyzing the way the end user logs in to the internal system according to the recorded and saved login information and according to pre-configured rule, and allowing the end user to log in to and access the internal system if the analyzed result matches pre-configured rule.
Preferably, the device further includes a result showing module configured for showing an access result to the end user.
Preferably, the central authentication module is further configured for judging whether the end user logs in to the internal system by SSO authentication.
Preferably, the central authentication module includes a SSO authentication unit and a user bind authentication unit; the SSO authentication unit is configured for judging whether there is SSO information in the internal system according to the recorded and saved login information and according to the pre-configured rule, for automatically inputting the login information if there is SSO information in the internal system, and for requiring the end user to manually input the login information if there is no SSO information; the user bind authentication unit is configured for analyzing the data flow in the terminal server and judging whether the analyzed result matches the pre-configured rule after the login information is input, and allowing the end user to log in to and access the internal system if the analyzed result matches the internal system.
Preferably, the login recording module records and saves the login information by determining a respective unique number of a user name input box, password input box, an OK button in the corresponding program in the terminal server when the end user logs in to the internal system.
The method and device for realizing remote login of the present disclosure realize the remote login by analyzing the data flow in the terminal server and the pre-configured rule, thereby allowing for the implementations of the SSO authentication and user bind authentication on the aspect of the data flow in the terminal server, simplifying the process that the user logs in to and access the internal system, and improving the information security of logging in to and access the remote application system.
Many aspects of the embodiments can be better understood with reference to the following drawings. The components in the drawings are not necessarily dawns to scale, the emphasis instead being placed upon clearly illustrating the principles of the embodiments. Moreover, in the drawings, like reference numerals designate corresponding parts throughout the several views.
The disclosure is illustrated by way of example and not by way of limitation in the figures of the accompanying drawings in which like references indicate similar elements. It should be noted that references to “an” or “one” embodiment is this disclosure are not necessarily to the same embodiment, and such references mean at least one.
Referring to
Step S01, a terminal server responding to a login request to an internal system from an end user, and recording and saving the login information of the end user for logging in to internal system.
After the end user logs in to the terminal server successfully according to preset user name and password, the terminal server responds to the login request to the internal system from the end user, collects the login information of the end user for logging in to the internal system, records the login information, and saves the login information in a configuration file of the terminal server. Preferably, the remote client can be a PC (Personal Computer), a notebook computer, a PDA (Personal Digital Assistant), or any other device which can be connected to the terminal server safely via the internet. The reason that the terminal server records and saves the login information is that, each user interface element of each remoter client on each program interface is given a unique number. By recording the login information, the unique serial numbers of the input boxes of the user name and the password and the OK button of a corresponding program in the terminal server corresponding to the end user can be determined By using a login recording program which is preferably a login recording assistant, when an end user logs in to an application program in the terminal server corresponding to the end user, the unique serial numbers of the input boxes of the input information and the buttons corresponding to the application program are collected and saved in the login configuration files of the terminal server which corresponds to the end user, thus, a control can input corresponding information into the corresponding input box when performing the login authentication of the end user.
Step S02, the terminal server judging and analyzing the way the user logs in to the internal system according to the recorded and saved login information and according to pre-configured rule, and judging whether the analyzed result matches the pre-configured rule or not. If the analyzed result matches the pre-configured rule, step S021 is performed, otherwise step S022 is performed.
Step S021, allowing the login and access to the internal system of the end user.
Step 5022, denying the end user access to the internal system.
After the login recording program finishes recording the login information of the end user for logging in to the internal system, the control is installed in the terminal server. After the terminal server responds to the login request to the internal system from the end user, the control judges the way that the user logs in to the internal system according to the recorded and saved login information and according to the pre-configured rule. In the embodiment, preferably, the method that the user logs in to the internal system includes single sign-on (SSO) and user bind. The control analyzes the data flow in the terminal server and determines whether the analyzed result matches the pre-configured rule. If the analyzed result matches the pre-configured rule, the end user is allowed login and access to the internal system. If the analyzed result does not match the pre-configured rule, the end user is denied login to the internal system.
By recording and saving the login information of the end user for logging in to the internal system and analyzing the data flow in the terminal server, the method for realizing remote login of the present disclosure allows the end user to log in to the internal system remotely and further get access to the internal system, simplifies the process that the user logs in to and access the internal system, and improves the safety of the system.
Referring to
Step S03, the terminal server showing an access result to the end user.
The control in the terminal server analyzes the data flow and judges whether the analyzed result matches the pre-configured rule or not according to the recorded and saved login information of the end user for logging in to the internal system and the pre-configured rule. If the analyzed result matches the pre-configured rule, the end user is allowed access to the internal system and the terminal server shows an interface indicating that the end user successfully gets access to the internal system. If the analyzed result does not match the pre-configured rule, the end user is denied access to the internal system and the terminal server shows the interface indicating that the end user is denied access to the internal system.
The method for realizing remote login of the present disclosure shows the access result to the client via the terminal server, which completes and humanizes the remote login process.
Referring to
Step S11, the terminal server judging whether there is SSO information in the internal system or not according to the recorded and saved login information of the end user for logging in to the internal system and according to the pre-configured rule, if yes, Step S12 is performed, otherwise Step S13 is performed.
Step S12, automatically inputting the login information of the end user.
Step S13, requiring the end user to manually input the login information.
Step S14, analyzing the data flow in the terminal server and judging whether the analyzed result matches the pre-configured rule after the login information is input. If the analyzed result matches the pre-configured rule, step S15 is performed, otherwise Step S16 is performed.
Step S15, allowing the login and access to the internal system of the end user.
Step S16, denying the end user access to the internal system.
The SSO authentication allows a user to get access to all the mutual-trust application systems via one login. The SSO authentication includes a login mechanism which reflects the login to other applications such that the login can be used for the same user. The SSO authentication is the popular solution for company integrated business. The user can choose different ways to initiate the SSO operation according to requirements, for example, the user can initiate the SSO operation by using auto-form filling. After the SSO authentication is successfully implemented, the user can set user name and password according to requirements. If the user needs to set a slave user name and a slave password, the system can set different slave user names and passwords according to different application programs and different user accounts.
In the embodiment, after the login recording program finishes recording the login information of the end user for logging in to the internal system, the control is installed in the terminal server. When the end user accesses the internal system via the remote application publication client, the control in the terminal server judges whether there is SSO information of the internal system according to the recorded and saved login information of the end user and according to the pre-configured rule. If there is SSO information of the internal system in the terminal server, the login information of the end user is automatically input; otherwise, the end user is required to input the login information manually.
In the user bind authentication, different binding ways can be chosen in the login interface, for example, the master user name and the slave user name can be bound by analyzing data package or bound in combination with the SSO authentication. The format of the data package used for binding the master user name and salve user name can be TCP (Transmission Control Protocol), HTTP (Hyper Text Transfer Protocol), FTP (File Transfer Protocol), simple universal plaintext, or other suitable formats. Since in the user bind authentication, the master user name and the slave user name can be bound by filtering data flow, therefore, the rule of the user bind authentication can be configured by setting different formats of data flows used for filtering different protocols. That is, a certain field can be set to match the user name and another field can be set to match the password. The terminal server instructs the control to analyze the data flow according to the set rule for binding the master and slave user name.
In the embodiment, after the end user inputs the login information, the control analyzes the data flow in the terminal server and judges whether the analyzed result matches the pre-configured rule. If the analyzed result matches the pre-configured rule, the end user is allowed to log in to and access the internal system. If the analyzed result does not match the pre-configured rule, the end user is denied access to the internal system. In this way, the user name bind authentication is finished. Specifically, in a preferred embodiment, when the end user accesses the internal system via the terminal server by using TCP connection, the control intercepts and analyzes the data flow of the corresponding program in the terminal server. The control disconnects the TCP connection and denies the user access when determining that the analyzed result does not match the preset rule, thereby finishing the user bind authentication.
The method for realizing remote login of the present disclosure analyzes the data flow in the terminal server, thereby allowing for the implementations of the SSO authentication and user bind authentication on the aspect of the data flow in the user remote applications, and improving the information security of logging in to and access the remote application system.
Referring to
The login recording module 01 is configured for responding to a login request to the internal system from an end user, and recording and saving the login information of the end user for logging in to the internal system.
After the end user logs in to the terminal server successfully according to preset user name and password, the login recording module 01 collects the login information of the end user for logging in to the internal system, records the login information, and saves the login information in a configuration file of the terminal server. Preferably, the remote client can be a PC (Personal Computer), a notebook computer, a PDA (Personal Digital Assistant), or any other device which can be connected the terminal server safely via the internet. The reason that the login recording module 01 records and saves the login information is that, each user interface element of each remoter client on each program interface is given a unique number. By recording the login information of the end user for logging in to the internal system, the unique serial numbers of the input boxes of the user name and the password and the OK button of a corresponding program in the terminal server corresponding to the end user can be determined By using a login recording program which is preferably a login recording assistant, when an end user logs in to an application program in the terminal server corresponding to the end user, the unique serial numbers of the input boxes of the input information and the buttons corresponding to the application program are collected and saved in the login configuration files of the terminal server which corresponds to the end user, thus, a control can input corresponding information into the corresponding input box when performing the login authentication of the end user.
The central authentication module 02 is configured for judging and analyzing the way the user logs in to the internal system according to the recorded and saved login information of the end user for logging in to the internal system and according to pre-configured rule. If the analyzed result matches the pre-configured rule, the central authentication module 02 allows the end user to log in to and access the internal system.
After the login recording module 01 finishes recording the login information, the control is installed in the central authentication module 02 of the terminal server. After the end user logs in to the terminal server, the central authentication module 02 responds to the login request to the internal system from the end user and judges the way that the user logs in to the internal system according to the recorded and saved login information and according to the pre-configured rule. In the embodiment, preferably, the way that the user logs in to the internal system includes SSO authentication and user bind authentication. After the central authentication module 02 analyzes the data flow, if the analyzed result matches the pre-configured rule, the end user is allowed login and access to the internal system; otherwise, if the analyzed result does not match the pre-configured rule, the end user is denied login to the internal system.
The central authentication module 02 is further configured for judging whether the user logs in to the internal system via the SSO authentication or not. If the central authentication module 02 determines that the user logs in to the internal system via the SSO authentication, the login information of the end user is automatically input. Otherwise, the end user is required to manually input the login information.
By using the login recording module 01 to record and save the login information of the end user for logging in to the internal system and by using the central authentication module 02 to analyze the data flow in the terminal server, the device for realizing remote login of the present disclosure allows the end user to log in to internal system remotely and further get access to the internal system, simplifies the process that the user logs in to and access the internal system, and improves the safety of the system.
Referring to
The result showing module 03 is configured for showing an access result to the end user.
The central authentication module 02 in the terminal server analyzes the data flow and judges whether the analyzed result matches the pre-configured rule or not according to the login information recorded and saved by the login recording module 01 and according to the pre-configured rule. If the analyzed result matches the pre-configured rule, the end user is allowed access to the internal system and the result showing module 03 shows an interface indicating that the end user successfully gets access to the internal system. If the analyzed result does not match the pre-configured rule, the end user is denied access to the internal system and the result showing module 03 shows the interface indicating that the end user is denied access to the internal system.
The device for realizing remote login of the present disclosure shows the access result to the client via the terminal server, which completes and humanizes the remote login process.
Referring to
The SSO authentication unit 021 is configured for judging whether there is SSO information in the internal system according to the recorded and saved login information of the end user for logging in to the internal system and according to the pre-configured rule. If there is SSO information in the terminal system, the login information of the end user is automatically input, otherwise the end user is required to manually input the login information.
The user bind authentication unit 022 is configured for analyzing the data flow in the terminal server and judging whether the analyzed result matches the pre-configured rule after the login information is input. If the analyzed result matches the pre-configured rule, the end user is allowed to log in to and access the internal system.
Specifically, in a preferred embodiment, when the end user accesses the internal system via the terminal server by using TCP connection after inputting the login information by the SSO authentication unit 021, the user bind authentication unit 022 intercepts and analyzes the data flow of the corresponding program in the terminal server. The user bind authentication unit 022 disconnects the TCP connection and denies the user access when determining that the analyzed result does not match the preset rule, thereby finishing the user bind authentication.
The device for realizing remote login of the present disclosure analyzes the data flow in the terminal server, thereby allowing the end user to log in to and access the internal system, simplifying the process that the user logs in to and access the internal system, and improving the safety of the system.
Even though information and the advantages of the present embodiments have been set forth in the foregoing description, together with details of the mechanisms and functions of the present embodiments, the disclosure is illustrative only; and that changes may be made in detail, especially in matters of shape, size, and arrangement of parts within the principles of the present embodiments to the full extend indicated by the broad general meaning of the terms in which the appended claims are expressed.
| Number | Date | Country | Kind |
|---|---|---|---|
| 201210012145.4 | Jan 2012 | CN | national |
