Application authorization login method and device, equipment and storage medium

Abstract

The invention relates to an application authorization login method and device, equipment and a storage medium. The application authorization login method is applied to an identity authentication system, and specifically comprises the following steps: receiving an application authorization request sent by a target application, and taking current time as authorization time; under the condition of determining that the digital certificate included in the application authorization request is valid, acquiring authorization information of a target user for a target application; encrypting the trusted digital identity identifier, the authorization time and the authorization information allocated to the application authorization request by using an application public key in the digital certificate to generate a dynamic ciphertext; receiving an authorization result request generated by a target background of the target application based on a login operation initiated by the target application; and after the dynamic ciphertext is decrypted and verified by using the application private key corresponding to the application identifier, an authorization result is generated, and the authorization result is returned to the target background, so that the target background completes login based on the authorization result, and the method improves convenience, security and controllability of application login.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to an application authorization login method, device, equipment and storage medium. Background Art

[0002] With the vigorous development of intelligent and connected devices, the applications deployed on devices are becoming more and more abundant. For example, the functions and scenarios of vehicle-side applications deployed on cars are becoming more and more abundant. At present, most vehicle-side applications require users to provide user information for registration and then log in. However, this login method brings great inconvenience to users and also brings great risks to user information protection. Summary of the invention

[0003] In order to solve the above technical problems, the embodiments of the present disclosure provide an application authorization login method, apparatus, device and storage medium.

[0004] In a first aspect, an embodiment of the present disclosure provides an application authorization login method, which is applied to an identity authentication system, and the method includes:

[0005] receiving an application authorization request sent by a target application, and using the current time as the authorization time, wherein the application authorization request is generated by the target application in response to a triggering operation of a login identifier;

[0006] When it is determined that the digital certificate included in the application authorization request is valid, obtaining authorization information of the target user who triggers the login identification for the target application;

[0007] Use the application public key in the digital certificate to encrypt the trusted digital identity identifier, authorization time and authorization information assigned to the application authorization request, generate dynamic ciphertext, and return the dynamic ciphertext to the target application;

[0008] Receiving an authorization result request generated by a target background of a target application based on a login operation initiated by the target application, wherein the authorization result request includes a dynamic ciphertext and an application identifier of the target application;

[0009] Use the application private key corresponding to the application identifier to decrypt and verify the dynamic ciphertext, generate an authorization result, and return the authorization result to the target background so that the target background can complete the login based on the authorization result.

[0010] In a second aspect, an embodiment of the present disclosure provides an application authorization login method, which is applied to a target application, and the method includes:

[0011] In response to the triggering operation of the login identifier, an application authorization request is generated, and the application authorization request is sent to the identity authentication system, the identity authentication system is used to use the current time of receiving the application authorization request as the authorization time, and when it is determined that the digital certificate included in the application authorization request is valid, control the target application to display the application authorization scope;

[0012] In response to the target user's confirmation operation on the application authorization scope that triggers the login identification, the target user's authorization information for the target application is obtained, and the authorization information is sent to the identity authentication system, the identity authentication system is used to use the application public key in the digital certificate to encrypt the trusted digital identity identifier assigned to the application authorization request, the authorization time and the authorization information, generate a dynamic ciphertext, and return the dynamic ciphertext to the target application;

[0013] Use the dynamic ciphertext to initiate a login operation to the target backend of the target application, so that the target backend responds to the login operation, generates an authorization result request according to the dynamic ciphertext and the application identifier of the target application, and sends the authorization result request to the identity authentication system, which is used to use the application private key corresponding to the application identifier to decrypt and verify the dynamic ciphertext and generate an authorization result;

[0014] The target background of the target application receives the login result generated after completing the login based on the authorization result, and displays the start interface when the login result is successful.

[0015] In a third aspect, an embodiment of the present disclosure provides an application authorization login device, which is applied to an identity authentication system, and the device includes:

[0016] A first receiving unit is used to receive an application authorization request sent by a target application and use the current time as the authorization time, wherein the application authorization request is generated by the target application in response to a triggering operation of a login identifier;

[0017] A first acquisition unit is used to acquire authorization information of a target user triggering a login identifier for a target application when it is determined that the digital certificate included in the application authorization request is valid;

[0018] The encryption unit is used to encrypt the trusted digital identity identifier, authorization time and authorization information assigned to the application authorization request using the application public key in the digital certificate, generate dynamic ciphertext, and return the dynamic ciphertext to the target application;

[0019] A second receiving unit is used to receive an authorization result request generated by a target background of a target application based on a login operation initiated by the target application, wherein the authorization result request includes a dynamic ciphertext and an application identifier of the target application;

[0020] The decryption unit is used to use the application private key corresponding to the application identifier to decrypt and verify the dynamic ciphertext, generate an authorization result, and return the authorization result to the target background so that the target background can complete the login based on the authorization result.

[0021] In a fourth aspect, an embodiment of the present disclosure provides an application authorization login device, which is applied to a target application, and the device includes:

[0022] a generating unit, configured to generate an application authorization request in response to a triggering operation of the login identifier, and send the application authorization request to the identity authentication system, wherein the identity authentication system uses the current time of receiving the application authorization request as the authorization time, and controls the target application to display the application authorization scope when determining that the digital certificate included in the application authorization request is valid;

[0023] A second acquisition unit is used to obtain the target user's authorization information for the target application in response to the target user's confirmation operation on the application authorization scope that triggers the login identification, and send the authorization information to the identity authentication system, the identity authentication system is used to use the application public key in the digital certificate to encrypt the trusted digital identity identifier assigned to the application authorization request, the authorization time and the authorization information, generate a dynamic ciphertext, and return the dynamic ciphertext to the target application;

[0024] A sending unit is used to initiate a login operation to a target background of a target application using a dynamic ciphertext, so that the target background generates an authorization result request according to the dynamic ciphertext and an application identifier of the target application in response to the login operation, and sends the authorization result request to an identity authentication system, and the identity authentication system is used to decrypt and verify the dynamic ciphertext using an application private key corresponding to the application identifier, and then generate an authorization result;

[0025] The third receiving unit is used to receive a login result generated after the target background of the target application completes the login based on the authorization result, and display a start interface when the login result is successful.

[0026] In a fifth aspect, an embodiment of the present disclosure provides an electronic device, including:

[0027] Memory;

[0028] Processor; and

[0029] Computer programs;

[0030] The computer program is stored in the memory and is configured to be executed by the processor to implement the above-mentioned application authorization login method.

[0031] In a sixth aspect, an embodiment of the present disclosure provides a computer-readable storage medium having a computer program stored thereon, which implements the steps of application authorization login as described above when the computer program is executed by a processor.

[0032] The application authorization login method provided by the present disclosure is applied to the identity authentication system, including: receiving an application authorization request sent by a target application, and taking the current time as the authorization time, wherein the application authorization request is generated by the target application in response to a trigger operation of a login identifier; obtaining the authorization information of the target user of the trigger login identifier for the target application when the digital certificate included in the application authorization request is determined to be valid; using the application public key in the digital certificate to encrypt the trusted digital identity identifier, authorization time and authorization information assigned to the application authorization request, generating a dynamic ciphertext, and returning the dynamic ciphertext to the target application; receiving an authorization result request generated by the target background of the target application based on the login operation initiated by the target application, wherein the authorization result request includes the dynamic ciphertext and the application identifier of the target application; using the application private key corresponding to the application identifier to decrypt and verify the dynamic ciphertext, generating an authorization result, and returning the authorization result to the target background, so that the target background completes the login based on the authorization result. The method provided by the present application improves the convenience of application login and protects user information to a certain extent. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0034] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0035] Figure 1 A schematic diagram of the structure of the application authorization login system provided by the embodiment of the present disclosure;

[0036] Figure 2 A flowchart of an application authorization login method provided by an embodiment of the present disclosure;

[0037] Figure 3 A schematic diagram of the application registration process provided by the embodiment of the present disclosure;

[0038] Figure 4 A schematic diagram of a key system provided in an embodiment of the present disclosure;

[0039] Figure 5 A schematic diagram of an identifier set system provided for an embodiment of the present disclosure;

[0040] Figure 6 A schematic diagram of the application authorization login process provided by an embodiment of the present disclosure;

[0041] Figure 7 A flowchart of an application authorization login method provided by another embodiment of the present disclosure;

[0042] Figure 8 A schematic diagram of an interface for application authorization login provided in an embodiment of the present disclosure;

[0043] Fig. 9 A schematic diagram of the structure of an application authorization login device provided in an embodiment of the present disclosure;

[0044] Fig.10 A schematic diagram of the structure of an application authorization login device provided by another embodiment of the present disclosure;

[0045] Fig.11 A schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0046] In order to more clearly understand the above-mentioned objectives, features and advantages of the present disclosure, the scheme of the present disclosure will be further described below. It should be noted that the embodiments of the present disclosure and the features in the embodiments can be combined with each other without conflict.

[0047] In the following description, many specific details are set forth to facilitate a full understanding of the present disclosure, but the present disclosure may also be implemented in other ways different from those described herein; it is obvious that the embodiments in the specification are only part of the embodiments of the present disclosure, rather than all of the embodiments.

[0048] In view of the above technical problems, the disclosed embodiments provide an application authorization login method, which is applied to an identity authentication system, performs application joint login and information authorization based on the identity authentication system, realizes a convenient experience of one-key joint login, improves the user login speed, and based on the principle of minimizing authorization, uses necessary user information and authorization information obtained based on the user's explicit authorization to share with the application, and also performs encryption, signature verification, verification and other security processing during the information sharing process, effectively improves the security of information sharing, and protects the user's personal information to the greatest extent. Detailed description is given through one or more of the following embodiments.

[0049] The application authorization login method provided in the embodiment of the present disclosure can be applied to the application registration login scenario. The method can be executed by an application authorization login device, which can be implemented by software and / or hardware, and the device can be integrated in an electronic device. Among them, the electronic device can include but is not limited to mobile terminals such as smart phones, laptops, digital broadcast receivers, personal digital assistants (Personal Digital Assistant, PDA), tablet computers (Tablet Personal Computer, Tablet PC), PMP (portable multimedia player), vehicle terminals (such as vehicle navigation terminals), wearable devices, etc., and fixed terminals such as digital televisions, desktop computers, smart home devices, etc.

[0050] Figure 1 The schematic diagram of the structure of the application authorization login system provided by the embodiment of the present disclosure is described by taking the vehicle-side application authorization login scenario deployed on the car as an example. The application authorization login system includes an identity authentication system, an application manufacturer, a host factory and a car. The identity authentication system includes an identity authentication interface, an identity authentication program and an identity authentication platform, wherein the identity authentication system can be understood as a trusted digital identity authentication system, and the identity authentication interface refers to a trusted digital identity API (Application Programming Interface, application programming interface), which is used to receive an application authorization request sent by the vehicle-side application, take the current time as the authorization time, send a digital certificate and authorization time to the identity authentication program, display the application authorization information field and send a dynamic ciphertext to the vehicle-side application. The identity authentication program can be understood as a trusted digital identity Applet (a small application written in Java programming language) in a secure chip (Secure Element, SE), which is used to verify the validity of a digital certificate and generate a dynamic ciphertext. The identity authentication platform can be understood as a trusted digital identity platform, which is used to decrypt and verify the dynamic ciphertext and return the generated authorization result to the vehicle-side application background of the target application, and can be deployed separately in the host factory. Application manufacturers include vehicle-side application backends, which refer to manufacturers who develop vehicle-side applications. The vehicle-side application backend is used to respond to the login operation of the vehicle-side application, send authorization result requests to the identity authentication platform, and complete automatic registration and automatic login based on the received authorization results. The vehicle is deployed with vehicle-side applications, identity authentication interfaces, and security chips. The vehicle refers to the device that runs / deploys the vehicle-side application. Figure 1As shown, a possible implementation process includes: the vehicle-side application accesses the trusted digital identity Apple in the security chip through the trusted digital identity API, the vehicle-side application accesses the vehicle-side application background through the car's 4G / 5G, and the vehicle-side application background accesses the trusted digital identity platform through the Internet, that is, the vehicle-side application interacts with the vehicle-side application background and the trusted digital identity API, the trusted digital identity API interacts with the trusted digital identity Apple, and the vehicle-side application background interacts with the trusted digital identity platform.

[0051] Figure 2 The flowchart of the application authorization login method provided in the embodiment of the present disclosure is applied to the above-mentioned identity authentication system, specifically including the following steps: Figure 2 The following steps are shown:

[0052] S201. Receive an application authorization request sent by a target application, and use the current time as the authorization time.

[0053] The application authorization request is generated by the target application in response to a triggering operation of the login identifier.

[0054] It is understandable that the target user triggers the login identifier of the target application, and the target application generates an application authorization request in response to the trigger operation. The login identifier can be the startup identifier of the target application, or the login / registration identifier on the startup interface displayed after the target application is started. The application authorization request carries a digital certificate, which is generated by the target application when it is registered. Subsequently, the target application sends the application authorization request to the identity authentication interface, and the identity authentication interface determines the current time of the target device as the authorization time. The target device refers to the device on which the target application, identity authentication interface and identity authentication program are deployed, such as the car in the above example. Subsequently, the identity authentication interface integrates the digital certificate and authorization time and sends them to the identity authentication program.

[0055] Optionally, before receiving the application authorization request sent by the target application, the specific implementation steps for the target application to register are as follows:

[0056] Receive an application registration request sent by the target background of the target application, where the application registration request includes application information and application authorization scope of the target application; if the application registration request is reviewed and approved, determine the application identifier assigned to the target application; generate a digital certificate for the target application based on the application identifier and the application authorization scope, and sign the digital certificate with the platform private key of the identity authentication platform, so that the target application performs user login based on the digital certificate, wherein the platform private key and the platform public key are the public-private key pair of the identity authentication platform.

[0057] Understandably, after the target application is successfully developed, it will be registered on the identity authentication platform. The identity authentication platform receives the application registration request sent by the target background (or application developer) of the target application. The application registration request includes application information and application authorization scope. Application information refers to registration related information, such as application scenarios, etc., and application authorization scope refers to user information that requires user authorization, such as name, etc. Subsequently, the identity authentication platform reviews the legality of the application information and the necessity of the application authorization scope to minimize the acquisition of user information and generate the audit result. If the audit result is that the audit is passed, the unique application identifier (APPID) assigned to the target application is determined. The APPID of each application is different. The application public-private key pair (application public key and application private key) and digital certificate of the target application are generated, and the platform private key of the identity authentication platform is used for signing, wherein the application private key is kept by the identity authentication platform. Subsequently, the target background can view the application audit information and download the digital certificate, and the identity authentication platform returns the application identifier and digital certificate.

[0058] For example, see Figure 3 , Figure 3 The application registration process diagram provided for the embodiment of the present disclosure is that after the application developer successfully develops the target application, the application will be registered and registered on the trusted digital identity platform (also known as the identity authentication platform). The trusted digital identity platform receives the application registration information, which includes the basic information of the application, the application scenario, the authorization information field, and the user personal information required for the application scenario. The application developer sends the application registration information and the authorization information field range to the trusted digital identity platform, and the trusted digital identity platform registers the application registration information into the database. The auditor of the trusted digital identity platform reviews the application registration information and focuses on the necessity of the authorization information field that the application needs to obtain. After the review is passed, the trusted digital identity platform will assign a unique application identifier to the target application, generate an application public-private key pair (APP public-private key pair) and a digital certificate, and use the platform private key to sign the digital certificate. Subsequently, the application developer logs in to the trusted digital identity platform, checks the application approval information and downloads the digital certificate, and packages the digital certificate into the application installation package so that the target application responds to the trigger operation of the login identifier and generates an authorization request carrying the digital certificate.

[0059] Optionally, the above-mentioned receiving the application authorization request sent by the target application and using the current time as the authorization time can be specifically implemented through the following steps:

[0060] An application authorization request sent by a target application is received through an identity authentication interface, the application authorization request including a digital certificate of the target application; the current time is obtained as the authorization time corresponding to the application authorization request; the authorization time and the digital certificate are encapsulated into a data unit form and sent to an identity authentication program, so that the identity authentication program verifies the validity and legality of the digital certificate.

[0061] It can be understood that the steps of integrating the digital certificate and the authorization time by the identity authentication interface include: the identity authentication interface receives the application authorization request sent by the target application, and obtains the current time of the target device as the authorization time. Subsequently, the digital certificate and the authorization time are encapsulated into an application authorization request, which can be a request format of a security chip, such as an application protocol data unit (APDU), and the application authorization request APDU is sent to the identity authentication program, which is used to verify the validity and legality of the digital certificate.

[0062] S202: When it is determined that the digital certificate included in the application authorization request is valid, obtain authorization information of the target user who triggers the login identification for the target application.

[0063] It can be understood that, based on the above S201, the identity authentication program determines whether the digital certificate is valid, and if the digital certificate is valid, the application authorization scope of the target user at the time of registration is displayed through the identity authentication interface. The application authorization scope is determined based on the authorization information field when the application is registered on the platform. After the target user confirms the displayed application authorization scope, the target user's authorization information for the target application is obtained.

[0064] The digital certificate includes the application identifier, application public key, information authorization set (application authorization scope), certificate signature and certificate validity period.

[0065] Optionally, when it is determined that the digital certificate included in the application authorization request is valid, obtaining the authorization information of the target user who triggers the login identification for the target application can be specifically implemented through the following steps:

[0066] The certificate signature is verified by the platform public key of the identity authentication platform in the identity authentication program, and the validity of the certificate validity period is checked to generate a first check result for the digital certificate, the first check result being that the digital certificate is valid or the digital certificate is invalid; when it is determined that the digital certificate is valid, a session identifier corresponding to the application authorization request is created, and the session identifier is returned to the identity authentication interface; in response to the session identifier, the authorization information field to be authorized to the target application is displayed to the target user who triggers the login identification through the identity authentication interface to obtain the authorization information authorized by the target user to the target application.

[0067] It can be understood that the identity authentication program includes the platform public key of the identity authentication platform and a data set that stores trusted digital identifiers. The identity authentication program uses the platform public key to verify the certificate signature. The certificate signature is obtained by signing with the platform private key when the target application is registered on the identity authentication platform. The validity of the certificate validity period is checked and a certificate check result is generated. The certificate check result is that the certificate is valid or invalid. When it is determined that the certificate is valid, an authorization session is created and a session identifier (session ID) is determined. After receiving the session identifier, the identity authentication interface displays the authorization fields that need to be authorized to the application to the target user and obtains the authorization information. The user can check the authorization field for authorization. The authorization type of the authorization field is divided into mandatory and optional. Subsequently, the identity authentication interface encapsulates the session identifier and the authorization field authorized by the user to the target application into an authorization information APDU and returns it to the identity authentication program.

[0068] For example, see Figure 4 , Figure 4 A schematic diagram of the key system provided for the embodiment of the present disclosure, the trusted digital identity platform includes a data set (VSID) storing a trusted digital identifier, a platform private key and an application private key, the trusted digital identity Applet includes a VSID and a platform public key, a digital certificate of the target application (APP digital certificate), the APP digital certificate includes an APPID, an APP public key (application public key), an information authorization set, a certificate validity period and an APP certificate signature, the platform public-private key pair (platform private key and platform public key) of the identity authentication platform adopts an elliptic curve public key cryptography algorithm (SM2) or an elliptic curve mathematics public key encryption algorithm (Elliptic Curve Cryptography, ECC) or an asymmetric encryption algorithm (RSA), which is used for signing and verifying the APP digital certificate. The APP public-private key pair (application public key and application private key) also adopts an asymmetric encryption algorithm, which is used for application authorization to obtain the VSID and the user's authorization information. The APP digital certificate consists of five parts, including APPID, which is the APPID assigned by the trusted digital identity platform when the application applies for registration and enrollment on the trusted digital identity platform; APP public key, which is the APP public-private key pair generated by the trusted digital identity platform when the application applies for registration. The APP private key is kept by the trusted digital identity platform. The APP public key is mainly used to encrypt the VSID obtained by the APP digital certificate to ensure security; information authorization set, which is the information set that the approved application can obtain through user authorization after the trusted digital identity platform reviews the application scenario when the application applies for registration on the trusted digital identity platform; the certificate validity period refers to the effective deadline of the APP digital certificate, which cannot be used after expiration; APP certificate signature, which is the signature of the complete information of the digital certificate after the application applies for registration using the platform private key before issuing it to the application.

[0069] S203: Use the application public key in the digital certificate to encrypt the trusted digital identity identifier, authorization time, and authorization information assigned to the application authorization request, generate dynamic ciphertext, and return the dynamic ciphertext to the target application.

[0070] It is understandable that, based on the above S202, after obtaining the authorization information sent by the identity authentication interface, the identity authentication program obtains the application public key in the digital certificate, or finds the application public key according to the session identifier, and determines the trusted digital identity identifier (VSID) assigned to the application authorization request. The VSIDs assigned to different application authorization requests are different. Subsequently, the trusted digital identity identifier, authorization time and authorization information are encrypted using the application public key to generate a dynamic ciphertext (Enc-VSID), and the dynamic ciphertext is returned to the identity authentication interface and the target application.

[0071] S204: Receive an authorization result request generated by a target background of the target application based on a login operation initiated by the target application.

[0072] The authorization result request includes a dynamic ciphertext and an application identifier of the target application.

[0073] It is understandable that, based on the above S203, after receiving the dynamic ciphertext, the target application initiates a login operation to the target background, and sends the dynamic ciphertext to the target background. The target background responds to the login operation, generates an authorization result request according to the dynamic ciphertext and the application identifier, and sends the authorization result request to the identity authentication platform to obtain the application authorization result. Alternatively, the target application uses the obtained dynamic ciphertext as a parameter to call the identity authentication platform's application authorization result acquisition interface, and sends the generated authorization result request to the identity authentication platform through the interface.

[0074] S205. After decrypting and verifying the dynamic ciphertext using the application private key corresponding to the application identifier, an authorization result is generated, and the authorization result is returned to the target background, so that the target background completes the login based on the authorization result.

[0075] It is understandable that, based on the above S204, the identity authentication platform obtains the application private key corresponding to the application identifier, uses the application private key to decrypt and verify the dynamic ciphertext, generates an authorization result, and returns the authorization result to the target background, where the authorization result includes an identifier set (also called an application ID set) and authorization information. The target background completes the automatic registration and automatic login of the target user on the target application based on the authorization result, and returns the login result to the target application.

[0076] Optionally, the above-mentioned application private key corresponding to the application identifier is used to decrypt and verify the dynamic ciphertext to generate an authorization result, which can be specifically achieved through the following steps:

[0077] Determine the application private key corresponding to the application identifier, wherein the application private key and the application public key are the public-private key pair of the target application; use the application private key to decrypt the dynamic ciphertext to obtain a trusted digital identity identifier, authorization time and authorization information; check the validity of the authorization time, and determine whether the authorization information is within the application authorization scope stored in the identity authentication platform included in the identity authentication system for the target application, and obtain a second check result for the authorization information, the second check result being either a passed check or a failed check; when the second check result is a passed check, generate an authorization result based on the application identifier, the trusted digital identity identifier and the authorization information.

[0078] It is understandable that the identity authentication platform obtains the application private key according to the application identifier, uses the application private key to decrypt the dynamic ciphertext, and obtains the trusted digital identity identifier, authorization time and authorization information. Subsequently, the identity authentication platform checks the validity of the authorization time according to the session identifier, and pre-sets a time threshold. The time threshold is used to limit whether the authorization request has timed out. For example, the time threshold is 10 minutes, that is, to determine whether the authorization time is within 10 minutes to avoid the authorization request timeout and failure to respond, affecting login security. Subsequently, the authorization information is compared to see whether it is within the application authorization range determined by the target application saved by the identity authentication platform at the time of registration, and the second inspection result is obtained, that is, to determine whether the authorization is in violation of regulations to ensure the legality of the user information authorization. The second inspection result is a check pass or a check fail. A check pass means that the authorization time is valid and the authorization information is legal. In the case where the second inspection result is a check pass, an authorization result is generated based on the application identifier, the trusted digital identity identifier and the authorization information.

[0079] Optionally, the above-mentioned generation of the authorization result according to the application identifier, the trusted digital identity identifier and the authorization information can be specifically implemented through the following steps:

[0080] Combine the application identifier and the trusted digital identity identifier, and generate an identifier set of the target application according to preset rules; generate an authorization result according to the identifier set and the authorization information; wherein the identifier set includes a first identifier, a second identifier, a third identifier and a fourth identifier, the first identifier is a user identifier assigned to the target application by the identity authentication platform, the second identifier is a user identifier assigned to the first application group where the target application is located by the identity authentication platform, the third identifier is a device identifier assigned to the target device running the target application by the identity authentication platform, and the fourth identifier is a device identifier assigned to the second application group where the target device is located by the identity authentication platform.

[0081] Understandably, the identity authentication platform combines the application identifier and the trusted digital identity identifier, and generates an identifier set according to preset rules, which may be a digest algorithm or a snowflake algorithm. Subsequently, an authorization result is generated based on the identifier set and the authorization information, and the authorization result is returned to the target background, for example, the identifier set and / or the authorization information are encrypted using the background private key of the target background to generate the authorization result, and the target background subsequently decrypts the authorization result using the background public key before registering and logging in, or directly using the identifier set and the authorization information as the authorization result. The identifier set includes a first identifier, a second identifier, a third identifier and a fourth identifier. The first identifier is a user identifier assigned to the target application by the identity authentication platform. Different applications obtain different first identifiers. The second identifier is a user identifier assigned to the first application group where the target application is located by the identity authentication platform. The first application group refers to an application group developed by the same application manufacturer. Different applications in the first application group obtain the same second identifier, and different first application groups obtain different second identifiers (user identifiers). That is, the second identifiers of applications developed by the same application manufacturer are the same, that is, the second identifiers of applications developed by the same manufacturer are the same, and the second identifiers of applications developed by different manufacturers are different. The third identifier is a device identifier assigned to the target device running the target application by the identity authentication platform. The target device may be the car in the above example. Different applications obtain different third identifiers. The fourth identifier is a device identifier assigned to the second application group where the target device is located by the identity authentication platform. The second application group refers to a device group produced by the same manufacturer. Different applications in the second application group obtain the same fourth identifier (device identifier), and different application groups obtain different fourth identifiers. That is, the fourth identifiers of applications deployed on devices produced by the same manufacturer are the same, and the fourth identifiers of applications deployed on devices produced by different manufacturers are different.

[0082] For example, see Figure 5 , Figure 5 Schematic diagram of the identifier set system provided in the embodiment of the present disclosure. The vehicle-side application uses its own APP digital certificate to access the VSID in the trusted digital identity Applet in the SE through the trusted digital identity API, and dynamically encrypts the VSID to obtain the dynamic ciphertext Enc-VSID of the VSID, such as Figure 5 As shown in the figure, vehicle-side application-1 and vehicle-side application-2 belong to the same application group. Vehicle-side application-1 corresponds to dynamic ciphertext Enc-VSID-1, and vehicle-side application-2 corresponds to dynamic ciphertext Enc-VSID-2. Subsequently, the vehicle-side application obtains the VSID dynamic ciphertext Enc-VSID, and can obtain the corresponding application ID set and authorization information by accessing the trusted digital identity platform. Then the application background can complete automatic registration and automatic login based on the application ID and authorization information, as shown in the figure below. Figure 5 As shown, the application ID set of vehicle-side application-1 includes S-OpenID-1 (first identifier), S-UnionID (second identifier), V-OpenID-1 (third identifier) ​​and V-UnionID (fourth identifier), the application ID set of vehicle-side application-2 includes S-OpenID-2, S-UnionID, V-OpenID-2 and V-UnionID, vehicle-side application-1 and vehicle-side application-2 belong to the same application group, that is, they are applications developed based on the same manufacturer, and the second identifier (S-UnionID) of vehicle-side application-1 and vehicle-side application-2 is the same, device-1 that deploys vehicle-side application-1 and device-2 that deploy vehicle-side application-2 belong to the same device group, that is, they are devices produced by the same manufacturer, and the fourth identifier (V-UnionID) of vehicle-side application-1 and vehicle-side application-2 is the same. Specifically, S-OpenID refers to the fixed user ID derived from the platform user identifier for the vehicle-side application, and different vehicle-side applications obtain different S-OpenIDs; S-UnionID refers to the fixed user ID derived from the platform user identifier for the vehicle-side application group, different vehicle-side applications within the application group obtain the same S-UnionID, and different application groups obtain different S-UnionIDs; V-OpenID refers to the fixed vehicle ID derived from the platform vehicle identifier for the vehicle-side application, and different vehicle-side applications obtain different V-OpenIDs; V-UnionID refers to the fixed vehicle ID derived from the platform vehicle identifier for the vehicle-side application group, different vehicle-side applications within the application group obtain the same V-UnionID, and different application groups obtain different V-UnionIDs.

[0083] For example, see Figure 6 , Figure 6The schematic diagram of the application authorization login process provided by the embodiment of the present disclosure specifically refers to the schematic diagram of the process of implementing application authorization login through interaction between the vehicle-mounted application, the vehicle-mounted application background, the trusted digital identity API, the feasible digital identity Applet and the trusted digital identity platform, specifically: 1) The vehicle-side application sends an authorization request to the trusted digital identity API, and the authorization request carries the APP digital certificate; 2) The trusted digital identity API obtains the current time of the vehicle as the authorization time, and encapsulates the APP digital certificate and the authorization time into an authorization request APDU; 3) The trusted digital identity API sends the authorization request APDU to the trusted digital identity Applet; 4) The trusted digital identity API sends the authorization request APDU to the trusted digital identity Applet; The digital identity Applet uses the platform public key to verify the APP digital certificate to ensure the legitimacy of the APP digital certificate, and compares the certificate validity period in the APP digital certificate to ensure the validity of the APP digital certificate. It then creates an authorization session and obtains the APP public key in the APP digital certificate, and returns the session ID and certificate check result to the trusted digital identity API; 5) The trusted digital identity API displays the information fields that need to be authorized to the application to the user. The user can check the information fields for authorization. The authorization types of the information fields are divided into mandatory and optional. Then the session ID and authorization information are encapsulated into the authorization result APDU; 6) The trusted digital identity API will obtain Take the authorization result APDU and send it to the trusted digital identity Applet in SE; 7) The trusted digital identity Applet finds the corresponding APP public key according to the session ID, uses the APP public key to encrypt the VSID, authorization time and authorization information, generates a dynamic ciphertext Enc-VSID, and returns the Enc-VSID to the trusted digital identity API and the vehicle-side application in turn; 8) The vehicle-side application uses the obtained Enc-VSID as a parameter to call the trusted digital identity platform's application authorization result acquisition interface, or initiates a login operation to the vehicle-side application background, and the vehicle-side application background sends a request to obtain the application authorization result; 9) The trusted digital identity platform APPID obtains the APP private key, and uses the APP private key to decrypt Enc-VSID to obtain VSID, authorization time and authorization information; 10) The trusted digital identity platform checks the validity of the authorization time according to the authorization session, and compares whether the authorization information is within the application authorization information field saved by the identity authentication platform to ensure the legitimacy of the user information authorization; 11) The trusted digital identity platform combines APPID and VSID, and generates an application ID set according to certain rules, and returns the application ID set and authorization information to the vehicle-side application background; 12) The vehicle-side application background uses the ID set and authorization information to complete automatic registration and automatic login, and returns the login result to the vehicle-side application.

[0084] The disclosed embodiment provides an application authorization login method. When the vehicle-side application accesses the trusted digital identity platform, that is, when registering on the platform, the platform conducts a minimization review of the authorization information fields available to the application (that is, only the authorization information fields necessary for the application to be carried out are authorized), thereby protecting the user's personal information. The trusted digital identity API displays the authorization information field, and the user can check the authorization information of the application, thereby protecting the user's control over the user's personal information obtained by the application. The application background obtains the identifier set and authorization information to realize the user's automatic registration and automatic login in the application, thereby improving the convenience of the user's use of the application and avoiding repeated operations by the user. Moreover, the generation of the identifier set has nothing to do with user information (such as ID number, mobile phone number, and license plate number, etc.), thereby avoiding the leakage of sensitive information of users and vehicles. In addition, in the entire authorization process, an asymmetric encryption and decryption algorithm is used for encryption and to check the validity of the authorization time, thereby achieving the security of the entire authorization process.

[0085] Based on the above embodiments, Figure 7 A flowchart of an application authorization login method provided by another embodiment of the present disclosure is applied to a target application and specifically includes the following steps: Figure 7 The following steps are shown:

[0086] S701. Generate an application authorization request in response to a trigger operation of a login identifier, and send the application authorization request to an identity authentication system. The identity authentication system is configured to use the current time of receiving the application authorization request as the authorization time, and control the target application to display the application authorization scope when determining that the digital certificate included in the application authorization request is valid.

[0087] It is understandable that the target user triggers the login identifier of the target application. The login identifier can be the startup identifier of the target application, that is, starting the application means automatically logging in, or it can also be the login identifier on the startup interface displayed after the target application is started. When the target user logs in for the first time or has not logged in for a long time, the application authorization login will be involved. In response to the triggering operation of the login identifier, the target application obtains the digital certificate to generate an application authorization request, and sends the application authorization request to the identity authentication system. Specifically, after the identity authentication interface receives the application authorization request, it uses the current time of the car as the authorization time, and checks the validity of the digital certificate through the identity authentication program. The specific implementation process refers to the above embodiment and will not be repeated here. Subsequently, the identity authentication interface displays the application authorization scope on the target application so that the target user can determine the authorization information by himself.

[0088] S702. In response to the confirmation operation of the target user who triggers the login identification on the application authorization scope, the target user's authorization information for the target application is obtained, and the authorization information is sent to the identity authentication system. The identity authentication system is used to use the application public key in the digital certificate to encrypt the trusted digital identity identifier, authorization time and authorization information assigned to the application authorization request, generate dynamic ciphertext, and return the dynamic ciphertext to the target application.

[0089] It can be understood that based on the above S701, the target application obtains the authorization information confirmed by the user and sends the authorization information to the identity authentication system. After receiving it, the identity authentication interface forwards it to the identity authentication program. The identity authentication program uses the application public key to encrypt and generate dynamic ciphertext. The specific implementation process of the identity authentication program refers to the above embodiment and will not be repeated here.

[0090] S703. Use dynamic ciphertext to initiate a login operation to the target background of the target application, so that the target background responds to the login operation, generates an authorization result request according to the dynamic ciphertext and the application identifier of the target application, and sends the authorization result request to the identity authentication system. The identity authentication system is used to use the application private key corresponding to the application identifier to decrypt and verify the dynamic ciphertext, and then generate an authorization result.

[0091] It is understandable that, based on the above S702, after the target application receives the dynamic ciphertext returned by the identity authentication interface, it uses the dynamic ciphertext to initiate a login to the target background. The target background responds to the login operation by calling the identity authentication platform's application authorization result acquisition interface to send the authorization result request generated based on the dynamic ciphertext and the application identifier to the identity authentication platform. The identity authentication platform uses the application private key to decrypt the dynamic ciphertext, and combines the application identifier and the trusted digital identity identifier to generate an identifier set according to certain rules, and then returns the identifier set and authorization information to the target background. The specific implementation process of the identity authentication platform refers to the above embodiment, which will not be repeated here.

[0092] S704: Receive a login result generated by the target background of the target application after completing the login based on the authorization result, and display a start interface if the login result is successful.

[0093] It can be understood that based on the above S703, the target background automatically registers and automatically logs in based on the identifier set and authorization information, and generates a login result. The target application receives the login result and displays the start interface of the target application when the login result is successful. The start interface refers to the main interface.

[0094] For example, see Figure 8 , Figure 8A schematic diagram of an interface for application authorization login provided in an embodiment of the present disclosure, wherein a user triggers a login identifier, and the login identifier is as follows: Figure 8 As shown in 801. When the vehicle-side application starts to log in, the vehicle-side application initiates an application authorization request to the trusted digital identity API through the digital certificate, and the trusted digital identity API initiates an authorization request to the SE. The trusted digital identity Applet in the SE checks the validity of the digital certificate, and then the trusted digital identity API pops up a window to prompt the authorization operation, as shown in Figure 8 The pop-up window in 802 shown in the figure displays "Real-name Information Authorization" and a prompt message prompting the user to log in and authorize. The user can check the authorization information. After agreeing to the authorization, the trusted digital identity API sends the authorization information to the trusted digital identity Applet to obtain the Enc-VSID, and then returns the dynamic ciphertext to the vehicle-side application. The vehicle-side application uses the Enc-VSID to initiate a login operation to the vehicle-side application background. The vehicle-side application background sends the Enc-VSID to the trusted digital identity platform to obtain the authorization result. After decryption and verification by the trusted digital identity platform, it derives the corresponding ID set for the vehicle-side application and returns the corresponding ID set and real-name authorization information for the vehicle-side application. The vehicle-side application background completes the user registration and login based on the returned ID set and authorization information, and then returns the login result to the game vehicle-side application. Figure 8 As shown in 803, when the login result is successful, the vehicle-side application displays the main interface and there is no need to perform real-name authentication again.

[0095] The application authorization login provided by the embodiment of the present disclosure realizes the user's automatic registration and automatic login in the application without any feeling, thereby improving the convenience of the user's use of the vehicle-side application and avoiding the user's repeated operations. In addition, the trusted digital identity API displays the information fields that require user authorization, and the user can check the authorization information of the application, thereby protecting the user's control over the user's personal data obtained by the application.

[0096] Fig. 9 Schematic diagram of the structure of the application authorization login device provided by the embodiment of the present disclosure. The application authorization login device provided by the embodiment of the present disclosure can execute the processing flow provided by the application authorization login method embodiment, such as Fig. 9 As shown, the application authorization login device 900 includes a first receiving unit 901, a first obtaining unit 902, an encryption unit 903, a second receiving unit 904 and a decryption unit 905, wherein:

[0097] The first receiving unit 901 is used to receive an application authorization request sent by a target application and use the current time as the authorization time. The application authorization request is generated by the target application in response to a triggering operation of a login identifier.

[0098] The first acquisition unit 902 is used to acquire authorization information of the target user triggering the login identification for the target application when it is determined that the digital certificate included in the application authorization request is valid;

[0099] The encryption unit 903 is used to encrypt the trusted digital identity identifier, authorization time and authorization information assigned to the application authorization request using the application public key in the digital certificate, generate dynamic ciphertext, and return the dynamic ciphertext to the target application;

[0100] The second receiving unit 904 is used to receive an authorization result request generated by a target background of a target application based on a login operation initiated by the target application, wherein the authorization result request includes a dynamic ciphertext and an application identifier of the target application;

[0101] The decryption unit 905 is used to use the application private key corresponding to the application identifier to decrypt and verify the dynamic ciphertext, generate an authorization result, and return the authorization result to the target background so that the target background completes the login based on the authorization result.

[0102] Among them, the identity authentication system includes an identity authentication interface and an identity authentication program.

[0103] Optionally, the first receiving unit 901 is used for:

[0104] receiving an application authorization request sent by a target application through an identity authentication interface, the application authorization request including a digital certificate of the target application;

[0105] Get the current time as the authorization time corresponding to the application authorization request;

[0106] The authorization time and the digital certificate are encapsulated into a data unit and sent to the identity authentication program so that the identity authentication program can verify the validity and legality of the digital certificate.

[0107] Among them, the identity authentication system also includes an identity authentication platform, and the digital certificate includes a certificate signature and a certificate validity period.

[0108] Optionally, the first acquiring unit 902 is used to:

[0109] Verify the signature of the certificate by using the platform public key of the identity authentication platform in the identity authentication procedure, check the validity of the certificate validity period, and generate a first check result for the digital certificate, the first check result is that the digital certificate is valid or invalid;

[0110] When the digital certificate is confirmed to be valid, a session identifier corresponding to the application authorization request is created and the session identifier is returned to the identity authentication interface;

[0111] In response to the session identifier, the authorization information field to be authorized to the target application is displayed to the target user who triggers the login identification through the identity authentication interface to obtain the authorization information authorized by the target user to the target application.

[0112] Optionally, the decryption unit 905:

[0113] Determine an application private key corresponding to the application identifier, wherein the application private key and the application public key are a public-private key pair of the target application;

[0114] Use the application private key to decrypt the dynamic ciphertext to obtain the trusted digital identity identifier, authorization time and authorization information;

[0115] Check the validity of the authorization time, and determine whether the authorization information is within the application authorization scope saved by the identity authentication platform included in the identity authentication system for the target application, and obtain a second check result for the authorization information, the second check result being a check pass or a check fail;

[0116] When the second check result is that the check is passed, an authorization result is generated according to the application identifier, the trusted digital identity identifier and the authorization information.

[0117] Optionally, the decryption unit 905:

[0118] Combine the application identifier and the trusted digital identity identifier, and generate an identifier set of the target application according to preset rules;

[0119] generating an authorization result according to the identifier set and the authorization information;

[0120] Among them, the identifier set includes a first identifier, a second identifier, a third identifier and a fourth identifier, the first identifier is a user identifier assigned by the identity authentication platform to the target application, the second identifier is a user identifier assigned by the identity authentication platform to the first application group where the target application is located, the third identifier is a device identifier assigned by the identity authentication platform to the target device running the target application, and the fourth identifier is a device identifier assigned by the identity authentication platform to the second application group where the target device is located.

[0121] Optionally, the application authorization login device 900 is further used for:

[0122] Receive an application registration request sent by a target background of a target application, where the application registration request includes application information and an application authorization scope of the target application;

[0123] If the application registration request is approved, determine the application identifier assigned to the target application;

[0124] A digital certificate for the target application is generated based on the application identifier and the application authorization scope, and the digital certificate is signed using the platform private key of the identity authentication platform, so that the target application performs user login based on the digital certificate, wherein the platform private key and the platform public key are the public-private key pair of the identity authentication platform.

[0125] Fig.10 The application authorization login device of the illustrated embodiment can be used to execute the technical solution of the above-mentioned method embodiment, and its implementation principle and technical effect are similar, which will not be repeated here.

[0126] Fig.10 This is a schematic diagram of the structure of an application authorization login device provided by another embodiment of the present disclosure. The application authorization login device provided by the embodiment of the present disclosure can execute the processing flow provided by the application authorization login method embodiment, such as Fig.10 As shown, the application authorization login device 100 includes a generating unit 1001, a second obtaining unit 1002, a sending unit 1003 and a third receiving unit 1004, wherein:

[0127] The generating unit 1001 is used to generate an application authorization request in response to a triggering operation of a login identifier, and send the application authorization request to an identity authentication system, the identity authentication system is used to use the current time of receiving the application authorization request as the authorization time, and control the target application to display the application authorization scope when determining that the digital certificate included in the application authorization request is valid;

[0128] The second acquisition unit 1002 is used to obtain the target user's authorization information for the target application in response to the target user's confirmation operation on the application authorization scope that triggers the login identification, and send the authorization information to the identity authentication system, the identity authentication system is used to use the application public key in the digital certificate to encrypt the trusted digital identity identifier assigned to the application authorization request, the authorization time and the authorization information, generate a dynamic ciphertext, and return the dynamic ciphertext to the target application;

[0129] The sending unit 1003 is used to initiate a login operation to the target background of the target application using the dynamic ciphertext, so that the target background generates an authorization result request according to the dynamic ciphertext and the application identifier of the target application in response to the login operation, and sends the authorization result request to the identity authentication system, and the identity authentication system is used to use the application private key corresponding to the application identifier to decrypt and verify the dynamic ciphertext and generate an authorization result;

[0130] The third receiving unit 1004 is used to receive a login result generated by the target background of the target application after completing the login based on the authorization result, and display a start interface if the login result is successful.

[0131] Fig.10The application authorization login device of the illustrated embodiment can be used to execute the technical solution of the above-mentioned method embodiment, and its implementation principle and technical effect are similar, which will not be repeated here.

[0132] Fig.11 This is a schematic diagram of the structure of an electronic device provided by an embodiment of the present disclosure. Fig.11 , which shows a schematic diagram of the structure of an electronic device 1100 suitable for implementing the embodiment of the present disclosure. The electronic device 1100 in the embodiment of the present disclosure may include, but is not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle terminals (such as vehicle navigation terminals), wearable electronic devices, etc., and fixed terminals such as digital TVs, desktop computers, smart home devices, etc. Fig.11 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0133] like Fig.11 As shown, the electronic device 1100 may include a processing device 1101 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1102 or a program loaded from a storage device 1108 to a random access memory (RAM) 1103 to implement the application authorization login method of the embodiment of the present disclosure. In the RAM 1103, various programs and data required for the operation of the electronic device 1100 are also stored. The processing device 1101, the ROM 1102, and the RAM 1103 are connected to each other via a bus 1104. An input / output (I / O) interface 1105 is also connected to the bus 1104.

[0134] Typically, the following devices may be connected to the I / O interface 1105: an input device 1106 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 11011 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 1108 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1109. The communication device 1109 may allow the electronic device 1100 to communicate with other devices wirelessly or by wire to exchange data. Although Fig.11 The electronic device 1100 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0135] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains a program code for executing the method shown in the flowchart, thereby implementing the above application authorization login method. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 1109, or installed from the storage device 1108, or installed from the ROM 1102. When the computer program is executed by the processing device 1101, the above functions defined in the method of the embodiment of the present disclosure are executed.

[0136] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0137] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0138] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0139] Optionally, when the above one or more programs are executed by the electronic device, the electronic device may also execute other steps of the above embodiments.

[0140] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0141] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0142] The units involved in the embodiments described in the present disclosure may be implemented by software or hardware, wherein the name of a unit does not, in some cases, limit the unit itself.

[0143] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0144] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0145] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or gateway that includes a series of elements includes not only those elements, but also other elements that are not explicitly listed, or also includes elements inherent to such process, method, article or gateway. In the absence of further restrictions, the elements defined by the sentence "comprises one..." do not exclude the presence of other identical elements in the process, method, article or gateway that includes the elements.

[0146] The above are only specific embodiments of the present disclosure, so that those skilled in the art can understand or implement the present disclosure. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure will not be limited to these embodiments herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An application authorization login method, characterized in that: Applied to an identity authentication system, the method comprises: receiving an application authorization request sent by a target application, and using the current time as the authorization time, wherein the application authorization request is generated by the target application in response to a triggering operation of a login identifier; When it is determined that the digital certificate included in the application authorization request is valid, obtaining authorization information of the target user who triggers the login identification for the target application; Using the application public key in the digital certificate, encrypting the trusted digital identity identifier assigned to the application authorization request, the authorization time, and the authorization information, generating a dynamic ciphertext, and returning the dynamic ciphertext to the target application; Receiving an authorization result request generated by a target background of the target application based on a login operation initiated by the target application, wherein the authorization result request includes the dynamic ciphertext and an application identifier of the target application; The dynamic ciphertext is decrypted and verified using the application private key corresponding to the application identifier, an authorization result is generated, and the authorization result is returned to the target background, so that the target background completes the login based on the authorization result.

2. The method according to claim 1, characterized in that The identity authentication system includes an identity authentication interface and an identity authentication program. The receiving application authorization request sent by the target application and using the current time as the authorization time includes: Receiving an application authorization request sent by a target application through the identity authentication interface, wherein the application authorization request includes a digital certificate of the target application; Obtaining the current time as the authorization time corresponding to the application authorization request; The authorization time and the digital certificate are packaged into a data unit form and sent to the identity authentication program so that the identity authentication program verifies the validity and legality of the digital certificate.

3. The method according to claim 2, characterized in that The identity authentication system further includes an identity authentication platform, the digital certificate includes a certificate signature and a certificate validity period, and when it is determined that the digital certificate included in the application authorization request is valid, obtaining authorization information of the target user who triggers the login identification for the target application includes: Verifying the signature of the certificate by using the platform public key of the identity authentication platform in the identity authentication procedure, and checking the validity of the validity period of the certificate, generating a first check result for the digital certificate, wherein the first check result is that the digital certificate is valid or the digital certificate is invalid; If it is determined that the digital certificate is valid, creating a session identifier corresponding to the application authorization request, and returning the session identifier to the identity authentication interface; In response to the session identifier, the authorization information field to be authorized to the target application is displayed to the target user who triggers the login identifier through the identity authentication interface, so as to obtain the authorization information authorized by the target user to the target application.

4. The method according to claim 1, characterized in that: The use of the application private key corresponding to the application identifier to decrypt and verify the dynamic ciphertext generates an authorization result, including: Determine an application private key corresponding to the application identifier, wherein the application private key and the application public key are a public-private key pair of the target application; Decrypting the dynamic ciphertext using the application private key to obtain the trusted digital identity identifier, the authorization time, and the authorization information; Checking the validity of the authorization time, and determining whether the authorization information is within the application authorization scope of the target application saved by the identity authentication platform included in the identity authentication system, and obtaining a second check result for the authorization information, wherein the second check result is a check pass or a check fail; When the second check result is that the check is passed, an authorization result is generated according to the application identifier, the trusted digital identity identifier and the authorization information.

5. The method according to claim 4, characterized in that The generating the authorization result according to the application identifier, the trusted digital identity identifier and the authorization information includes: Combining the application identifier and the trusted digital identity identifier, and generating an identifier set of the target application according to a preset rule; generating an authorization result according to the identifier set and the authorization information; Among them, the identifier set includes a first identifier, a second identifier, a third identifier and a fourth identifier, the first identifier is a user identifier assigned by the identity authentication platform to the target application, the second identifier is a user identifier assigned by the identity authentication platform to the first application group where the target application is located, the third identifier is a device identifier assigned by the identity authentication platform to the target device running the target application, and the fourth identifier is a device identifier assigned by the identity authentication platform to the second application group where the target device is located.

6. The method according to claim 3, characterized in that Before receiving the application authorization request sent by the target application, the method further includes: Receiving an application registration request sent by a target background of the target application, the application registration request including application information and application authorization scope of the target application; If the application registration request is approved, determining an application identifier assigned to the target application; A digital certificate for the target application is generated according to the application identifier and the application authorization scope, and the digital certificate is signed using the platform private key of the identity authentication platform, so that the target application performs user login based on the digital certificate, wherein the platform private key and the platform public key are the public-private key pair of the identity authentication platform.

7. An application authorization login method, characterized in that: Applied to the target application, the method comprises: generating an application authorization request in response to a trigger operation of the login identifier, and sending the application authorization request to the identity authentication system, wherein the identity authentication system uses the current time of receiving the application authorization request as the authorization time, and controls the target application to display the application authorization scope when determining that the digital certificate included in the application authorization request is valid; In response to a confirmation operation of the target user triggering the login identification on the application authorization scope, obtaining the target user's authorization information for the target application, and sending the authorization information to the identity authentication system, wherein the identity authentication system is used to use the application public key in the digital certificate to encrypt the trusted digital identity identifier assigned to the application authorization request, the authorization time and the authorization information, generate a dynamic ciphertext, and return the dynamic ciphertext to the target application; Initiate a login operation to the target background of the target application using the dynamic ciphertext, so that the target background generates an authorization result request according to the dynamic ciphertext and the application identifier of the target application in response to the login operation, and sends the authorization result request to the identity authentication system, wherein the identity authentication system is used to decrypt and verify the dynamic ciphertext using the application private key corresponding to the application identifier, and then generate an authorization result; A login result generated after the target background of the target application completes the login based on the authorization result is received, and a start interface is displayed if the login result is a successful login.

8. An application authorization login device, characterized in that: Applied to an identity authentication system, the device comprises: A first receiving unit, configured to receive an application authorization request sent by a target application and use the current time as the authorization time, wherein the application authorization request is generated by the target application in response to a triggering operation of a login identifier; A first acquisition unit is used to acquire authorization information of the target user who triggers the login identification for the target application when it is determined that the digital certificate included in the application authorization request is valid; an encryption unit, configured to encrypt the trusted digital identity identifier assigned to the application authorization request, the authorization time, and the authorization information using the application public key in the digital certificate, generate a dynamic ciphertext, and return the dynamic ciphertext to the target application; A second receiving unit, configured to receive an authorization result request generated by a target background of the target application based on a login operation initiated by the target application, wherein the authorization result request includes the dynamic ciphertext and an application identifier of the target application; The decryption unit is used to use the application private key corresponding to the application identifier to decrypt and verify the dynamic ciphertext, generate an authorization result, and return the authorization result to the target background so that the target background completes login based on the authorization result.

9. An application authorization login device, characterized in that: Applied to the target application, the device comprises: a generating unit, configured to generate an application authorization request in response to a triggering operation of a login identifier, and send the application authorization request to an identity authentication system, wherein the identity authentication system uses a current time of receiving the application authorization request as the authorization time, and controls the target application to display an application authorization scope when determining that the digital certificate included in the application authorization request is valid; A second acquisition unit is configured to, in response to a confirmation operation of the target user triggering the login identification on the application authorization scope, acquire the authorization information of the target user for the target application, and send the authorization information to the identity authentication system, wherein the identity authentication system is configured to use the application public key in the digital certificate to encrypt the trusted digital identity identifier assigned to the application authorization request, the authorization time, and the authorization information, generate a dynamic ciphertext, and return the dynamic ciphertext to the target application; A sending unit, configured to use the dynamic ciphertext to initiate a login operation to a target background of the target application, so that the target background generates an authorization result request according to the dynamic ciphertext and an application identifier of the target application in response to the login operation, and sends the authorization result request to the identity authentication system, wherein the identity authentication system is configured to use an application private key corresponding to the application identifier to decrypt and verify the dynamic ciphertext and generate an authorization result; The third receiving unit is used to receive a login result generated by the target background of the target application after completing the login based on the authorization result, and display a start interface when the login result is a successful login.

10. An electronic device, characterized in that: include: Memory; processor; as well as Computer programs; The computer program is stored in the memory and is configured to be executed by the processor to implement the application authorization login method as described in any one of claims 1 to 7.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the application authorization login method as described in any one of claims 1 to 7 are implemented.

Images