Multi-system login method and device, storage medium and program product

Abstract

The embodiment of the invention provides a multi-system login method and device, a storage medium and a program product, and relates to the technical field of security authentication. The method comprises the steps of receiving a token sent by a server in response to successful passing of identity verification of a digital portal, displaying system entrances of a plurality of systems associated with the digital portal, and responding to a touch operation for a system entrance of a target system in the system entrances of the plurality of systems, determining a system verification level of the target system according to the permission identifier, if the system verification level of the target system is a first system level, logging in a preset page of the target system, and if the system verification level of the target system is a second system level, logging in a preset page of the target system; if yes, first system verification information input by the user based on verification prompt information corresponding to the second system level is verified, and if verification succeeds, a preset page of the target system is logged in. According to the method provided by the embodiment of the invention, the convenience and security of multi-system login are improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of distributed technology, and in particular to a multi-system login method, device, storage medium, and program product. Background Art

[0002] With the development of Internet technology, enterprises may establish multiple systems to provide different services to users.

[0003] In the related art, multiple systems are independent of each other, and users can log in and access the corresponding system based on the account number and password corresponding to the system.

[0004] However, in the process of implementing this application, the inventors found that there are at least the following problems in the prior art: in the above method, users need to remember multiple sets of account passwords, which causes inconvenience when they need to log in to multiple systems. Summary of the invention

[0005] The embodiments of the present application provide a multi-system login method, device, storage medium and program product to improve the convenience and security of multi-system login.

[0006] In a first aspect, an embodiment of the present application provides a multi-system login method, which is applied to a terminal device, and the method includes:

[0007] In response to successfully passing the identity authentication of the digital portal, a token sent by the receiving server is displayed, and the system entrances of multiple systems associated with the digital portal are displayed; the token includes an authority identifier;

[0008] In response to a touch operation on a system entry of a target system among the system entries of the multiple systems, determining a system verification level of the target system according to the authority identifier;

[0009] If the system verification level of the target system is the first system level, logging into a preset page of the target system;

[0010] If the system verification level of the target system is the second system level, verification prompt information corresponding to the second system level is generated; the first system verification information input by the user based on the verification prompt information corresponding to the second system level is verified, and if the verification is successful, the user logs in to the preset page of the target system.

[0011] In a possible design, the verification prompt information includes at least one of the following: inserting an online banking shield, entering a text message verification code, performing fingerprint verification, performing voiceprint verification, and performing face verification.

[0012] In a possible design, before the response to successfully logging into the digital portal, the process further includes:

[0013] Display the login page of the digital portal;

[0014] In response to a login operation on the login page, the portal login account and password corresponding to the login operation are obtained, and the portal login account and password are sent to a server so that the server verifies the portal login account and password. If the verification passes, a token is generated and sent to the terminal device.

[0015] In a possible design, before determining the system verification level of the target system according to the authority identifier, the method further includes:

[0016] Decrypt the token to obtain a timestamp of when the token was generated and the validity period of the token;

[0017] Determine whether the token is valid according to the timestamp of generating the token and the validity period of the token;

[0018] If valid, the system verification level of the target system is determined according to the authority identifier.

[0019] In one possible design, the method further includes:

[0020] Based on the preset period, the refresh interface is actively called to obtain a new valid token from the server.

[0021] In a possible design, the preset page for logging into the target system includes:

[0022] Determining a function display level of the target system according to the permission identifier;

[0023] The preset page of the target system is logged in, and the preset page of the target system displays function entrances of multiple function modules matching the function display level.

[0024] In a possible design, after logging into the preset page of the target system, the method further includes:

[0025] In response to a touch operation on a function entry of a target function module among the function entries of the plurality of function modules in the preset page, logging into the function module;

[0026] In response to executing the business function provided by the functional module, determining the function verification level of the target functional module according to the authority identifier;

[0027] If the function verification level of the target function is the first function level, generating verification prompt information corresponding to the first function level; verifying the first function verification information input by the user based on the verification prompt information corresponding to the first function level, and if the verification is successful, completing the execution of the business function;

[0028] If the system verification level of the target system is the second functional level, generating verification prompt information corresponding to the second functional level; verifying the second functional verification information input by the user based on the verification prompt information corresponding to the second functional level, and if the verification is successful, completing the execution of the business function;

[0029] The security of the second function verification information is greater than that of the first function verification information.

[0030] In a second aspect, an embodiment of the present application provides a multi-system login method, which is applied to a server, and the method includes:

[0031] Receiving the portal login account and password of the digital portal sent by the terminal device;

[0032] Verifying the portal login account and password;

[0033] If the verification is successful, a token is generated according to the unique user identifier corresponding to the portal login account; the token includes an authority identifier; the authority identifier is used to indicate the corresponding system verification level; different system verification levels correspond to different verification complexities;

[0034] The token is sent to the terminal device.

[0035] In a possible design, generating a token according to the unique user identifier corresponding to the portal login account includes:

[0036] Combine the user unique identifier and the authority identifier corresponding to the portal login account into a JSON object or string to obtain the token original data;

[0037] The original data is encrypted based on a preset key, and a token is generated according to the encrypted original data.

[0038] In a possible design, generating a token according to the unique user identifier corresponding to the portal login account includes:

[0039] Record the timestamp of generating the token;

[0040] A token is generated according to a timestamp, a preset validity period, and a unique user identifier corresponding to the portal login account.

[0041] In a possible design, after generating a token according to the timestamp, the preset validity period, and the unique user identifier corresponding to the portal login account, the process further includes:

[0042] If the remaining validity time of the token is less than or equal to the preset duration, a new token is automatically generated.

[0043] In a third aspect, an embodiment of the present application provides a terminal device, including:

[0044] A display module, for receiving a token sent by a server in response to successfully passing the identity authentication of the digital portal, and displaying system entrances of multiple systems associated with the digital portal; the token includes an authority identifier;

[0045] a determination module, configured to determine, in response to a touch operation on a system entry of a target system among the system entries of the multiple systems, a system verification level of the target system according to the authority identifier;

[0046] A login module, configured to log in to a preset page of the target system if the system verification level of the target system is the first system level;

[0047] The login module is also used to generate verification prompt information corresponding to the second system level if the system verification level of the target system is the second system level; verify the first system verification information input by the user based on the verification prompt information corresponding to the second system level, and if the verification is successful, log in to the preset page of the target system.

[0048] In a fourth aspect, an embodiment of the present application provides a server, including:

[0049] A receiving module, used for receiving a portal login account and password of a digital portal sent by a terminal device;

[0050] A verification module, used to verify the portal login account and password;

[0051] A generation module, for generating a token according to the unique user identifier corresponding to the portal login account if the verification is passed; the token includes an authority identifier; the authority identifier is used to indicate the corresponding system verification level; different system verification levels correspond to different verification complexities;

[0052] A sending module is used to send the token to the terminal device.

[0053] In a fifth aspect, an embodiment of the present application provides an electronic device, including: at least one processor and a memory;

[0054] The memory stores computer-executable instructions;

[0055] The at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor executes the method described in the first aspect and various possible designs of the first aspect.

[0056] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the method described in the first aspect and various possible designs of the first aspect are implemented.

[0057] In a seventh aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the method described in the first aspect and various possible designs of the first aspect.

[0058] The multi-system login method, device, storage medium and program product provided in this embodiment include receiving a token sent by a server in response to successfully passing the identity authentication of a digital portal, displaying the system entrances of multiple systems associated with the digital portal, the token including an authority identifier, and in response to a touch operation on the system entrance of a target system among the system entrances of multiple systems, determining the system verification level of the target system according to the authority identifier, if the system verification level of the target system is the first system level, logging into the preset page of the target system, if the system verification level of the target system is the second system level, generating verification prompt information corresponding to the second system level, verifying the first system verification information input by the user based on the verification prompt information corresponding to the second system level, and if the verification is successful, logging into the preset page of the target system. The method provided in this embodiment sets up a digital portal, and after successfully passing the identity authentication for the digital portal, generates a token to log in to each system in the digital portal based on the token, and the authority identifier is embedded when the token is generated, and based on the authority identifier, different systems can be logged in through verifications of different complexity, so as to achieve refined management of risk levels for different systems, eliminate security risks, and improve the convenience and security of multi-system login. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0060] Figure 1 A schematic diagram of a scenario of a multi-system login method provided in an embodiment of the present application;

[0061] Figure 2Schematic diagram of the process of the multi-system login method provided in the embodiment of the present application Figure 1 ;

[0062] Figure 3 Schematic diagram of the process of the multi-system login method provided in the embodiment of the present application Figure 2 ;

[0063] Figure 4 An interactive schematic diagram of a multi-system login method provided in an embodiment of the present application;

[0064] Figure 5 A schematic diagram of the structure of a terminal device provided in an embodiment of the present application;

[0065] Figure 6 A schematic diagram of the structure of a server provided in an embodiment of the present application;

[0066] Figure 7 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0067] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0068] In the technical solution of this application, the collection, storage, use, processing, transmission, provision and disclosure of information such as financial data or user data involved shall comply with the provisions of relevant laws and regulations and shall not violate public order and good morals.

[0069] It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, and they should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0070] Currently, the corporate banking business involves multiple systems and platforms, such as online banking with functions such as transfer transactions, and systems for querying information. Since the login and authentication mechanisms of these systems are different, users need to remember and enter different account passwords separately, which causes inconvenience. In addition, the security control mechanisms between different systems are inconsistent, which increases security risks.

[0071] In order to solve the above problems and improve user experience and system security, the inventors of the present application have discovered that the system entrances of multiple systems can be integrated by setting up a digital portal, and then a unique token corresponding to the user is generated after the user logs in to the digital portal, and then the system entrances of each system can be logged in based on the token. In order to further refine the management of the risk levels of different systems, the user's authority level information can be added when generating the token, so that when logging in to each system according to the token, the corresponding level verification can be performed based on the authority level information contained in the token, ensuring that systems with different risk levels are protected to varying degrees and eliminating security risks.

[0072] Figure 1 Schematic diagram of a scenario of a multi-system login method provided in an embodiment of the present application. Figure 1 As shown, the terminal device 101 is in communication connection with the server 102. The terminal device 101 can be a mobile phone, a tablet computer, a computer or other devices, and the server 102 can be a cluster server or a cloud server.

[0073] In the specific implementation process, the terminal device 101 is installed with a digital portal. The terminal device 101 receives verification information for the digital portal input by the user, and sends the verification information to the server 102 for identity authentication. After the verification is passed, the server 102 generates a token and sends the token to the terminal device 101. The terminal device 101 receives the token sent by the server and displays the system entrances of multiple systems associated with the digital portal. The token includes an authority identifier. In response to a touch operation on a system entrance of a target system among the system entrances of the multiple systems, the system verification level of the target system is determined according to the authority identifier. If the system verification level of the target system is the first system level, the preset page of the target system is logged in. If the system verification level of the target system is the second system level, verification prompt information corresponding to the second system level is generated, and the first system verification information input by the user based on the verification prompt information corresponding to the second system level is verified. If the verification is successful, the preset page of the target system is logged in. The multi-system login method provided in the embodiment of the present application sets up a digital portal, and after successfully passing the identity authentication for the digital portal, generates a token to log in to each system in the digital portal based on the token. In addition, an authority identifier is embedded when the token is generated. Based on the authority identifier, different systems can be logged in through verifications of different complexities, thereby achieving refined management of risk levels for different systems and eliminating security risks.

[0074] It should be noted that Figure 1The scenario diagram shown is only an example. The multi-system login method and scenario described in the embodiment of the present application are intended to more clearly illustrate the technical solution of the embodiment of the present application, and do not constitute a limitation on the technical solution provided in the embodiment of the present application. Ordinary technicians in this field can know that with the evolution of the system and the emergence of new business scenarios, the technical solution provided in the embodiment of the present application is also applicable to similar technical problems.

[0075] The technical solution of the present application is described in detail with specific embodiments below. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0076] Figure 2 Schematic diagram of the process of the multi-system login method provided in the embodiment of the present application Figure 1 .like Figure 2 As shown, the method is applied to a terminal device and specifically includes:

[0077] 201. In response to successfully passing the identity authentication of the digital portal, a token sent by a receiving server is received, and system entrances of multiple systems associated with the digital portal are displayed; the token includes an authority identifier.

[0078] Specifically, enterprises usually have multiple systems to provide different services to users. In order to facilitate user operation, this embodiment integrates multiple channel entrances such as corporate online banking and consulting platforms to build a unified digital portal, so that users can access all systems after obtaining a unique token, simplifying the login process. When logging in to the digital portal, the user can enter the account and password of the digital portal into the terminal device to verify the user's identity. When the verification is passed, a token unique to the user can be obtained for logging in to each system integrated by the digital portal. In addition, different systems have different risk levels. Therefore, by adding permission identifiers when generating tokens, refined management of access rights and security levels of each system can be achieved to eliminate security risks and avoid financial losses or information leaks.

[0079] In some embodiments, the response before successfully logging into the digital portal also includes: displaying the login page of the digital portal; in response to a login operation on the login page, obtaining the portal login account and password corresponding to the login operation, and sending the portal login account and password to a server so that the server verifies the portal login account and password. If the verification passes, a token is generated and the token is sent to the terminal device.

[0080] Specifically, the terminal device is installed with the digital portal application. After the application is opened, a login page can be displayed. The login page may include an input box for the account and password. After the terminal device receives the portal login account and password and other verification information entered by the user, the terminal device sends the verification information to the server for authentication. After the authentication is successful, the server generates a token, and then can send the token to the terminal device, so that the terminal device can log in to multiple systems associated with the digital portal based on the token.

[0081] The multi-system login method provided in this embodiment can uniformly manage users based on the digital portal by using account and password verification to log in to the digital portal. After the login, the subsequent login of each system can be carried out by automatically identifying the token generated after the verification is passed, which has good confidentiality and improves the convenience of login.

[0082] 202. In response to a touch operation on a system entry of a target system among the system entries of the multiple systems, determine a system verification level of the target system according to the permission identifier.

[0083] Specifically, after successful verification, the system entrances of multiple systems are displayed on the page, and a touch operation (such as click, long press, etc.) on one of the system entrances is received, and the token can be automatically identified, and the system corresponding to the system entrance is logged in according to the token. In order to carry out risk management, during the automatic identification of the token, the authority identifier can be extracted, and the system verification level indicated by the authority identifier can be determined, and then the degree of verification required for the user to log in to the system to be logged in can be determined.

[0084] In some embodiments, in order to further improve security, the token can be encrypted to prevent the token from being tampered with. Specifically, before determining the system verification level of the target system according to the permission identifier, it can also include: decrypting the token to obtain the timestamp of generating the token and the validity period of the token; determining whether the token is valid according to the timestamp of generating the token and the validity period of the token; if valid, determining the system verification level of the target system according to the permission identifier.

[0085] Specifically, after the user passes the identity authentication, the authentication server can generate a token based on the user's unique identifier (such as user ID), permission identifier (such as role, permission level), device information and other context information. When generating a token, the system can embed the user's permission information (such as user role, permission level, and accessible resources) into the token so that it can be directly used for permission verification later. Symmetric encryption (such as AES) or asymmetric encryption (such as RSA) algorithms can also be used to encrypt the token content to ensure its security and tamper resistance.

[0086] In the specific implementation process, the original data is first generated: the user's ID, permission identifier, device information, etc. are combined into a JSON object or string. Secondly, encryption processing is performed: the original data is encrypted using a preset key. Finally, the token is output: the encrypted data is converted into a token and returned to the client.

[0087] In some embodiments, in order to ensure the continuous security of the system and the convenience of users, the token Token may have a certain validity period and an automatic update mechanism. Specifically, based on a preset period, the refresh interface is actively called to obtain a new valid token from the server.

[0088] 203. If the system verification level of the target system is the first system level, log in to a preset page of the target system.

[0089] 204. If the system verification level of the target system is the second system level, generate verification prompt information corresponding to the second system level; verify the first system verification information input by the user based on the verification prompt information corresponding to the second system level, and if the verification is successful, log in to the preset page of the target system.

[0090] Specifically, system-level security management and control can be subdivided for multiple systems. Different role permissions can be set for different systems. For example, for financial function systems: it can be set as the highest security level role. When users access these systems, they need to pass the dual verification of online banking shield and SMS verification code to ensure the authenticity of the user's identity and the legality of the operation. The specific implementation method may include: after the user logs in to the digital portal, he chooses to access the corporate online banking. The system prompts the user to insert the online banking shield and enter the SMS verification code. After the verification is successful, the user can perform high-risk operations, such as fund transfers. For information systems: it can be set as a lower security level role. Users only need to perform basic login verification, and no additional security verification measures are required. The specific implementation method includes: after the user logs in to the digital portal, he chooses to access Feizhi E-News. The system directly allows access without additional verification.

[0091] In some embodiments, in order to ensure security, the number of verification failures may be limited. After verifying the verification information input by the user based on the verification prompt information corresponding to the second system level, it may also include: if the verification fails, updating the total number of failures; the total number of failures is the sum of the number of verification failures performed by logging into multiple systems after successfully logging into the digital portal; if the total number of failures is greater than a preset value, logging out of the digital portal.

[0092] In some embodiments, the method may further include: if the system verification level of the target system is the third system level, generating verification prompt information corresponding to the third system level; verifying the second system verification information input by the user based on the verification prompt information corresponding to the third system level, and if the verification is successful, logging in to the preset page of the target system; the security of the second system verification information is greater than that of the first system verification information.

[0093] In some embodiments, the verification prompt information includes at least one of the following: inserting an online banking shield, entering a text message verification code, performing fingerprint verification, performing voiceprint verification, and performing face verification.

[0094] Specifically, different system levels can perform verifications of different complexity. For example, verification types can be superimposed, and the more superimposed, the higher the complexity. For example, the complexity from low to high can be, using verification to log in directly, requiring online banking shield and SMS verification code, requiring online banking shield, SMS verification and fingerprint verification, etc.

[0095] In some embodiments, in order to manage the risk level of the functional modules in detail, different functional modules can be displayed for different users. Specifically, the preset page for logging into the target system may include: determining the function display level of the target system according to the permission identifier; logging into the preset page of the target system, wherein the preset page of the target system displays the function entrances of multiple functional modules matching the function display level.

[0096] In some embodiments, in order to manage the risk level of the functional module in detail, the verification level of different functional modules can be set for different users. Specifically, after logging into the preset page of the target system, it also includes: in response to the touch operation of the function entry of the target functional module among the function entries of the multiple functional modules in the preset page, logging into the functional module; in response to executing the business function provided by the functional module, determining the function verification level of the target functional module according to the permission identifier; if the function verification level of the target function is the first function level, generating the verification prompt information corresponding to the first function level; verifying the first function verification information input by the user based on the verification prompt information corresponding to the first function level, if the verification is successful, the business function is executed; if the system verification level of the target system is the second function level, generating the verification prompt information corresponding to the second function level; verifying the second function verification information input by the user based on the verification prompt information corresponding to the second function level, if the verification is successful, the business function is executed; the security of the second function verification information is greater than the first function verification information.

[0097] Specifically, within the system, different functions are graded and processed according to their risk levels: For low-risk functions, such as user-generated account transactions in corporate online banking, users only need to verify SMS or password to complete the operation. Specific implementation methods include: the user chooses to perform a personal account operation; the system prompts the user to enter the SMS verification code or password; after successful verification, the user completes the operation. For high-risk functions, such as fund transactions with others in corporate online banking, users not only need to verify SMS or password, but also need to perform secondary verification through online banking shield to ensure transaction security. Specific implementation methods include: the user chooses to perform fund transactions with others. The system prompts the user to insert the online banking shield and enter the SMS verification code or password. After successful verification, the user completes the transaction.

[0098] In this embodiment, the system security is effectively improved through the system-level and function-level security hierarchical control mechanism to meet the security requirements of different risk operations. The access rights and security verification methods of different systems and functions are carefully designed to ensure the security of operations.

[0099] From the above description, it can be seen that the multi-system login method provided in the embodiment of the present application sets up a digital portal, and after successfully passing the identity authentication for the digital portal, generates a token to log in to each system in the digital portal based on the token, and an authority identifier is embedded when the token is generated. Based on the authority identifier, different systems can be logged in through verifications of different complexities, thereby achieving refined management of risk levels for different systems and eliminating security risks. A unified security management and control mechanism ensures security consistency between systems and reduces potential security risks. Strict verification methods and authority settings ensure that high-risk operations are fully protected and reduce the possibility of financial losses and information leaks.

[0100] Figure 3 Schematic diagram of the process of the multi-system login method provided in the embodiment of the present application Figure 2 .like Figure 3 As shown, the method includes:

[0101] 301. Receive a portal login account and password of a digital portal sent by a terminal device.

[0102] 302. Verify the portal login account and password.

[0103] 303. If the verification is successful, a token is generated according to the unique user identifier corresponding to the portal login account; the token includes an authority identifier; the authority identifier is used to indicate the corresponding system verification level; different system verification levels correspond to different verification complexities.

[0104] 304. Send the token to the terminal device.

[0105] Specifically, during the process of logging into the digital portal, the terminal device receives the portal login account and password entered by the user for the digital portal, and sends the account and password to the server for verification. After the verification is passed, the server generates a token based on the user's unique identifier (such as the portal login account), and embeds the permission identifier in the token generation process to perform refined permission management based on the token when logging into each system. In this embodiment, the user only needs to log in once in the digital portal to obtain a unique token Token to access all systems, which improves the user experience and reduces the tedious operation of repeated logins.

[0106] In some embodiments, in order to further improve security, the token can be encrypted to prevent the token from being tampered with. Generating a token according to the user unique identifier corresponding to the portal login account may include: combining the user unique identifier and the authority identifier corresponding to the portal login account into a JSON object or string to obtain the original data of the token; encrypting the original data based on a preset key, and generating a token according to the encrypted original data.

[0107] Specifically, after the user passes the identity authentication, the authentication server can generate a token based on the user's unique identifier (such as user ID), permission identifier (such as role, permission level), device information and other context information. When generating a token, the system can embed the user's permission information (such as user role, permission level, and accessible resources) into the token so that it can be directly used for permission verification later. Symmetric encryption (such as AES) or asymmetric encryption (such as RSA) algorithms can also be used to encrypt the token content to ensure its security and tamper resistance.

[0108] In the specific implementation process, the original data is first generated: the user's ID, permission identifier, device information, etc. are combined into a JSON object or string. Secondly, encryption processing is performed: the original data is encrypted using a preset key. Finally, the token is output: the encrypted data is converted into a token and returned to the client.

[0109] In some embodiments, in order to ensure the continuous security of the system and the convenient use of the user, the token Token may have a certain validity period. The generating of the token according to the user unique identifier corresponding to the portal login account includes: recording the timestamp of generating the token; generating the token according to the timestamp, the preset validity period and the user unique identifier corresponding to the portal login account.

[0110] In some embodiments, in order to ensure the validity of the token, an automatic update mechanism for the token can be set. Specifically, after the token is generated according to the timestamp, the preset validity period and the user unique identifier corresponding to the portal login account, it also includes: if the remaining validity time of the token is less than or equal to the preset period, a new token is automatically generated.

[0111] Specifically, you can set a validity period. The token is valid from the time it is generated. If it exceeds the validity period, it will be considered invalid. The system can configure the "auto-renewal" or "manual refresh" function of the token to update the validity period when the token is about to expire or is refreshed.

[0112] Exemplarily, the server adds a valid duration field (such as 30 minutes) when the token is generated, and records the timestamp of the token generation in the token. When the token is generated, the valid duration field is added, for example, the valid period is 30 minutes. The valid duration can be checked by checking the timestamp after decrypting the token to determine whether it has expired. When the token is about to expire, the system can provide a refresh mechanism to generate a new token to continue the user's session.

[0113] During the validation of the token, when the system in the terminal device receives a request containing a token, it extracts user information, permission identification, validity period and other information from the token to perform permission verification and expiration check. The system checks whether the user has the permission to perform the requested operation based on the parsed permission identification. During the verification process, the system checks the timestamp and validity period fields of the token to ensure that the token is used within the validity period. Exemplarily, the terminal device decrypts the token, extracts permission information and validity period; verifies whether the permission information meets the permission requirements of the requested operation; checks whether the validity period has expired. If the token has expired, access is denied and a re-login prompt is prompted.

[0114] After setting the validity period of the token to ensure security, a re-issuance mechanism is used to ensure the continued validity of the token: one method is automatic renewal: the system can automatically renew the token within a specific time window before the token expires, for example, a new token is generated and returned to the client within the last 10 minutes. Another method is active refresh: the client can request a refresh token to ensure the continuity of the session. When refreshing the token, the system will regenerate the token and update the validity period.

[0115] Specifically, when the token is about to expire (e.g. within 10 minutes), the system automatically generates a new token and updates the validity period. The client can actively call the refresh interface to obtain a new valid token.

[0116] In summary, token generation: Generate a token based on the user ID and permission identifier, ensure that the permission information is embedded in it, and encrypt it to ensure security. Expiration mechanism: Set the validity period when the token is generated, and support automatic renewal or active refresh mechanism to ensure the continuity of the session. Validity verification: When receiving a request, the system obtains permission information and validity period by decrypting the token, performs permission verification and expiration check, and ensures the validity of the token. Re-issuance: The system supports the re-issuance mechanism of tokens to deal with token expiration and invalidation.

[0117] The multi-system login method provided in this embodiment generates a token after successfully passing the identity authentication for the digital portal, so as to log in to each system in the digital portal based on the token. In addition, an authority identifier is embedded when generating the token. Based on the authority identifier, different systems can be logged in through verifications of different complexities, thereby achieving refined management of risk levels for different systems and eliminating security risks.

[0118] Figure 4 This is an interactive diagram of the multi-system login method provided in the embodiment of the present application. Figure 4 As shown, the method includes:

[0119] 401. The terminal device displays the login page of the digital portal.

[0120] 402. The terminal device receives a touch operation of the user on the login page.

[0121] 403. The terminal device sends the portal login account and password for the digital portal corresponding to the touch operation to the server.

[0122] 404. The server verifies the portal login account and password.

[0123] 405. If the verification is successful, the server generates a token according to the unique user identifier corresponding to the portal login account; the token includes an authority identifier; the authority identifier is used to indicate the corresponding system verification level; different system verification levels correspond to different verification complexities.

[0124] 406. The server sends the token to the terminal device.

[0125] 407. In response to successfully passing the identity authentication of the digital portal, the terminal device receives a token sent by the server and displays system entrances of multiple systems associated with the digital portal; the token includes an authority identifier.

[0126] 408. In response to a touch operation on a system entry of a target system among the system entries of the multiple systems, determine a system verification level of the target system according to the permission identifier.

[0127] 409. If the system verification level of the target system is the first system level, log in to a preset page of the target system.

[0128] 410. If the system verification level of the target system is the second system level, generate verification prompt information corresponding to the second system level; verify the first system verification information input by the user based on the verification prompt information corresponding to the second system level, and if the verification is successful, log in to the preset page of the target system.

[0129] The multi-system login method provided in this embodiment sets up a digital portal, and after successfully passing the identity authentication for the digital portal, generates a token to log in to each system in the digital portal based on the token. In addition, an authority identifier is embedded when generating the token. Based on the authority identifier, different systems can be logged in through verifications of different complexities, thereby achieving refined management of risk levels for different systems and eliminating security risks.

[0130] Figure 5 This is a schematic diagram of the structure of the terminal device provided in the embodiment of the present application. Figure 5 As shown, the terminal device 50 includes: a display module 501 , a determination module 502 and a login module 503 .

[0131] The display module 501 is used to receive a token sent by a server in response to successfully passing the identity authentication of the digital portal, and display the system entrances of multiple systems associated with the digital portal; the token includes an authority identifier.

[0132] The determination module 502 is configured to determine, in response to a touch operation on a system entry of a target system among the system entries of the multiple systems, a system verification level of the target system according to the permission identifier.

[0133] The login module 503 is configured to log in to a preset page of the target system if the system verification level of the target system is the first system level.

[0134] The login module 503 is also used to generate verification prompt information corresponding to the second system level if the system verification level of the target system is the second system level; verify the first system verification information input by the user based on the verification prompt information corresponding to the second system level, and if the verification is successful, log in to the preset page of the target system.

[0135] The service network initiating device provided in the embodiment of the present application sets up a digital portal, and after successfully passing the identity authentication for the digital portal, generates a token to log in to each system in the digital portal based on the token. In addition, an authority identifier is embedded when the token is generated. Based on the authority identifier, different systems can be logged in through verifications of different complexities, thereby achieving refined management of risk levels for different systems and eliminating security risks.

[0136] In some embodiments, the verification prompt information includes at least one of the following: inserting an online banking shield, entering a text message verification code, performing fingerprint verification, performing voiceprint verification, and performing face verification.

[0137] In some embodiments, the display module 501 is also used to display a login page of the digital portal;

[0138] In response to a login operation on the login page, the portal login account and password corresponding to the login operation are obtained, and the portal login account and password are sent to a server so that the server verifies the portal login account and password. If the verification passes, a token is generated and sent to the terminal device.

[0139] In some embodiments, the determination module 502 is specifically used to: decrypt the token to obtain the timestamp of generating the token and the validity period of the token; determine whether the token is valid based on the timestamp of generating the token and the validity period of the token; if valid, determine the system verification level of the target system based on the authority identifier.

[0140] In some embodiments, the login module 503 is further used to: actively call a refresh interface based on a preset period to obtain a new valid token from the server.

[0141] In some embodiments, the login module 503 is specifically used to: determine the function display level of the target system according to the permission identifier; log in to the preset page of the target system, and the preset page of the target system displays the function entrances of multiple function modules matching the function display level.

[0142] In some embodiments, the login module 503 is also used to: log in to the function module in response to a touch operation on a function entry of a target function module among the function entries of multiple function modules in the preset page; determine the function verification level of the target function module according to the permission identifier in response to executing the business function provided by the function module; if the function verification level of the target function is the first function level, generate verification prompt information corresponding to the first function level; verify the first function verification information input by the user based on the verification prompt information corresponding to the first function level, and if the verification is successful, complete the execution of the business function; if the system verification level of the target system is the second function level, generate verification prompt information corresponding to the second function level; verify the second function verification information input by the user based on the verification prompt information corresponding to the second function level, and if the verification is successful, complete the execution of the business function; the security of the second function verification information is greater than that of the first function verification information.

[0143] The terminal device provided in the embodiment of the present application can be used to execute the above-mentioned method embodiment with the terminal device as the execution subject. Its implementation principle and technical effects are similar, and this embodiment will not be repeated here.

[0144] Figure 6 This is a schematic diagram of the structure of the server provided in the embodiment of the present application. Figure 6As shown, the server 60 includes: a receiving module 601, a verification module 602, a generation module 603 and a sending module 604.

[0145] The receiving module 601 is used to receive the portal login account and password of the digital portal sent by the terminal device.

[0146] The verification module 602 is used to verify the portal login account and password.

[0147] The generation module 603 is used to generate a token according to the user unique identifier corresponding to the portal login account if the verification is passed; the token includes an authority identifier; the authority identifier is used to indicate the corresponding system verification level; different system verification levels correspond to different verification complexities.

[0148] The sending module 604 is used to send the token to the terminal device.

[0149] The service network initiating device provided in the embodiment of the present application sets up a digital portal, and after successfully passing the identity authentication for the digital portal, generates a token to log in to each system in the digital portal based on the token. In addition, an authority identifier is embedded when the token is generated. Based on the authority identifier, different systems can be logged in through verifications of different complexities, thereby achieving refined management of risk levels for different systems and eliminating security risks.

[0150] In some embodiments, the generation module 603 is specifically used to: combine the user unique identifier and the authority identifier corresponding to the portal login account into a JSON object or string to obtain the token original data; encrypt the original data based on a preset key, and generate a token based on the encrypted original data.

[0151] In some embodiments, the generation module 603 is specifically used to: record the timestamp of generating the token; and generate the token according to the timestamp, the preset validity period, and the user unique identifier corresponding to the portal login account.

[0152] In some embodiments, the generation module 603 is further used to automatically generate a new token if the remaining validity time of the token is less than or equal to a preset duration.

[0153] The server provided in the embodiment of the present application can be used to execute the above-mentioned method embodiment with the server as the execution subject. Its implementation principle and technical effects are similar, and this embodiment will not be repeated here.

[0154] Figure 7 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application, which device may be a computer, a tablet device, a server, etc.

[0155] The device 70 may include one or more of the following components: a processing component 701 , a memory 702 , a power component 703 , a multimedia component 704 , an audio component 705 , an input / output (I / O) interface 706 , a sensor component 707 , and a communication component 708 .

[0156] The processing component 701 generally controls the overall operation of the device 70, such as operations associated with display, phone calls, data communications, camera operations, and recording operations. The processing component 701 may include one or more processors 709 to execute instructions to complete all or part of the steps of the above-mentioned method. In addition, the processing component 701 may include one or more modules to facilitate the interaction between the processing component 701 and other components. For example, the processing component 701 may include a multimedia module to facilitate the interaction between the multimedia component 704 and the processing component 701.

[0157] The memory 702 is configured to store various types of data to support operations on the device 70. Examples of such data include instructions for any application or method operating on the device 70, contact data, phone book data, messages, pictures, videos, etc. The memory 702 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0158] The power supply component 703 provides power to the various components of the device 70. The power supply component 703 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the device 70.

[0159] The multimedia component 704 includes a screen that provides an output interface between the device 70 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundaries of the touch or slide action, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 704 includes a front camera and / or a rear camera. When the device 70 is in an operating mode, such as a shooting mode or a video mode, the front camera and / or the rear camera may receive external multimedia data. Each front camera and the rear camera may be a fixed optical lens system or have a focal length and optical zoom capability.

[0160] The audio component 705 is configured to output and / or input audio signals. For example, the audio component 705 includes a microphone (MIC), and when the device 70 is in an operating mode, such as a call mode, a recording mode, and a speech recognition mode, the microphone is configured to receive an external audio signal. The received audio signal can be further stored in the memory 702 or sent via the communication component 708. In some embodiments, the audio component 705 also includes a speaker for outputting audio signals.

[0161] I / O interface 706 provides an interface between processing component 701 and peripheral interface modules, which may be keyboards, click wheels, buttons, etc. These buttons may include but are not limited to: home button, volume button, start button, and lock button.

[0162] The sensor assembly 707 includes one or more sensors for providing various aspects of status assessment for the device 70. For example, the sensor assembly 707 can detect the open / closed state of the device 70, the relative positioning of components, such as the display and keypad of the device 70, and the sensor assembly 707 can also detect the position change of the device 70 or a component of the device 70, the presence or absence of user contact with the device 70, the orientation or acceleration / deceleration of the device 70, and the temperature change of the device 70. The sensor assembly 707 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. The sensor assembly 707 may also include an optical sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 707 may also include an accelerometer, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0163] The communication component 708 is configured to facilitate wired or wireless communication between the device 70 and other devices. The device 70 can access a wireless network based on a communication standard, such as WiFi, 2G or 3G, or a combination thereof. In an exemplary embodiment, the communication component 708 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 708 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0164] In an exemplary embodiment, the device 70 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the above methods.

[0165] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 702 including instructions, and the instructions can be executed by a processor 709 of the device 70 to perform the above method. For example, the non-transitory computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0166] The computer-readable storage medium mentioned above can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0167] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (Application Specific Integrated Circuits, referred to as: ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0168] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0169] An embodiment of the present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the multi-system login method performed by the multi-system login device as described above.

[0170] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A multi-system login method, characterized in that: Applied to a terminal device, the method comprises: In response to successfully passing the identity authentication of the digital portal, a token sent by the receiving server is displayed, and the system entrances of multiple systems associated with the digital portal are displayed; the token includes an authority identifier; In response to a touch operation on a system entry of a target system among the system entries of the multiple systems, determining a system verification level of the target system according to the authority identifier; If the system verification level of the target system is the first system level, logging into a preset page of the target system; If the system verification level of the target system is the second system level, verification prompt information corresponding to the second system level is generated; the first system verification information input by the user based on the verification prompt information corresponding to the second system level is verified, and if the verification is successful, the user logs in to the preset page of the target system.

2. The method according to claim 1, characterized in that The verification prompt information includes at least one of the following: inserting an online banking shield, entering a text message verification code, performing fingerprint verification, performing voiceprint verification, and performing face verification.

3. The method according to claim 1, characterized in that The response before successfully logging into the digital portal also includes: Display the login page of the digital portal; In response to a login operation on the login page, the portal login account and password corresponding to the login operation are obtained, and the portal login account and password are sent to a server so that the server verifies the portal login account and password. If the verification passes, a token is generated and sent to the terminal device.

4. The method according to claim 1, characterized in that: Before determining the system verification level of the target system according to the authority identifier, the method further includes: Decrypt the token to obtain a timestamp of when the token was generated and the validity period of the token; Determine whether the token is valid according to the timestamp of generating the token and the validity period of the token; If valid, the system verification level of the target system is determined according to the authority identifier.

5. The method according to claim 4, characterized in that The method further comprises: Based on the preset period, the refresh interface is actively called to obtain a new valid token from the server.

6. The method according to any one of claims 1 to 5, characterized in that: The preset page for logging into the target system includes: Determining a function display level of the target system according to the permission identifier; The preset page of the target system is logged in, and the preset page of the target system displays function entrances of multiple function modules matching the function display level.

7. The method according to any one of claims 1 to 5, characterized in that: After logging into the preset page of the target system, the method further includes: In response to a touch operation on a function entry of a target function module among the function entries of the plurality of function modules in the preset page, logging into the function module; In response to executing the business function provided by the functional module, determining the function verification level of the target functional module according to the authority identifier; If the function verification level of the target function is the first function level, generating verification prompt information corresponding to the first function level; verifying the first function verification information input by the user based on the verification prompt information corresponding to the first function level, and if the verification is successful, completing the execution of the business function; If the system verification level of the target system is the second functional level, generating verification prompt information corresponding to the second functional level; verifying the second functional verification information input by the user based on the verification prompt information corresponding to the second functional level, and if the verification is successful, completing the execution of the business function; The security of the second function verification information is greater than that of the first function verification information.

8. A multi-system login method, characterized in that: Applied to a server, the method comprises: Receiving the portal login account and password of the digital portal sent by the terminal device; Verifying the portal login account and password; If the verification is successful, a token is generated according to the unique user identifier corresponding to the portal login account; the token includes an authority identifier; the authority identifier is used to indicate the corresponding system verification level; different system verification levels correspond to different verification complexities; The token is sent to the terminal device.

9. The method according to claim 8, characterized in that The generating a token according to the unique user identifier corresponding to the portal login account includes: Combine the user unique identifier and the authority identifier corresponding to the portal login account into a JSON object or string to obtain the token original data; The original data is encrypted based on a preset key, and a token is generated according to the encrypted original data.

10. The method according to claim 8 or 9, characterized in that: The generating a token according to the unique user identifier corresponding to the portal login account includes: Record the timestamp of generating the token; A token is generated according to a timestamp, a preset validity period, and a unique user identifier corresponding to the portal login account.

11. The method according to claim 10, characterized in that After the token is generated according to the timestamp, the preset validity period and the unique user identifier corresponding to the portal login account, the method further includes: If the remaining validity time of the token is less than or equal to the preset duration, a new token is automatically generated.

12. A terminal device, characterized in that: include: A display module, configured to receive a token sent by a server and display system portals of a plurality of systems associated with the digital portal in response to successfully passing the identity authentication of the digital portal; The token includes an authority identifier; a determination module, configured to determine, in response to a touch operation on a system entry of a target system among the system entries of the multiple systems, a system verification level of the target system according to the authority identifier; A login module, configured to log in to a preset page of the target system if the system verification level of the target system is the first system level; The login module is also used to generate verification prompt information corresponding to the second system level if the system verification level of the target system is the second system level; verify the first system verification information input by the user based on the verification prompt information corresponding to the second system level, and if the verification is successful, log in to the preset page of the target system.

13. A server, characterized in that: include: A receiving module, used for receiving a portal login account and password of a digital portal sent by a terminal device; A verification module, used to verify the portal login account and password; A generation module, for generating a token according to the unique user identifier corresponding to the portal login account if the verification is passed; the token includes an authority identifier; the authority identifier is used to indicate the corresponding system verification level; Different system verification levels correspond to different verification complexities; A sending module is used to send the token to the terminal device.

14. An electronic device, characterized in that: include: at least one processor and memory; The memory stores computer-executable instructions; The at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor executes the multi-system login method according to any one of claims 1 to 11.

15. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions. When the processor executes the computer-executable instructions, the multi-system login method according to any one of claims 1 to 11 is implemented.

16. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the multi-system login method according to any one of claims 1 to 11 is implemented.

Images