Access information processing method, device, electronic device and medium

Abstract

The embodiments of the present application disclose an access information processing method, device, electronic device and medium. The present application relates to the field of mobile Internet technology. The method is executed by a server and includes: if it is detected that a user has successfully logged in to the server through a terminal, then the terminal identification information and the user's login information sent by the terminal are obtained; based on the terminal identification information, the terminal's authorization environment identifier is generated, and based on the user's login information, the user's authorized login identifier is generated, and the authorized login identifier is issued to the terminal to perform security verification on the operation request carrying the terminal identification information and the authorized login identifier initiated by the terminal after the user successfully logs in. The above scheme solves the problem of other terminals stealing login authentication information and making abnormal access to the server after the terminal successfully logs in by performing security verification on the operation request carrying the terminal identification and authorized login information initiated by subsequent terminals, thereby ensuring the security of the terminal's access to the server.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of mobile Internet technology, and in particular to an access information processing method, device, electronic device, and medium. Background Art

[0002] Currently, the transformation of the banking system has entered its third phase, which is unbundling banking services and expanding globally. This is achieving business separation and scenario integration within banks, between banks, between banks and non-bank financial institutions, and even between cross-border enterprises, thereby reshaping the banking ecosystem. The third phase of the banking service system is a borderless and open banking service system, where customers use banking services in open scenarios.

[0003] However, the opening of banking service systems also poses a further threat to their security. After a user successfully logs in to the banking service system using a terminal, the system returns a token to indicate the user's successful login. However, other terminals with unauthorized access may steal the token and continue to access the banking service system using the stolen token, threatening the security of the banking service system. Summary of the Invention

[0004] The embodiments of the present invention provide an access information processing method, device, electronic device and medium, so as to continue to verify the operations performed by the user after logging in, thereby ensuring the security of access.

[0005] In one embodiment, the present application provides an access information processing method, which is executed by a server and includes:

[0006] If it is detected that the user has successfully logged in to the server through the terminal, the terminal identification information and the user's login information sent by the terminal are obtained;

[0007] Based on the terminal identification information, the authorization environment identifier of the terminal is generated, and based on the user's login information, the authorized login identifier of the user is generated, and the authorized login identifier is issued to the terminal to perform security verification on operation requests carrying the terminal identification information and the authorized login identifier initiated by the terminal after the user successfully logs in.

[0008] In another embodiment, the present application also provides an access information processing method, which is executed by a terminal, and the method includes:

[0009] If it is detected that the user logs into the server through the terminal, the terminal identification information of the terminal and the login information of the user are collected;

[0010] Sending the terminal identification information and the user's login information to the server, so that after the user successfully logs in to the server through the terminal, the server generates an authorization environment identifier for the terminal based on the terminal identification information, generates an authorized login identifier for the user based on the user's login information, and issues the authorized login identifier to the terminal;

[0011] Receive the authorized login identifier issued by the server.

[0012] In one embodiment, the present application further provides an access information processing device, which is configured on a server and includes:

[0013] An information acquisition module, configured to acquire terminal identification information and user login information sent by the terminal if it is detected that the user has successfully logged in to the server via the terminal;

[0014] The identification generation module is used to generate the authorization environment identification of the terminal based on the terminal identification information, and generate the user's authorized login identification based on the user's login information, and issue the authorized login identification to the terminal to perform security verification on operation requests initiated by the terminal after the user successfully logs in and carries the terminal identification information and the authorized login identification.

[0015] In another embodiment, the present application also provides an access information processing device, which is configured in a terminal and includes:

[0016] An information collection module is configured to collect terminal identification information of the terminal and login information of the user if it is detected that the user logs into the server through the terminal;

[0017] an information sending module, configured for the server to send the terminal identification information and the user's login information, so that after the user successfully logs in to the server through the terminal, the server generates an authorization environment identifier for the terminal based on the terminal identification information, generates an authorized login identifier for the user based on the user's login information, and sends the authorized login identifier to the terminal;

[0018] The identification receiving module receives the authorized login identification issued by the server.

[0019] In yet another embodiment, an embodiment of the present application further provides an electronic device, including: one or more processors;

[0020] a memory for storing one or more programs;

[0021] When the one or more programs are executed by the one or more processors, the one or more processors implement the access information processing method executed by the server as described in any embodiment of the present application, or implement the access information processing method executed by the terminal as described in any embodiment of the present application.

[0022] In another embodiment, the embodiment of the present application further provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, it implements the access information processing method executed by the server as described in any embodiment of the present application, or implements the access information processing method executed by the terminal as described in any embodiment of the present application.

[0023] The technical solution of the embodiment of the present application is as follows: if it is detected that a user has successfully logged into a server through a terminal, the terminal identification information and the user's login information sent by the terminal are obtained; based on the terminal identification information, the terminal's authorization environment identifier is generated; and based on the user's login information, the user's authorized login identifier is generated, and the authorized login identifier is issued to the terminal to perform security verification on operation requests initiated by the terminal after the user successfully logs in, which carry the terminal identification information and the authorized login identifier. By performing security verification on operation requests initiated by subsequent terminals carrying the terminal identification and authorized login information, the problem of other terminals stealing login authentication information and performing abnormal access to the server after a terminal successfully logs in is solved, thereby ensuring the security of the terminal's access to the server. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 A flowchart of an access information processing method executed by a server according to an embodiment of the present invention;

[0025] Figure 2 A schematic diagram of a user login interface provided by an embodiment of the present invention;

[0026] Figure 3 A flowchart of an access information processing method executed by a server according to another embodiment of the present invention;

[0027] Figure 4 A flowchart of an access information processing method executed by a server according to another embodiment of the present invention;

[0028] Figure 5 A flowchart of an access information processing method executed by a terminal according to an embodiment of the present invention;

[0029] Figure 6 A schematic diagram of the structure of an access information processing device configured on a server provided in one embodiment of the present invention;

[0030] Figure 7A schematic structural diagram of an access information processing device configured in a terminal according to an embodiment of the present invention;

[0031] Figure 8 A schematic structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0032] The present invention will be further described in detail below with reference to the accompanying drawings and examples. It will be understood that the specific embodiments described herein are intended only to illustrate the present invention and are not intended to limit the present invention. It should also be noted that, for ease of description, the accompanying drawings only illustrate portions relevant to the present invention, not all structures.

[0033] Figure 1 This is a flowchart of an access information processing method performed by a server according to an embodiment of the present invention. The access information processing method provided in this embodiment of the application is applicable to the case where access initiated by a user to a server through a terminal is processed. Typically, this embodiment of the application is applicable to the case where an operation request initiated is verified after a user successfully logs in to a server through a terminal. The method can be specifically executed by an access information processing device, which can be implemented in software and / or hardware, and can be integrated into an electronic device capable of implementing the access information processing method. See Figure 1 , the method of the embodiment of the present application specifically includes:

[0034] S110: If it is detected that the user has successfully logged in to the server through the terminal, the terminal identification information and the user's login information sent by the terminal are obtained.

[0035] The user logging into the server through the terminal can be a software system such as a banking service system. The server verifies the login operation and other access information of the service system. The user can be a bank customer who can use the banking service system. The software system can also be other systems, such as a provident fund business system or a household registration business system, and is not limited to banking service systems.

[0036] If the terminal logs in based on an application, the terminal identification information includes at least one of the following: software system identification, device identification and hardware address; for example: Android Id, Open UDID, Device Id, MAC address, etc. If the terminal logs in based on a browser, the terminal identification information includes at least one of the following: browser name, kernel version number on which the browser is based, browser manufacturer kernel version number, browser user agent and operating system version information, etc.

[0037] A user's login information may include a user account identifier and a third-party platform identifier. The third-party platform is the platform used by the user to log in through the terminal. The user account identifier may be a bank customer number, for example, a unique identifier set by the bank for each user. The third-party platform identifier may be an external merchant ID for the current application scenario. For example, if a user accesses a bank service system through the Taobao platform on the terminal, the Taobao platform is considered a third-party platform, and the third-party platform identifier is the merchant ID of the Taobao platform.

[0038] For example, Figure 2 As shown, a user can log in to the server through a terminal. The specific login verification process is as follows: the user logs in using a mobile phone number, the server returns a verification code to the terminal, the user then enters the verification code into the terminal, sends it to the server, and the server verifies the verification code. If the verification is successful, the user's login is successful. When the user logs in to the server through the terminal, the terminal identification information and the user's login information are collected and sent to the server. The server then receives the terminal identification information and the user's login information sent by the terminal.

[0039] S120. Generate an authorization environment identifier for the terminal based on the terminal identification information, and generate an authorized login identifier for the user based on the user's login information. The authorized login identifier is issued to the terminal to perform security verification on an operation request initiated by the terminal after the user successfully logs in and carries the terminal identification information and the authorized login identifier.

[0040] Currently, after a user successfully logs in to a server through a terminal, the server will return a token to the terminal to indicate that the terminal has successfully logged in. Subsequent terminals can access the server with the token. However, if other non-normal terminals steal the token, they can continue to illegally access the server with the token, posing a threat to the security of the server. In an embodiment of the present application, after a user successfully logs in through a terminal, an authorization environment identifier for the terminal is generated based on the terminal identification information and stored locally. When a subsequent terminal accesses the server, the terminal currently used by the user is verified based on the authorization environment identifier, thereby preventing other non-normal terminals from making abnormal access. In addition, the server generates an authorized login identifier for the user based on the user's login information and issues the authorized login identifier to the terminal. Therefore, when a subsequent user initiates an operation request through the terminal, the user's operation request is securely verified based on the authorized login identifier carried by the terminal and the authorized login identifier issued to the terminal, thereby preventing abnormal access by non-normal users.

[0041] The technical solution of the embodiment of the present application is as follows: if it is detected that a user has successfully logged into a server through a terminal, the terminal identification information and the user's login information sent by the terminal are obtained; based on the terminal identification information, the terminal's authorization environment identifier is generated, and based on the user's login information, the user's authorized login identifier is generated, and the authorized login identifier is issued to the terminal to perform security verification on operation requests initiated by the terminal after the user successfully logs in, which carry the terminal identification information and the authorized login identifier. By performing security verification on operation requests initiated by subsequent terminals carrying the terminal identification and authorized login information, the terminal environment used by the user is verified, solving the problem of other terminals stealing login authentication information and making abnormal access to the server after the terminal successfully logs in, and ensuring the security of the terminal's access to the server.

[0042] Figure 3 This is a flowchart of an access information processing method performed by a server according to another embodiment of the present invention. This embodiment of the present application is a further optimization of the above embodiment. For details not described in detail in this embodiment of the present application, please refer to the above embodiment. Figure 3 The access information processing method provided in the embodiment of the present application may include:

[0043] S210: If it is detected that the user has successfully logged in to the server through the terminal, the terminal identification information and the user's login information sent by the terminal are obtained.

[0044] S220: Generate an authorization environment identifier for the terminal according to the terminal identification information and the key information allocated to the user.

[0045] For example, the server may pre-assign dedicated key information to the user, and different dedicated key information may be assigned to different third-party platforms used by the user. The server generates an authorization environment identifier for the terminal based on the terminal identification information and the key information assigned to the user, so that the authorization environment identifier uniquely identifies a terminal, and different terminal environments correspond to different authorization environment identifiers.

[0046] In an embodiment of the present application, the authorization environment identifier of the terminal is generated based on the terminal identification information and the key information assigned to the user, including: splicing the terminal identification information and the key information to obtain spliced ​​environment identification information; encrypting the spliced ​​identification information based on an encryption algorithm to obtain the authorization environment identifier of the terminal.

[0047] For example, as shown in Table 1, the terminal identification information and key information are concatenated to obtain the concatenated environment identification information, which is then encrypted to obtain the terminal's authorization environment identification. The encryption algorithm may be a MAC algorithm, an MD5 algorithm, or the like. After the server generates the authorization environment identification, it stores it locally.

[0048] Table 1

[0049]

[0050]

[0051] S230: Determine the authorized identity identifier of the user according to the user account identifier and the third-party platform identifier.

[0052] The user's login information includes a user account identifier and a third-party platform identifier, where the third-party platform is the platform used by the user to log in through the terminal;

[0053] Exemplarily, for each user, an authorized identity identifier of the user is generated based on the user account identifier and the third-party platform identifier, so that the user's identity is uniquely marked with the authorized identity identifier.

[0054] In an embodiment of the present application, the authorized identity identifier of the user is determined based on the user account identifier and the third-party platform identifier, including: splicing the user account identifier and the third-party platform identifier to obtain a spliced ​​identity identifier; encrypting the spliced ​​identity identifier to obtain the authorized identity identifier; and issuing the authorized identity identifier to the terminal.

[0055] The user account identifier and the third-party platform identifier are concatenated. The third-party platform identifier can be concatenated before the user account identifier or after the user account identifier, without limitation. After concatenating the user account identifier and the third-party platform identifier, a concatenated identity identifier is obtained. The concatenated identity identifier is encrypted to obtain an authorized identity identifier, which is then issued to the terminal so that the terminal carries the authorized identity identifier when initiating subsequent operation requests, which are then securely verified by the server. The encryption algorithm can be a MAC algorithm, an MD5 algorithm, or the like.

[0056] S240: Generate a session identifier for the current successful login behavior.

[0057] For example, each time a user successfully logs in to the server through a terminal, the server generates a session identifier, i.e., a token. The server returns the session identifier to the terminal, and the terminal needs to carry the token in subsequent accesses instead of carrying the username and password every time.

[0058] S250: Concatenate the authorization identity and the session identifier and encrypt them to obtain the authorization login identifier; or concatenate the third-party platform identifier, the authorization identity and the session identifier and encrypt them to obtain the authorization login identifier.

[0059] Exemplarily, the server concatenates the authorization identity and the session identifier, encrypts the concatenated authorization identity and session identifier, and obtains an authorized login identifier. Alternatively, the server concatenates the third-party platform identifier, the authorization identity, and the session identifier, and encrypts the concatenated third-party platform identifier, the authorization identity, and the session identifier to obtain an authorized login identifier, and issues the authorized login identifier to the terminal so that the terminal carries the authorized login identifier during subsequent access, and the server performs security verification. In an embodiment of the present application, the encryption method for encrypting the concatenation of the authorization identity and the session identifier, or encrypting the concatenation of the third-party platform identifier, the authorization identity, and the session identifier is reversible encryption. The authorization identity and the session identifier can be determined based on the authorized login information, or the third-party platform identifier, the authorization identity, and the session identifier can be determined based on the authorized login information.

[0060] The solution in the embodiment of the present application generates an authorization environment identifier of the terminal based on the terminal identification information and the key information assigned to the user, determines the user's authorization identity identifier based on the user account identifier and the third-party platform identifier, determines the user's authorization identity identifier based on the user account identifier and the third-party platform identifier, and encrypts the authorization identity identifier and the session identifier after splicing to obtain the authorized login identifier; or, encrypts the third-party platform identifier, the authorization identity identifier and the session identifier after splicing to obtain the authorized login identifier, thereby performing dual authentication from two aspects of the user's operating environment and user identity, thereby improving the security of operations initiated after the user logs in.

[0061] In an embodiment of the present application, the process of performing security verification on the operation request after the user successfully logs in includes: if an operation request initiated by the user through the terminal is received, obtaining the authorization identity carried by the terminal; if the authorization identity carried by the terminal is consistent with the authorization identity issued to the terminal, determining the user operation authority associated with the authorization identity.

[0062] Exemplarily, after generating an authorization identity, the server associates and stores the authorization identity with the user's operation permissions and sends the authorization identity to the terminal. When the user initiates an operation request to the server via the terminal, the authorization identity sent by the server is carried. Upon receiving an operation request initiated by the user via the terminal, the server obtains the authorization identity carried by the terminal. If the authorization identity carried by the terminal is consistent with the authorization identity sent by the server to the terminal, the server determines the user operation permissions associated with the authorization identity based on the pre-stored association between the authorization identity and the user operation permissions, thereby executing the corresponding operation based on the operation permissions.

[0063] Figure 4 This is a flowchart of an access information processing method performed by a server according to another embodiment of the present invention. This embodiment of the present application is a further optimization of the above embodiment. For details not described in detail in this embodiment of the present application, please refer to the above embodiment. Figure 4 The access information processing method provided in the embodiment of the present application may include:

[0064] S310: If it is detected that the user has successfully logged into the server through the terminal, the terminal identification information and the user's login information sent by the terminal are obtained.

[0065] S320. Generate an authorization environment identifier for the terminal based on the terminal identification information, and generate an authorized login identifier for the user based on the user's login information. The authorized login identifier is issued to the terminal to perform security verification on an operation request carrying the terminal identification information and the authorized login identifier initiated through the terminal after the user successfully logs in.

[0066] S330: If an operation request is received from the user via the terminal, the current terminal identification information and the authorized login identification carried by the terminal are obtained.

[0067] For example, for an operation request initiated by a user after successful terminal login, the server needs to re-verify the terminal environment and user identity of the operation request. Therefore, the terminal needs to collect the current terminal identification information. After the server generates the authorization login identifier, it sends the authorization identifier information to the terminal. The terminal needs to send the authorization login identifier to the server, and the server will perform security verification of the terminal environment and user identity of the current operation request based on the current terminal identification information and the authorization login identifier carried by the terminal.

[0068] S340: Generate a current environment identifier according to the current terminal identifier information carried by the terminal.

[0069] The server generates the current environment identifier based on the current terminal identification information carried by the terminal. The generation method is the same as the generation method of the authorization environment identifier, that is, the terminal identification information and the key information assigned to the user are concatenated and then encrypted to obtain the current environment identifier.

[0070] S350: Determine a security verification result based on a matching result between the current environment identifier and the authorized environment identifier, and a matching result between an authorized login identifier issued to the terminal and an authorized login identifier carried by the terminal.

[0071] Exemplarily, the current environment identifier is matched with a pre-stored authorization environment identifier. If the match is successful, it is determined that the terminal environment currently used by the user is the same as the terminal environment used when the user logged in, and that no change has occurred in the terminal environment. The server matches the authorization login identifier issued to the terminal with the authorization login identifier carried by the terminal. The specific process of the server matching the authorization login identifier issued to the terminal with the authorization login identifier carried by the terminal can be: the server decrypts the authorization login identifier to obtain an authorization identity identifier and a session identifier, matches the decrypted authorization identity identifier with an authorization identity identifier pre-stored in the server, and matches the decrypted session identifier with a session identifier pre-stored in the server. If the match is successful, the security authentication is passed. Alternatively, the server decrypts the authorization login identifier to obtain a third-party platform identifier, an authorization identity identifier, and a session identifier, matches the decrypted third-party platform identifier and authorization identity identifier with the authorization identity identifier pre-stored in the server, matches the decrypted session identifier with a session identifier pre-stored in the server, and matches the decrypted third-party platform identifier with the third-party platform identifier pre-stored in the server. If the match is successful, the security authentication is passed. In addition, the server can also query whether the current login status of the user is within the limited period according to the limited period of the login status of the pre-stored session identifier. If it is within the limited period, the user is allowed to continue accessing.

[0072] The technical solution of the embodiment of the present application verifies the terminal environment and user identity used by the user through the current terminal identification information and authorized login identification carried by the terminal when the user initiates an operation request to the server through the terminal, thereby avoiding illegal access to the server by other abnormal terminals, thereby improving the security of access.

[0073] Figure 5This is a flowchart of an access information processing method performed by a terminal according to an embodiment of the present invention. The access information processing method provided in this embodiment of the application is applicable to the case where access initiated by a user to a server through a terminal is processed. Typically, this embodiment of the application is applicable to the case where an operation request initiated is verified after a user successfully logs in to a server through a terminal. The method can be specifically executed by an access information processing device, which can be implemented in software and / or hardware, and can be integrated into an electronic device capable of implementing the access information processing method. See Figure 5 , the method of the embodiment of the present application specifically includes:

[0074] S410: If it is detected that the user logs into the server through the terminal, the terminal identification information of the terminal and the login information of the user are collected.

[0075] If the terminal logs in based on an application, the terminal identification information includes at least one of the following: software system identification, device identification and hardware address; if the terminal logs in based on a browser, the terminal identification information includes at least one of the following: browser name, kernel version number on which the browser is based, browser manufacturer kernel version number, browser user agent and operating system version information.

[0076] Exemplarily, if the terminal detects that the user sends a login request to the server through the terminal, the terminal representation information and the user's login information are collected.

[0077] S420. Send the terminal identification information and the user's login information to the server, so that after the user successfully logs in to the server through the terminal, the server generates an authorization environment identifier for the terminal based on the terminal identification information, generates an authorized login identifier for the user based on the user's login information, and issues the authorized login identifier to the terminal.

[0078] The terminal sends the terminal identification information and the user's login information to the server. After the user successfully logs in through the terminal, the server generates an authorization environment identifier for the terminal based on the terminal identification information and stores it locally. This allows the server to verify the user's current terminal based on the authorization environment identifier when the terminal attempts to access the system, preventing unauthorized access by other unauthorized terminals. Furthermore, the server generates an authorized login identifier for the user based on the user's login information and issues it to the terminal. Consequently, when the user subsequently initiates an operation request through the terminal, the server uses the authorization login identifier carried by the terminal and the authorized login identifier issued to the terminal to perform security verification on the user's operation request, preventing unauthorized access by unauthorized users.

[0079] S430: Receive the authorized login identifier issued by the server.

[0080] Exemplarily, the terminal receives the authorized login identifier issued by the server, and then when initiating an operation request to the server subsequently, carries the authorized login identifier and the terminal identification information for security verification by the server.

[0081] In an embodiment of the present application, the method also includes: if the user initiates an operation request to the server through the terminal, collecting the current terminal identification information of the terminal; sending the current terminal identification information and the authorized login identification to the server, so that the server generates a current environment identification based on the current terminal identification information, and performing security verification based on the matching result of the current environment identification and the authorized environment identification, as well as the matching result of the authorized login identification sent by the terminal and the authorized login identification issued by the server to the terminal.

[0082] For example, for an operation request initiated by a user after successfully logging in through a terminal, the server needs to re-verify the terminal environment and user identity of the operation request. Therefore, the terminal needs to collect the current terminal identification information. After the server generates the authorized login identifier, it sends the authorization identifier information to the terminal. The terminal needs to send the authorized login identifier to the server, so that the server can perform security verification of the terminal environment and user identity of the current operation request based on the current terminal identification information and the authorized login identifier carried by the terminal. The server generates the current environment identifier based on the current terminal identification information carried by the terminal. The generation method is the same as the authorization environment identifier, that is, the terminal identification information is concatenated with the key information assigned to the user, and then encrypted to obtain the current environment identifier. The current environment identifier is matched with the pre-stored authorization environment identifier. If a match is successful, it is determined that the terminal environment currently used by the user is the same as the terminal environment used when the user logged in, and the terminal environment has not changed. The server matches the authorized login identifier sent to the terminal with the authorized login identifier carried by the terminal. The specific process for the server to match the authorized login identifier issued to the terminal with the authorized login identifier carried by the terminal may include: the server decrypts the authorized login identifier to obtain an authorized identity identifier and a session identifier; matches the decrypted authorized identity identifier with an authorized identity identifier pre-stored on the server; and matches the decrypted session identifier with a session identifier pre-stored on the server. If a match is successful, security authentication is passed. Alternatively, the server decrypts the authorized login identifier to obtain a third-party platform identifier, an authorized identity identifier, and a session identifier; matches the decrypted third-party platform identifier and authorized identity identifier with an authorized identity identifier pre-stored on the server; matches the decrypted session identifier with a session identifier pre-stored on the server; and matches the decrypted third-party platform identifier with a third-party platform identifier pre-stored on the server. If a match is successful, security authentication is passed. Furthermore, the server may also query whether the user's current login status is within the limited period of the pre-stored session identifier based on the limited period of the login status. If so, the user is allowed to continue access.

[0083] In an embodiment of the present application, the method further includes: receiving an authorization identity identifier issued by the server; if the user initiates an operation request to the server through the terminal, the authorization identity identifier is sent to the server, so that if the server determines that the authorization identity identifier carried by the terminal is consistent with the authorization identity identifier issued to the terminal, the user operation authority associated with the authorization identity identifier is determined.

[0084] Exemplarily, after generating an authorization identity, the server associates and stores the authorization identity with the user's operation permissions and sends the authorization identity to the terminal. When the user initiates an operation request to the server via the terminal, the authorization identity sent by the server is carried. Upon receiving an operation request initiated by the user via the terminal, the server obtains the authorization identity carried by the terminal. If the authorization identity carried by the terminal is consistent with the authorization identity sent by the server to the terminal, the server determines the user operation permissions associated with the authorization identity based on the pre-stored association between the authorization identity and the user operation permissions, thereby executing the corresponding operation based on the operation permissions.

[0085] Figure 6 This is a schematic diagram of the structure of an access information processing device configured on a server provided by an embodiment of the present invention. The device is applicable to processing access initiated by a user to a server through a terminal. Typically, the embodiment of the present application is applicable to verifying the operation request initiated after the user successfully logs in to the server through a terminal. The device can be implemented in software and / or hardware, and can be integrated into an electronic device. Figure 6 , the device specifically includes:

[0086] The information acquisition module 510 is configured to acquire the terminal identification information and the user's login information sent by the terminal if it is detected that the user has successfully logged in to the server via the terminal;

[0087] The identification generation module 520 is used to generate the authorization environment identification of the terminal based on the terminal identification information, and generate the authorized login identification of the user based on the login information of the user, and send the authorized login identification to the terminal to perform security verification on the operation request carrying the terminal identification information and the authorized login identification initiated by the terminal after the user successfully logs in.

[0088] In an embodiment of the present application, if the terminal logs in based on an application, the terminal identification information includes at least one of the following: a software system identification, a device identification, and a hardware address;

[0089] If the terminal logs in based on a browser, the terminal identification information includes at least one of the following: browser name, kernel version number based on the browser, browser manufacturer kernel version number, browser user agent and operating system version information.

[0090] In the embodiment of the present application, the identification generation module 520 includes:

[0091] The authorization environment identifier generating unit is configured to generate the authorization environment identifier of the terminal according to the terminal identification information and the key information allocated to the user.

[0092] In the embodiment of the present application, the authorization environment identifier generation unit is specifically used to:

[0093] Concatenate the terminal identification information and the key information to obtain concatenated environment identification information;

[0094] The splicing identification information is encrypted based on an encryption algorithm to obtain an authorization environment identification of the terminal.

[0095] In the embodiment of the present application, the user's login information includes a user account identifier and a third-party platform identifier, where the third-party platform is the platform based on which the user logs in through a terminal;

[0096] Accordingly, the identification generation module 520 includes:

[0097] an authorized identity determination unit, configured to determine the authorized identity of the user based on the user account identifier and the third-party platform identifier;

[0098] A session identifier generating unit, configured to generate a session identifier for a current successful login behavior;

[0099] The authorization login identifier generation unit is used to encrypt the authorization identity identifier and the session identifier after splicing them together to obtain the authorization login identifier; or to encrypt the third-party platform identifier, the authorization identity identifier and the session identifier after splicing them together to obtain the authorization login identifier.

[0100] In the embodiment of the present application, the authorization identity determination unit is specifically configured to:

[0101] Concatenate the user account identifier and the third-party platform identifier to obtain a concatenated identity identifier;

[0102] Encrypting the spliced ​​identity to obtain the authorized identity;

[0103] The authorization identity is issued to the terminal.

[0104] In an embodiment of the present application, the device further includes:

[0105] an authorization identity acquisition module, configured to acquire the authorization identity carried by the terminal upon receiving an operation request initiated by the user through the terminal;

[0106] The user operation authority determination module is used to determine the user operation authority associated with the authorization identity if the authorization identity carried by the terminal is consistent with the authorization identity issued to the terminal.

[0107] In an embodiment of the present application, the device further includes:

[0108] an identification acquisition module, configured to acquire the current terminal identification information and the authorized login identification carried by the terminal upon receiving an operation request initiated by the user through the terminal;

[0109] A current environment identifier generating module, configured to generate a current environment identifier based on the current terminal identifier information carried by the terminal;

[0110] The security verification result determination module is used to determine the security verification result according to the matching result of the current environment identifier and the authorized environment identifier, and the matching result of the authorized login identifier issued to the terminal and the authorized login identifier carried by the terminal.

[0111] The access information processing device configured in the server provided in the embodiment of the present application can execute the access information processing method provided by any embodiment of the present application and executed by the server, and has the corresponding functional modules and beneficial effects of the execution method.

[0112] Figure 7 This is a schematic diagram of the structure of an access information processing device configured in a terminal according to an embodiment of the present invention. The device is applicable to processing access initiated by a user to a server through a terminal. Typically, the embodiment of the present application is applicable to verifying the operation request initiated after the user successfully logs in to the server through the terminal. The device can be implemented in software and / or hardware and can be integrated into an electronic device. Figure 7 , the device specifically includes:

[0113] The information collection module 610 is configured to collect the terminal identification information of the terminal and the login information of the user if it is detected that the user logs into the server through the terminal;

[0114] An information sending module 620 is configured to cause the server to send the terminal identification information and the user's login information, so that after the user successfully logs in to the server through the terminal, the server generates an authorization environment identifier for the terminal based on the terminal identification information, generates an authorized login identifier for the user based on the user's login information, and sends the authorized login identifier to the terminal;

[0115] The identification receiving module 630 is used to receive the authorized login identification sent by the server.

[0116] In an embodiment of the present application, if the terminal logs in based on an application, the terminal identification information includes at least one of the following: a software system identification, a device identification, and a hardware address;

[0117] If the terminal logs in based on a browser, the terminal identification information includes at least one of the following: browser name, kernel version number based on the browser, browser manufacturer kernel version number, browser user agent and operating system version information.

[0118] In an embodiment of the present application, the device further includes:

[0119] A current information collection module, configured to collect the current terminal identification information of the terminal if the user initiates an operation request to the server through the terminal;

[0120] The identification sending module is used to send the current terminal identification information and the authorized login identification to the server, so that the server generates the current environment identification based on the current terminal identification information, and performs security verification based on the matching result between the current environment identification and the authorized environment identification, as well as the matching result between the authorized login identification sent by the terminal and the authorized login identification issued by the server to the terminal.

[0121] In an embodiment of the present application, the device further includes:

[0122] An authorization identity receiving module is used to receive the authorization identity issued by the server;

[0123] The authorization identity sending module is used to send the authorization identity to the server if the user initiates an operation request to the server through the terminal, so that if the server determines that the authorization identity carried by the terminal is consistent with the authorization identity issued to the terminal, it determines the user operation authority associated with the authorization identity.

[0124] The access information processing device configured in the terminal provided in the embodiment of the present application can execute the access information processing method provided by any embodiment of the present application and executed by the terminal, and has the corresponding functional modules and beneficial effects of the execution method.

[0125] Figure 8 A schematic structural diagram of an electronic device provided by an embodiment of the present invention. Figure 8 A block diagram of an exemplary electronic device 712 suitable for implementing embodiments of the present application is shown. Figure 8 The electronic device 712 shown is merely an example and should not limit the functionality and scope of use of the embodiments of the present application.

[0126] like Figure 8As shown, the electronic device 712 may include: one or more processors 716; a memory 728 for storing one or more programs. When the one or more programs are executed by the one or more processors 716, the one or more processors 716 implement the access information processing method provided by the server in the embodiment of the present application, including:

[0127] If it is detected that the user has successfully logged in to the server through the terminal, the terminal identification information and the user's login information sent by the terminal are obtained;

[0128] Based on the terminal identification information, the authorization environment identifier of the terminal is generated, and based on the user's login information, the authorized login identifier of the user is generated, and the authorized login identifier is issued to the terminal to perform security verification on operation requests carrying the terminal identification information and the authorized login identifier initiated by the terminal after the user successfully logs in.

[0129] Alternatively, the access information processing method provided by the terminal in the embodiment of the present application may be implemented, including:

[0130] If it is detected that the user logs into the server through the terminal, the terminal identification information of the terminal and the login information of the user are collected;

[0131] Sending the terminal identification information and the user's login information to the server, so that after the user successfully logs in to the server through the terminal, the server generates an authorization environment identifier for the terminal based on the terminal identification information, generates an authorized login identifier for the user based on the user's login information, and issues the authorized login identifier to the terminal;

[0132] Receive the authorized login identifier issued by the server.

[0133] Components of the electronic device 712 may include, but are not limited to, one or more processors or processor 716 , a memory 728 , and a bus 718 that connects the various device components (including the memory 728 and the processor 716 ).

[0134] Bus 718 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor or a local bus using any of a variety of bus architectures. Examples of these architectures include, but are not limited to, an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MAC) bus, a processed ISA bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus.

[0135] The electronic device 712 typically includes a variety of computer-readable storage media, which can be any available storage media that can be accessed by the electronic device 712, including volatile and non-volatile storage media, removable and non-removable storage media.

[0136] The memory 728 may include computer-readable storage media in the form of volatile memory, such as random access memory (RAM) 730 and / or cache memory 732. The electronic device 712 may further include other removable / non-removable, volatile / non-volatile computer storage media. By way of example only, the storage system 734 may be configured to read and write non-removable, non-volatile magnetic storage media ( Figure 8 Not shown, often called a "hard drive"). Although Figure 8 Not shown, a magnetic disk drive for reading and writing to a removable non-volatile magnetic disk (e.g., a "floppy disk"), and an optical disk drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, DVD-ROM, or other optical storage medium) may be provided. In these cases, each drive may be connected to bus 718 via one or more data storage medium interfaces. Memory 728 may include at least one program product having a set (e.g., at least one) of program modules configured to perform the functions of various embodiments of the present invention.

[0137] A program / utility 740 having a set (at least one) of program modules 742 may be stored, for example, in memory 728. Such program modules 742 include, but are not limited to, operating devices, one or more application programs, other program modules, and program data, each of which, or some combination thereof, may include an implementation of a network environment. Program modules 742 generally implement the functions and / or methods of the embodiments described herein.

[0138] The electronic device 712 may also communicate with one or more external devices 714 (e.g., a keyboard, a pointing device, a display 724, etc.), and may also communicate with one or more devices that enable a user to interact with the electronic device 712, and / or any device that enables the electronic device 712 to communicate with one or more other computing devices (e.g., a network card, a modem, etc.). Such communication may be performed through an input / output (I / O) interface 722. Furthermore, the electronic device 712 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) through a network adapter 720. Figure 8 As shown, the network adapter 720 communicates with other modules of the electronic device 712 via the bus 718. Figure 8Not shown, other hardware and / or software modules may be used in conjunction with electronic device 712, including but not limited to microcode, device drivers, redundant processing units, external disk drive arrays, RAID devices, tape drives, and data backup storage devices.

[0139] The processor 716 executes various functional applications and data processing by running at least one of the other programs among the multiple programs stored in the memory 728, such as implementing an access information processing method provided in an embodiment of the present application.

[0140] An embodiment of the present invention provides a storage medium containing computer-executable instructions. When the computer-executable instructions are executed by a computer processor, the computer-executable instructions are used to implement the access information processing method provided by the embodiment of the present application and performed by the server, including:

[0141] If it is detected that the user has successfully logged in to the server through the terminal, the terminal identification information and the user's login information sent by the terminal are obtained;

[0142] Based on the terminal identification information, the authorization environment identifier of the terminal is generated, and based on the user's login information, the authorized login identifier of the user is generated, and the authorized login identifier is issued to the terminal to perform security verification on operation requests carrying the terminal identification information and the authorized login identifier initiated by the terminal after the user successfully logs in.

[0143] Alternatively, the access information processing method provided by the terminal in the embodiment of the present application may be implemented, including:

[0144] If it is detected that the user logs into the server through the terminal, the terminal identification information of the terminal and the login information of the user are collected;

[0145] Sending the terminal identification information and the user's login information to the server, so that after the user successfully logs in to the server through the terminal, the server generates an authorization environment identifier for the terminal based on the terminal identification information, generates an authorized login identifier for the user based on the user's login information, and issues the authorized login identifier to the terminal;

[0146] Receive the authorized login identifier issued by the server.

[0147] The computer storage medium of the embodiment of the present application can adopt any combination of one or more computer-readable storage media. The computer-readable storage medium can be a computer-readable signal storage medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor device, apparatus or device, or any combination thereof. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In an embodiment of the present application, a computer-readable storage medium can be any tangible storage medium containing or storing a program, which can be used by an instruction execution device, device or device or used in combination with it.

[0148] A computer-readable signal storage medium may include a data signal propagated in baseband or as part of a carrier wave, which carries computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal storage medium may also be any computer-readable storage medium other than a computer-readable storage medium that can transmit, propagate, or transfer a program for use by or in conjunction with an instruction execution device, apparatus, or component.

[0149] The program code embodied on the computer-readable storage medium may be transmitted using any appropriate storage medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0150] Computer program code for performing the operations of the present invention may be written in one or more programming languages, or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on the remote computer or device. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0151] Note that the above are only preferred embodiments of the present invention and the technical principles employed. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and that various obvious changes, readjustments, and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in detail through the above embodiments, the present invention is not limited to the above embodiments and may include many other equivalent embodiments without departing from the concept of the present invention. The scope of the present invention is determined by the scope of the appended claims.

Claims

1. A method for processing access information, characterized in that: Executed by a server, the method includes: If it is detected that the user has successfully logged in to the server through the terminal, the terminal identification information and the user's login information sent by the terminal are obtained; wherein the user's login information includes the user account identification and the third-party platform identification. The user account identification is a unique identification set by the bank for each user; The terminal identification information and the key information are spliced ​​together to obtain splicing environment identification information; different third-party platforms correspond to different key information; Encrypting the splicing environment identification information based on an encryption algorithm to obtain an authorized environment identification of the terminal; and concatenating the user account identifier and the third-party platform identifier to obtain a concatenated identity identifier; Encrypting the spliced ​​identity to obtain an authorized identity; issuing the authorized identity to the terminal; Generate a session identifier for the current successful login behavior; The third-party platform identifier, the authorized identity identifier, and the session identifier are concatenated and encrypted to obtain an authorized login identifier; issuing the authorized login identifier to the terminal to perform security verification on an operation request carrying the terminal identification information and the authorized login identifier initiated by the terminal after the user successfully logs in; If an operation request initiated by the user through the terminal is received, obtaining the current terminal identification information and the authorized login identification carried by the terminal; Generate a current environment identifier according to the current terminal identification information carried by the terminal; Matching the current environment identifier with the pre-stored authorization environment identifier, if the match is successful, determining that the terminal environment currently used by the user is the same as the terminal environment used when the user logged in, and no change in the terminal environment has occurred; and Decrypt the authorized login identifier to obtain the third-party platform identifier, authorized identity identifier, and session identifier; The decrypted third-party platform identifier and authorization identity identifier are matched with the authorization identity identifier pre-stored in the server, the decrypted session identifier is matched with the session identifier pre-stored in the server, and the decrypted third-party platform identifier is matched with the pre-stored third-party platform identifier; if the match is successful, the security authentication is passed.

2. The method according to claim 1, characterized in that If the terminal logs in based on an application, the terminal identification information includes at least one of the following: a software system identification, a device identification, and a hardware address; If the terminal logs in based on a browser, the terminal identification information includes at least one of the following: browser name, kernel version number based on the browser, browser manufacturer kernel version number, browser user agent and operating system version information.

3. The method according to claim 1, characterized in that The process of performing security verification on the operation request after the user successfully logs in includes: If an operation request is received from the user via the terminal, obtaining the authorization identity carried by the terminal; If the authorization identity carried by the terminal is consistent with the authorization identity issued to the terminal, the user operation authority associated with the authorization identity is determined.

4. A method for processing access information, characterized in that: Executed by a terminal, the method includes: If it is detected that the user logs into the server through the terminal, the terminal identification information of the terminal and the login information of the user are collected; Sending terminal identification information and the user's login information to the server, so that after the user successfully logs in to the server through the terminal, the server will splice the terminal identification information and the key information to obtain spliced ​​environment identification information, encrypt the spliced ​​environment identification information based on an encryption algorithm, and obtain the authorization environment identification of the terminal. Different third-party platforms correspond to different key information, and splice the user account identification and the third-party platform identification to obtain a spliced ​​identity identification; encrypt the spliced ​​identity identification to obtain an authorized identity identification; issue the authorized identity identification to the terminal; generate a session identification for the current successful login behavior; encrypt the spliced ​​third-party platform identification, the authorized identity identification and the session identification to obtain an authorized login identification; and issue the authorized login identification to the terminal; wherein, the user's login information includes a user account identification and a third-party platform identification, and the user account identification is a unique identification set by the bank for each user; Receiving the authorization login identifier issued by the server; The method further comprises: If the user initiates an operation request to the server through the terminal, the current terminal identification information of the terminal is collected; Sending the current terminal identification information and the authorized login identification to the server, so that the server generates a current environment identification according to the current terminal identification information; The server matches the current environment identifier with the pre-stored authorization environment identifier. If the match is successful, it is determined that the terminal environment currently used by the user is the same as the terminal environment used when the user logged in, and no change in the terminal environment has occurred; and Decrypt the authorized login identifier to obtain the third-party platform identifier, authorized identity identifier, and session identifier; The decrypted third-party platform identifier and authorization identity identifier are matched with the authorization identity identifier pre-stored in the server, the decrypted session identifier is matched with the session identifier pre-stored in the server, and the decrypted third-party platform identifier is matched with the pre-stored third-party platform identifier; if the match is successful, the security authentication is passed.

5. The method according to claim 4, characterized in that If the terminal logs in based on an application, the terminal identification information includes at least one of the following: a software system identification, a device identification, and a hardware address; If the terminal logs in based on a browser, the terminal identification information includes at least one of the following: browser name, kernel version number based on the browser, browser manufacturer kernel version number, browser user agent and operating system version information.

6. The method according to claim 4, characterized in that The method further comprises: Receiving the authorization identity issued by the server; If the user initiates an operation request to the server through the terminal, an authorization identity identifier is sent to the server, so that if the server determines that the authorization identity identifier carried by the terminal is consistent with the authorization identity identifier issued to the terminal, the server determines the user operation authority associated with the authorization identity identifier.

7. An access information processing device, characterized in that: Configured on a server, the device includes: An information acquisition module, configured to, upon detecting that a user has successfully logged into a server via a terminal, acquire terminal identification information and the user's login information sent by the terminal; wherein the user's login information includes a user account identifier and a third-party platform identifier, wherein the user account identifier is a unique identifier set by the bank for each user; The logo generation module includes: An authorization environment identifier generating unit is configured to concatenate the terminal identification information and the key information to obtain concatenated environment identifier information; different third-party platforms correspond to different key information; and encrypt the concatenated environment identifier information based on an encryption algorithm to obtain the authorization environment identifier of the terminal; An authorized identity identification determination unit is configured to concatenate the user account identifier and the third-party platform identifier to obtain a concatenated identity identifier; encrypt the concatenated identity identifier to obtain an authorized identity identifier; and issue the authorized identity identifier to the terminal; A session identifier generating unit, configured to generate a session identifier for a current successful login behavior; An authorized login identifier generating unit is configured to encrypt the concatenation of the third-party platform identifier, the authorized identity identifier, and the session identifier to obtain an authorized login identifier; and issue the authorized login identifier to the terminal; an identification acquisition module, configured to acquire the current terminal identification information and the authorized login identification carried by the terminal upon receiving an operation request initiated by the user through the terminal; A current environment identifier generating module, configured to generate a current environment identifier based on the current terminal identifier information carried by the terminal; Security verification result determination module, used for Matching the current environment identifier with the pre-stored authorization environment identifier, if the match is successful, determining that the terminal environment currently used by the user is the same as the terminal environment used when the user logged in, and no change in the terminal environment has occurred; and Decrypting the authorized login identifier to obtain a third-party identifier, an authorized identity identifier, and a session identifier; The decrypted third-party platform identifier and authorization identity identifier are matched with the authorization identity identifier pre-stored in the server, the decrypted session identifier is matched with the session identifier pre-stored in the server, and the decrypted third-party platform identifier is matched with the pre-stored third-party platform identifier; if the match is successful, the security authentication is passed.

8. An access information processing device, characterized in that: Configured at a terminal, the device includes: An information collection module is configured to collect terminal identification information of the terminal and login information of the user if it is detected that the user logs into the server through the terminal; An information sending module is used to send terminal identification information and the user's login information to the server, so that after the user successfully logs in to the server through the terminal, the server will splice the terminal identification information and the key information to obtain spliced ​​environment identification information, encrypt the spliced ​​environment identification information based on an encryption algorithm, and obtain the authorization environment identification of the terminal. Different third-party platforms have different corresponding key information, and splice the user account identification and the third-party platform identification to obtain a spliced ​​identity identification; encrypt the spliced ​​identity identification to obtain an authorized identity identification; issue the authorized identity identification to the terminal; generate a session identification for the current successful login behavior; encrypt the spliced ​​third-party platform identification, the authorized identity identification and the session identification to obtain an authorized login identification; and issue the authorized login identification to the terminal; wherein, the user's login information includes a user account identification and a third-party platform identification, and the user account identification is a unique identification set by the bank for each user; An identification receiving module receives the authorization login identification issued by the server; The device further comprises: A current information collection module, configured to collect the current terminal identification information of the terminal if the user initiates an operation request to the server through the terminal; An identification sending module, configured to send the current terminal identification information and the authorized login identification to the server, so that the server generates a current environment identification according to the current terminal identification information; The server matches the current environment identifier with the pre-stored authorization environment identifier. If the match is successful, it is determined that the terminal environment currently used by the user is the same as the terminal environment used when the user logged in, and no change in the terminal environment has occurred; and Decrypting the authorized login identifier to obtain a third-party identifier, an authorized identity identifier, and a session identifier; The decrypted third-party platform identifier and authorization identity identifier are matched with the authorization identity identifier pre-stored in the server, the decrypted session identifier is matched with the session identifier pre-stored in the server, and the decrypted third-party platform identifier is matched with the pre-stored third-party platform identifier; if the match is successful, the security authentication is passed.

9. An electronic device, characterized in that: The electronic device comprises: one or more processors; a memory for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the access information processing method executed by the server as described in any one of claims 1-3, or implement the access information processing method executed by the terminal as described in any one of claims 4-6.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the access information processing method executed by the server according to any one of claims 1 to 3 is implemented, or the access information processing method executed by the terminal according to any one of claims 4 to 6 is implemented.

Images