Authentication hosting system, business processing methods, systems, storage media and devices

Abstract

This specification provides an authentication hosting system, a business processing method, a system, a storage medium, and a device. The business processing method is applied to the authentication hosting system, which obtains target account information from a target business system, adopts an appropriate authorization strategy based on the target open platform connected to the target business system, uses the target account information to obtain access credentials from the target open platform, and provides a target interface so that the target business system can obtain the access credentials. Thus, through the authentication hosting system of this embodiment, business users only need to provide basic information to quickly connect their business systems to the open platform, without spending time familiarizing themselves with the open platform's authorization mechanism or implementing the logic for obtaining credentials, thereby improving the development efficiency of business users.

Description

Technical Field

[0001] This specification relates to the field of Internet technology, and in particular to an authentication hosting system, business processing method, system, storage medium and device. Background Technology

[0002] In the internet age, encapsulating website services into a series of easily recognizable computer-defined data interfaces and making them available to third-party developers is called an Open API, and the platform that provides Open APIs is called an open platform. A business system is a system developed by the business party that can utilize the interface capabilities provided by the open platform and leverage the resources of that open platform to implement its corresponding business functions.

[0003] In related technologies, business systems typically implement API access authorization logic internally. When developers on the business side are developing business systems by interfacing with one or more open platforms, they not only need to focus on the business implementation but also on the implementation of the authorization process between the business system and the open platform. This part of the work is highly repetitive, affecting the development efficiency of developers. Summary of the Invention

[0004] Firstly, a business processing method is provided, applied to an authentication hosting system, wherein the authentication hosting system deploys at least one authorization policy, each authorization policy being encapsulated based on the code logic corresponding to the authorization processing flow for an open platform; the method includes: obtaining target account information of a target business system on a target open platform; determining a target authorization policy from the at least one authorization policy according to the target open platform, and obtaining access credentials from the target open platform using the target account information according to the target authorization policy; and transmitting the access credentials to the target business system when the target business system requests access credentials through a target interface.

[0005] In some embodiments, the above-mentioned authentication hosting system further deploys at least one refresh strategy, each refresh strategy being encapsulated based on the code logic corresponding to the refresh credential processing flow for an open platform; the method further includes: performing invalidation detection on the access credential, and when the access credential meets preset invalidation conditions, determining a target refresh strategy for the target open platform from the at least one refresh strategy, and refreshing the access credential according to the target refresh strategy.

[0006] In some embodiments, the method further includes: sending a warning message to the management user of the authentication hosting system and / or the management user of the target business system when the access credential meets a preset expiration condition.

[0007] In some embodiments, obtaining access credentials from the target open platform using the target account information includes: accessing the authorization page of the target open platform; entering authorization account information on the authorization page, wherein the authorization account information is obtained based on the target account information; obtaining an authorization code sent by the target open platform; and applying for access credentials from the target open platform based on the authorization code.

[0008] In some embodiments, the target authorization policy includes a policy that indicates the address concatenation method for concatenating the authorization URL; before accessing the authorization page of the target open platform, the method further includes: constructing an authorization URL according to the address concatenation method indicated in the target authorization policy, wherein the authorization URL is used to access the authorization page of the target open platform.

[0009] In some embodiments, the above method further includes: storing the correspondence between the identifier of the target business system and the access credentials; the step of transmitting the access credentials to the target business system includes: obtaining the access credentials corresponding to the identifier based on the identifier carried in the request parameters transmitted by the target business system when calling the target interface, and transmitting them to the target business system.

[0010] In some embodiments, the access credentials mentioned above include an access token.

[0011] Secondly, an authentication hosting system is provided, including an information acquisition module, a business processing module, and an interface providing module. The business processing module deploys at least one authorization policy, each authorization policy being encapsulated based on the code logic corresponding to the authorization processing flow for an open platform. Specifically: the information acquisition module is configured to acquire target account information of the target business system on the target open platform; the business processing module is configured to determine a target authorization policy from the at least one authorization policy according to the target open platform, and obtain access credentials from the target open platform using the target account information according to the target authorization policy; the interface providing module is configured to transmit the access credentials to the target business system through a target interface.

[0012] In some embodiments, the above-mentioned authentication hosting system further includes: a dynamic refresh module, wherein the dynamic refresh module is deployed with at least one refresh strategy, each refresh strategy being encapsulated based on the code logic corresponding to the refresh credential processing flow for an open platform; the dynamic refresh module is configured to perform invalidation detection on the access credential, and when the access credential meets preset invalidation conditions, determine a target refresh strategy for the target open platform from the at least one refresh strategy, and refresh the access credential according to the target refresh strategy.

[0013] In some embodiments, the above-mentioned authentication hosting system further includes an early warning module, configured to send early warning information to the management user of the authentication hosting system and / or the management user of the target business system when the access credential meets a preset expiration condition.

[0014] In some embodiments, the information acquisition module described above is configured to: provide an access page for management users of the target business system to access and input target account information.

[0015] In some embodiments, the above-mentioned business processing module includes: an access submodule configured to access the authorization page of the target open platform; an input submodule configured to input authorized account information on the authorization page, wherein the authorized account information is obtained based on the target account information; and an application submodule configured to obtain an authorization code sent by the target open platform and apply for access credentials from the target open platform based on the authorization code.

[0016] In some embodiments, the target authorization policy includes a policy that indicates the address concatenation method for concatenating the authorization URL; the business processing module further includes: a concatenation submodule, configured to construct the authorization URL according to the address concatenation method indicated in the target authorization policy, and pass the authorization URL to the access submodule.

[0017] In some embodiments, the above-mentioned authentication hosting system further includes: an interface management module, configured to obtain a new authorization policy when interfaced with a new open platform, and deploy the new authorization policy to the business processing module.

[0018] Thirdly, a business processing system is provided, including at least one business system, an authentication hosting system, and at least one open platform. The authentication hosting system deploys at least one authorization policy, each authorization policy being encapsulated based on the code logic corresponding to the authorization processing flow for an open platform. Specifically: after registering on the open platform, each business system inputs its account information into the authentication hosting system; the authentication hosting system determines a target authorization policy from the at least one authorization policy based on the open platform connected to the business system, and obtains access credentials from the open platform connected to the business system using the account information according to the target authorization policy, and provides a target interface to the business system so that the business system can obtain the access credentials according to the target interface; the open platform authenticates the business system based on the account information, and upon successful authentication, transmits the access credentials to the authentication hosting system.

[0019] Fourthly, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements any of the methods described in the embodiments of the specification.

[0020] Fifthly, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement any of the methods described in the embodiments of the specification.

[0021] The technical solutions provided in the embodiments of this specification may include the following beneficial effects:

[0022] This specification discloses an authentication hosting system, a business processing method, a system, a storage medium, and a device. The business processing method is applied to the authentication hosting system to obtain target account information of a target business system. Based on the target open platform connected to the target business system, an appropriate authorization strategy is adopted. The target account information is used to obtain access credentials from the target open platform, and a target interface is provided so that the target business system can obtain the access credentials. In this way, through the authentication hosting system of this embodiment, the business party only needs to provide basic information to quickly connect the business system to the open platform without spending time on familiarizing itself with the authorization mechanism of the open platform and implementing the logic for obtaining credentials, thereby improving the development efficiency of the business party.

[0023] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this specification. Attached Figure Description

[0024] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this specification and, together with the description, serve to explain the principles of this specification.

[0025] Figure 1 This is a schematic diagram illustrating the interaction process when a business system calls an interface provided by an open platform in a related technology.

[0026] Figure 2 This is a schematic diagram illustrating an authentication hosting system according to an exemplary embodiment of this specification;

[0027] Figure 3 This is a flowchart illustrating a business processing method according to an exemplary embodiment of this specification;

[0028] Figure 4 This is a schematic diagram illustrating a business processing system according to an exemplary embodiment of this specification;

[0029] Figure 5A This is a schematic diagram illustrating the interaction process of a business processing system according to an exemplary embodiment of this specification;

[0030] Figure 5B This specification is a schematic diagram illustrating the system architecture of an authentication hosting system according to an exemplary embodiment;

[0031] Figure 5C This is a schematic diagram illustrating an authorized page according to an exemplary embodiment of this specification;

[0032] Figure 6 This specification is a hardware structure diagram of a computer device containing a business processing apparatus, according to an exemplary embodiment.

[0033] Figure 7 This is a block diagram illustrating a service processing apparatus according to an exemplary embodiment. Detailed Implementation

[0034] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this specification. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this specification as detailed in the appended claims.

[0035] The terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to be limiting of this specification. The singular forms “a,” “the,” and “the” as used in this specification and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any and all possible combinations of one or more of the associated listed items.

[0036] It should be understood that although the terms first, second, third, etc., may be used in this specification to describe various information, this information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this specification, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."

[0037] Many large internet companies now offer open platforms to facilitate developer access. An open platform refers to a software system that exposes its Application Programming Interface (API) or functions, allowing external programs to add functionality or use its resources without modifying the source code. A business system is a system developed by a business entity that can utilize the interface capabilities provided by the open platform to implement its corresponding business functions. For example, an internet company primarily engaged in online food delivery and instant delivery might provide an open platform supporting mini-program development. A catering company can develop a business system based on this platform, which can include at least one mini-program. This allows the catering company to implement mini-program ordering services, and during the business process, the system can call the interfaces provided by the open platform to achieve various functions, such as order management and inventory management.

[0038] Currently, most open platforms use the OAuth 2.0 (Open Authorization) protocol to provide standard specifications for user authentication and authorization. This means that business systems typically need to pass an access token when calling the interfaces provided by the open platform. Therefore, the business system needs to obtain the access token, i.e., the calling credential, from the open platform first. For example... Figure 1 As shown, Figure 1 This is a schematic diagram illustrating the interaction process when a business system calls an interface provided by an open platform in related technologies. The business system 11 interfaces with the open platform 12. When the business system 11 needs to call the interface provided by the open platform 12 to read target data from the open platform 12, the business system 11 and the open platform 12 implement the following interaction process:

[0039] S101, Business system 11 accesses open platform 12 using account information manually entered by administrators;

[0040] S102. Open platform 12 performs identity authentication on business system 11. After successful authentication, open platform 12 issues an authorization code to business system 11. This authorization code has a certain validity period.

[0041] S103. Business system 11 uses this authorization code to request an access token from open platform 12;

[0042] S104. Open platform 12 verifies the validity of the authorization code. After successful verification, open platform 12 issues an access token to business system 11.

[0043] S105. After obtaining the access token, the business system 11 uses the access token to call the interface of the open platform 12 to access the relevant business.

[0044] In related technologies, business systems typically implement the logic for calling credentials internally. When developers on the business side are developing business systems by interfacing with one or more open platforms, they not only need to focus on the business implementation but also on the implementation of the authorization process between the business system and the open platform. This part of the work is highly repetitive, affecting the development efficiency of developers.

[0045] Therefore, this specification provides an authentication hosting system to solve the above-mentioned problems. The embodiments of this specification will now be described in detail.

[0046] like Figure 2 As shown, Figure 2 This is a schematic diagram of an authentication hosting system according to an exemplary embodiment of this specification. The authentication hosting system 21 includes an information acquisition module 211, a business processing module 212, and an interface providing module 213. The business processing module 212 is deployed with at least one authorization strategy, each authorization strategy being encapsulated based on the code logic corresponding to the authorization processing flow for an open platform; wherein:

[0047] Information acquisition module 211 is configured to acquire target account information of target business system 22 on target open platform 23;

[0048] The business processing module 212 is configured to determine a target authorization policy from the at least one authorization policy according to the target open platform 23, and obtain access credentials from the target open platform 23 using the target account information according to the target authorization policy;

[0049] Interface providing module 213 is configured to pass the access credentials to target business system 22 through target interface.

[0050] The authentication hosting system in this embodiment can be located on the server of the business party or on the server of an agent. The agent can be a party entrusted by the business party to provide authentication hosting services for the business party's business systems. The authentication hosting system can provide services to multiple business systems simultaneously. The target business system mentioned in this embodiment can be any one of the multiple business systems connected to the authentication hosting system. The target business system can include at least one business application, such as a mini-program or official account. If the business party of the target business system is different from the platform party of the target open platform, the business applications included in the target business system can also be referred to as third-party applications.

[0051] Before developing or deploying a business system, the management user of the business system, i.e., the business party, needs to register an account on the open platform to be integrated, thus becoming a service provider for that platform. After the open platform completes the qualification verification of the management user, the management user can deploy the developed business system to realize the corresponding business. In this embodiment, the target account information obtained by the information acquisition module refers to the relevant information of the account registered by the target business system on the target open platform. This target account information may include information such as the third-party application name, service provider information, and account key information. After registration, the management user of the target business system can pass the target account information to the authentication hosting system of this embodiment, which will then help the target business system implement the logic related to authentication and authorization. In some examples, the information acquisition module can be configured to provide an access page for the management user of the target business system to access and input target account information. This access page can be a UI (User Interface) page, which the management user of the target business system can open in a browser to enter or import the target account information, so that the information acquisition module of the authentication hosting system can obtain the target account information. Of course, in other embodiments, the information acquisition module of the authentication hosting system can also acquire the target account information through other means. It should be noted that, to prevent this information from being leaked during transmission, the target account information can be processed using pre-negotiated encryption algorithms and / or system security mechanisms to ensure information security.

[0052] In the authentication hosting system of this embodiment, the business processing module is a module that automatically completes the authorization operation. This business processing module deploys at least one authorization strategy. Each authorization strategy is encapsulated based on the code logic corresponding to the authorization processing flow of an open platform. That is, the authentication hosting system can deploy multiple authorization strategies based on the authorization mechanisms of multiple open platforms, with each authorization strategy corresponding to the authorization mechanism of one open platform. Thus, the business processing module can determine the target authorization strategy corresponding to the authorization mechanism of the target open platform from multiple authorization strategies for the target business system, and then automatically complete the authorization operation according to the target authorization strategy. Optionally, the authorization strategy can be designed and encapsulated by technical personnel after analyzing the authorization mechanism of the open platform for use by the business processing module. After determining the target authorization strategy, the business processing module can execute the corresponding code logic according to the target authorization strategy, thereby simulating manual authorization. For example, if an open platform's authorization mechanism involves obtaining the AppKey (application public key, equivalent to an account) and AppSecret (application key, equivalent to a password) passed by the service provider's business system when requesting authorization, and then authenticating the business system based on the AppKey and AppSecret, issuing access credentials to the business system if the authentication is successful, so that the business system can call the corresponding backend interface through the access credentials, then the authorization strategy deployed by the business processing module for the open platform can be a set of code logic encapsulated to simulate the service provider's manual authorization operations. When the business processing module uses this authorization strategy, it can automatically complete operations such as requesting authorization and entering the AppKey and AppSecret, thereby obtaining the access credentials issued by the open platform.

[0053] In some examples, the business processing module may include: an access submodule configured to access the authorization page of the target open platform; an input submodule configured to input authorized account information on the authorization page, the authorized account information being obtained based on the target account information; and an application submodule configured to obtain an authorization code sent by the target open platform and apply for access credentials from the target open platform based on the authorization code. First, the authorization page may be a UI page provided by the target open platform to guide the user to authorize login. The target open platform can obtain the information input by the user through this authorization page. In this embodiment, the access submodule in the business processing module can automatically access the authorization page of the target open platform. In practical applications, some open platforms, for security considerations, require business systems to access their authorization pages only after passing through an authorization URL. Based on this, in other examples, the aforementioned target authorization strategy may include a strategy indicating the address concatenation method for constructing the authorization URL. The business processing module may also include: a concatenation submodule configured to construct the authorization URL according to the address concatenation method indicated in the target authorization strategy and pass the authorization URL to the access submodule. The strategy for concatenating the instruction address here can be configured based on the concatenation rules of the open platform's authorized URL. The concatenation submodule can construct the authorized URL according to this strategy and pass the authorized URL to the access submodule. In this way, the access submodule can access the authorized URL, obtain the redirect address returned by the target open platform for this access, and access the redirect address to jump to the authorization page of the target open platform.

[0054] Secondly, the authorized account information is required by the target open platform for authentication and can be obtained from the target account information. Different open platforms may require different information for authentication. For example, one open platform may require AppKey and AppSecret, while another may require the third-party application name, service provider information, etc. Therefore, the aforementioned target authorization strategy can include a policy instructing the target open platform on the required information for authentication. This input submodule can then determine the authorized account information from the target account information obtained by the information acquisition module according to this policy and input the authorized account information into the authorization page. It should be noted that some open platforms have a confirmation login button on their authorization page. During authentication, the service provider needs to manually enter the authorized account information and click this button. Therefore, in other examples, this input submodule can also be configured to automatically click the target control on the authorization page according to the target authorization strategy.

[0055] Furthermore, the target open platform authenticates the target business system based on the authorized account information. After successful authentication, the application submodule obtains an authorization code with a certain validity period from the target open platform. It then uses this authorization code to re-request access credentials from the target open platform. The target open platform verifies the validity of the authorization code, and upon successful verification, transmits the access credentials to the application submodule. Optionally, the authentication hosting system can provide an authorization callback interface to the target open platform, allowing the target open platform to call this interface to transmit the authorization code and access credentials to the application submodule.

[0056] It should be noted that if the target business system includes multiple business applications, the target account information may include the account information of each of the multiple business applications. The business processing module can obtain the access credential corresponding to each business application based on the account information of each business application. For example, if a target business system includes two business applications, namely Mini Program 1 and Mini Program 2, the target account information may include the service provider name, account key information, and other account information corresponding to Mini Program 1, as well as the service provider name, account key information, and other account information corresponding to Mini Program 2. Thus, in the authentication hosting system of this embodiment, the business processing module can obtain access credential 1 based on the account information corresponding to Mini Program 1, which is used by Mini Program 1. Similarly, the business processing module can obtain access credential 2 based on the account information corresponding to Mini Program 2, which is used by Mini Program 2.

[0057] The authentication hosting system in this embodiment also provides a target interface, enabling target business systems to call this interface to obtain access credentials. Optionally, the target interface can be a standard interface, i.e., an interface with unified standards for parameter passing methods, return methods, etc. Since the authentication hosting system can provide services to multiple business systems simultaneously, it can also include a storage module for storing the correspondence between the identifiers of target business systems and access credentials. Optionally, when the target business system includes multiple business applications, the identifier of the target business system can include an identifier corresponding to the account information of each business application. This identifier can be created and assigned to the target business system by the authentication hosting system as an identity marker when the target business system obtains access credentials from the authentication hosting system. Thus, the interface providing module of the authentication hosting system can obtain the access credential corresponding to the identifier from the storage module based on the identifier carried in the request parameters passed by the target business system when calling the target interface, and then pass the access credential to the target business system. In this way, the access credentials of the target business system can be accurately passed to the target business system, preventing them from being obtained by irrelevant users, thereby ensuring the security of the access credentials.

[0058] In summary, in the authentication hosting system of this embodiment, the information acquisition module can obtain the target account information of the target business system, the business processing module can adopt an appropriate authorization strategy based on the target open platform connected to the target business system, and use the target account information to obtain access credentials from the target open platform, and the interface providing module can pass the access credentials to the target business system through the target interface. In this way, through the authentication hosting system of this embodiment, the business party only needs to provide basic information to quickly connect the business system to the open platform without having to worry about the authorization mechanism of the open platform, thereby reducing the development cost of the business party and improving the development efficiency of the business party.

[0059] It should be noted that the access credentials mentioned above may include access tokens or other types of credentials. In other words, the authentication hosting system of this embodiment is not only applicable to open platforms based on the OAuth 2.0 protocol, but also to open platforms that provide standard specifications for user authentication and authorization based on other protocols. For example, if an open platform authenticates and authorizes service providers based on a custom protocol that uses access credentials different from access tokens, then the authentication hosting system of this embodiment can obtain the access credentials from the open platform based on its authorization policy and then pass the access credentials to the business system.

[0060] In the OAuth 2.0 mechanism, access tokens have a lifecycle, i.e., a validity period. Within this validity period, business systems can use the access token to call the open platform's interfaces. If the validity period expires, the access token becomes invalid, and the business system needs to refresh the credentials, such as obtaining a new access token or renewing the access token; otherwise, it cannot continue to call the open platform's interfaces. To address this, some embodiments in this specification provide the following solution: The authentication hosting system further includes a dynamic refresh module. The dynamic refresh module deploys at least one refresh strategy, each refresh strategy being encapsulated based on the code logic corresponding to the refresh credential processing flow for a specific open platform. This dynamic refresh module is configured to detect the invalidation of the access credential. When the access credential meets preset invalidation conditions, it determines a target refresh strategy for the target open platform from the at least one refresh strategy and refreshes the access credential according to the target refresh strategy. Similar to authorization strategies, this refresh strategy can be designed and encapsulated by technical personnel after analyzing the open platform's refresh credential mechanism, for use by the dynamic refresh module. Different open platforms may have different credential refresh mechanisms. Therefore, when maintaining the validity of access credentials for a target business system, the dynamic refresh module can determine the target refresh strategy for the target open platform from the deployed refresh strategies and execute the corresponding code logic according to the target refresh strategy, thereby simulating manual credential refresh operations. For example, if an open platform's credential refresh mechanism issues a refresh token with a longer validity period along with the access token to the business system, and upon receiving a refresh credential request carrying the refresh token from the business system, returns a new access token and a new refresh token to the business system, then the dynamic refresh module, when using the refresh strategy deployed for that open platform, can automatically send a refresh credential request carrying the refresh token to the open platform to obtain the new access token and the new refresh token returned by the open platform. In this way, the authentication hosting system in this embodiment can ensure the availability of access credentials for each business system and achieve the maintenance of access credentials for each business system.

[0061] Furthermore, whether an access credential meets a preset expiration condition can be determined based on the remaining validity period of the access credential. For example, the preset expiration condition could be that the ratio of the remaining validity period of the access credential to the total validity period is less than or equal to a preset ratio, or that the remaining validity period of the access credential is less than or equal to a preset remaining time. Taking an access credential with a validity period of 2 hours as an example, if the preset ratio is 50%, then when the remaining validity period of the access credential is less than or equal to 1 hour, the access credential is considered to meet the preset expiration condition; if the preset remaining time is 40 minutes, then when the remaining validity period of the access credential is less than or equal to 40 minutes, the access credential is considered to meet the preset expiration condition. Of course, in other embodiments, the preset expiration condition can also be set according to the needs of specific scenarios, and this specification does not limit this.

[0062] To further ensure the availability of access credentials, in some examples, the authentication hosting system may also include an early warning module, configured to send early warning information to the management users of the authentication hosting system and / or the management users of the target business system when the access credential meets preset expiration conditions. Here, the management users can refer to operations and maintenance personnel or system account administrators. When the access token meets the preset expiration conditions, i.e., is nearing expiration, the early warning module can send early warning information to the management users of the authentication hosting system and / or the management users of the target business system through a preset notification method. This preset notification method can be any one or a combination of at least two of the following: email, SMS, pop-up message, etc. Thus, by configuring notification and alarm mechanisms to comprehensively monitor and warn of access tokens, the availability of access credentials is effectively maintained. Furthermore, in other examples, the timing of the alert module sending alert information can be determined based on the processing results of the dynamic refresh module. For instance, when the remaining validity time of an access token for a business system is less than or equal to 1 hour, the dynamic refresh module refreshes the access token using the corresponding refresh strategy. At this time, the alert module can wait for 5 minutes. If, after 5 minutes, the remaining validity time of the access token for the business system is greater than 1 hour, it indicates that the dynamic refresh module has successfully completed the refresh of the access token, and the alert module does not need to send an alert. Otherwise, it indicates that the dynamic refresh module may be unable to complete the credential refresh due to abnormal conditions such as network failures during the processing. In this case, the alert module can send an alert to the management users of the authentication hosting system and / or the management users of the target business system, so that the management users of the authentication hosting system and / or the management users of the target business system can manually resolve the abnormal situation and complete the credential refresh operation. This ensures the availability of the access token as much as possible while reducing redundant reminders to the management users of the authentication hosting system / target business system.

[0063] Furthermore, it should be noted that the authentication hosting system described in this manual can also provide monitoring and early warning services for access credentials for some business systems based solely on the dynamic refresh module and the early warning module. For example, some business systems can allow management users to manually authorize access credentials. After authorization, the business system can notify the authentication hosting system of the validity period of the access credentials. The authentication hosting system can then detect the expiration of the access credentials of the business system based on the dynamic refresh module, and then send an early warning message to the management user of the business system when the access token is about to expire, so that the management user of the business system can manually refresh the credentials.

[0064] Furthermore, the authentication hosting system described in this specification can be adapted to multiple open platforms, and new open platforms can also be quickly integrated. In an optional embodiment, the authentication hosting system may further include an interface management module, configured to obtain new authorization policies when integrating with new open platforms, and deploy the new authorization policies to the business processing modules. In other words, when integrating with a new open platform, technical personnel can develop corresponding authorization policies for the authorization mechanism of that new open platform, enabling the authentication hosting system to adapt to it. Thus, when developing business systems to integrate with the new open platform, business parties do not need to concern themselves with the authorization mechanism of that new open platform; they only need to provide basic program information to the authentication hosting system of this embodiment for rapid integration, thereby saving significant integration time.

[0065] Corresponding to the above system embodiments, this specification also provides embodiments of business processing methods and business processing systems related to the system.

[0066] like Figure 3 As shown, Figure 3 This is a flowchart illustrating a business processing method according to an exemplary embodiment. The business processing method is applied to an authentication hosting system, which deploys at least one authorization policy. Each authorization policy is encapsulated based on code logic corresponding to an authorization processing flow for an open platform. The method includes:

[0067] Step 301: Obtain the target account information of the target business system on the target open platform;

[0068] Step 302: Determine the target authorization policy from the at least one authorization policy based on the target account information, and obtain access credentials from the target open platform using the target account information in accordance with the target authorization policy;

[0069] Step 303: When the target business system requests access credentials through the target interface, the access credentials are transmitted to the target business system.

[0070] In some embodiments, the above-mentioned authentication hosting system further deploys at least one refresh strategy, each refresh strategy being encapsulated based on the code logic corresponding to the refresh credential processing flow for an open platform; the method further includes: performing invalidation detection on the access credential, and when the access credential meets preset invalidation conditions, determining a target refresh strategy for the target open platform from the at least one refresh strategy, and refreshing the access credential according to the target refresh strategy.

[0071] In some embodiments, the method further includes: sending a warning message to the management user of the authentication hosting system and / or the management user of the target business system when the access credential meets a preset expiration condition.

[0072] In some embodiments, obtaining access credentials from the target open platform using the target account information includes: accessing the authorization page of the target open platform; entering authorization account information on the authorization page, wherein the authorization account information is obtained based on the target account information; obtaining an authorization code sent by the target open platform; and applying for access credentials from the target open platform based on the authorization code.

[0073] In some embodiments, the target authorization policy includes a policy that indicates the address concatenation method for concatenating the authorization URL; before accessing the authorization page of the target open platform, the method further includes: constructing an authorization URL according to the address concatenation method indicated in the target authorization policy, wherein the authorization URL is used to access the authorization page of the target open platform.

[0074] In some embodiments, the above method further includes: storing the correspondence between the identifier of the target business system and the access credentials; the step of transmitting the access credentials to the target business system includes: obtaining the access credentials corresponding to the identifier based on the identifier carried in the request parameters transmitted by the target business system when calling the target interface, and transmitting them to the target business system.

[0075] In some embodiments, the access credentials mentioned above include an access token.

[0076] like Figure 4 As shown, Figure 4This is a schematic diagram illustrating a business processing system according to an exemplary embodiment of this specification. The business processing system includes at least one business system 41, an authentication hosting system 42, and at least one open platform 43. The authentication hosting system 42 deploys at least one authorization policy, each authorization policy being encapsulated based on the code logic corresponding to the authorization processing flow for an open platform 43. Specifically: after registering with the open platform 43, each business system 41 inputs its account information into the authentication hosting system 42; the authentication hosting system 42 determines a target authorization policy from the at least one authorization policy according to the open platform to which the business system 41 is connected, and obtains access credentials from the open platform 43 to which the business system 41 is connected using the account information according to the target authorization policy, and provides a target interface to the business system 41 so that the business system 41 can obtain the access credentials according to the target interface; the open platform 43 authenticates the business system 41 according to the account information, and upon successful authentication, transmits the access credentials to the authentication hosting system 42.

[0077] For details on the implementation process of each step in the above business processing method and the implementation process of the functions and roles of each module in the above business processing system, please refer to the corresponding implementation process in the above authentication hosting system, which will not be repeated here.

[0078] To provide a more detailed explanation of the authentication hosting system in this manual, a specific embodiment is described below:

[0079] This embodiment relates to a business processing system, which includes an authentication hosting system, an open platform A, an open platform B, a business system a1 developed by connecting to open platform A, and a business system b1 developed by connecting to open platform B. Business system a1 includes mini-programs a11 and a12, and business system b1 includes official accounts b11 and b12. The authentication hosting system provides authentication hosting services for each business system. For simplicity, mini-program a11 is used as an example. The interaction process of this business processing system is as follows: Figure 5A As shown (where mini-program a11 is denoted as 51, authentication hosting system as 52, and open platform A as 53), the interaction process includes:

[0080] S501. The authentication hosting system obtains the target account information entered by the service provider of the mini-program a11. This target account information is the account information obtained by the service provider when registering on the open platform A, including the name of the mini-program a11, the service provider's name, account key information, etc.

[0081] The system architecture of the authentication hosting system is as follows: Figure 5BAs shown, the authentication hosting system provides a UI page at the user interaction layer. The service provider of the mini-program a11 can access the UI page to enter the target account information. At least one piece of information in the target account information is processed by a pre-negotiated encryption algorithm and system security mechanism.

[0082] S502. The authentication hosting system constructs and accesses the authorization URL according to the authorization mechanism of Open Platform A to redirect to the authorization page of Open Platform A, and enters the authorization account information on the authorization page;

[0083] The authentication hosting system deploys multiple authorization policies, including a first authorization policy for the authorization mechanism of Open Platform A. Open Platform A's authorization mechanism includes the authorization process, the rules for concatenating the authorization URL, and the information required to be entered on the authorization page. Correspondingly, the authentication hosting system uses this first authorization policy and can perform authorization operations such as constructing the authorization URL, accessing the authorization page, and entering authorization account information according to its authorization process. The authorization page can be configured as follows: Figure 5C As shown, this includes a "Confirm Authorization Login" button control. The authentication hosting system can simulate a human, automatically clicking the button control after the authorized account information is entered on the authorization page.

[0084] S503. Open Platform A receives the authorized account information transmitted by the authentication hosting system and performs authentication based on the authorized account information;

[0085] In this embodiment, the authorized account information includes the service provider name and account key information of the mini-program a11. The database of the open platform A stores the account information of each registered business application, so the mini-program a11 can be authenticated based on the authorized account information.

[0086] S504. Open Platform A confirms successful authentication and passes the access token to the authentication hosting system through the authorization callback interface provided by the authentication hosting system.

[0087] In this embodiment, Open Platform A adopts a simplified mode of directly issuing tokens, while Open Platform B adopts an authorization code mode. Open Platform B confirms that the authentication is successful and returns an authorization code. When the authentication hosting system sends a request to Open Platform B for an access token, it carries the authorization code in the request parameters. Open Platform B confirms the validity of the authorization code and issues the access token after the confirmation is successful.

[0088] S505. The authentication and management system continuously performs expiration checks on the access token, that is, it checks whether the access token is about to expire.

[0089] from Figure 5BAs shown in the system architecture of the authentication hosting system, the authentication hosting system provides a task scheduler to implement the task scheduling function of the business function layer. The task scheduler can monitor the remaining validity time of the access tokens of each business application at the same time to detect whether each access token is about to expire. In this embodiment, the validity time of the access token of the mini program a11 is 2 hours. When the remaining validity time of the access token is less than or equal to 1 hour, the task scheduler determines that the access token is about to expire.

[0090] S506. When the access token is about to expire, the authentication hosting system sends a refresh token to the open platform A according to the refresh credential mechanism of the open platform A to refresh the access token. At the same time, the authentication hosting system outputs a warning message.

[0091] In this embodiment, the refresh token is issued to the authentication hosting system along with the access token by open platform A. The validity period of the refresh token is longer than that of the access token. The authentication hosting system can refresh the token to exchange for a new access token from open platform A. It should be noted that, unlike the refresh credential mechanism of open platform A, the refresh credential mechanism of open platform B refreshes the access token through AppKey and AppSecret. Therefore, when the access token of business system b1 is about to expire, the authentication hosting system can send AppKey and AppSecret to open platform B to refresh the access token of business system b1. Similar to the authorization policy, the authentication hosting system can deploy two refresh policies, corresponding to the refresh credential mechanisms of open platform A and open platform B respectively. Different refresh policies can be processed by different business processors in the authentication hosting system. At the same time, the authentication hosting system is configured with a notification and alarm mechanism. When the access token is about to expire, it sends warning information to the management users of the authentication hosting system via email, SMS, etc., to reduce the situation where automatic refresh fails due to abnormal conditions, thus making the access token unusable.

[0092] S507. The authentication hosting system receives the new access token sent by the open platform A and continues to maintain the access token.

[0093] Correspondingly, the authentication hosting system also receives a new refresh token sent by Open Platform A, and the task scheduler continues to perform expiration checks on the new access token;

[0094] S508. When the mini-program a11 needs to call the backend interface of the open platform A, it obtains an access token through the standard interface provided by the authentication hosting system.

[0095] The authentication hosting system stores the correspondence between the identifiers of each business application and the access tokens of each business application. When the mini program a11 requests an access token through the standard interface provided by the authentication hosting system, the request parameters passed carry the identifier of the mini program a11. The authentication hosting system can determine the access token of the mini program a11 from the multiple access tokens it maintains based on the identifier, and return the access token of the mini program a11 to the mini program a11 through the standard interface.

[0096] S509 and Mini Program a11 use this access token to call the backend interface of Open Platform A.

[0097] The process for the authentication hosting system to provide authentication hosting services for Mini Program a12, Official Account b11, and Official Account b12 can be found in the implementation process of each step in the above process.

[0098] In practical applications, it is common for business users to develop multiple business applications based on an open platform. In related technologies, when developing each business application, the business users' developers need to first understand the authorization mechanism of the open platform and then implement the logic of obtaining and calling credentials within the business application. This results in a lot of repetitive work and affects the development efficiency of the developers.

[0099] As can be seen from the above process, this embodiment establishes a unified authorization management center, namely an authentication hosting system. This system provides unified authentication and interface standards, enabling various business applications to quickly access and use the open platform. This allows developers from different business units to focus solely on business implementation, without spending time on familiarizing themselves with the open platform's authorization mechanisms or implementing logic for obtaining and refreshing credentials, thus reducing development costs. In other words, the authentication hosting system provided in this embodiment, through the analysis and integration of the authorization mechanisms of various open platforms, effectively reduces repetitive work for different business units in developing their applications, solving the problems mentioned above in the related technologies. Furthermore, this authentication hosting system also provides monitoring and early warning functions, enabling timely detection of token expiration and other anomalies, effectively ensuring token availability.

[0100] Corresponding to the embodiments of the aforementioned business processing methods, this specification also provides embodiments of a business processing apparatus and the terminal to which it is applied.

[0101] The embodiments of the business processing device described in this specification can be applied to computer equipment, such as servers or terminal devices. The authentication hosting system described in this specification can be implemented by at least one such computer device. The embodiments of the business processing device can be implemented through software, hardware, or a combination of both. Taking software implementation as an example, as a logical device, it is formed by a processor that processes the file and reads the corresponding computer program instructions from non-volatile memory into memory for execution. From a hardware perspective, such as... Figure 6 The diagram shown is a hardware structure diagram of a computer device containing the service processing apparatus in an embodiment of this specification. Except for... Figure 6 In addition to the processor 610, memory 630, network interface 620, and non-volatile memory 640 shown, the server or electronic device where the device 631 is located in the embodiment may also include other hardware depending on the actual function of the computer device, which will not be described in detail here.

[0102] Accordingly, embodiments of this specification also provide a computer storage medium storing a program that, when executed by a processor, implements the method in any of the above embodiments.

[0103] The embodiments of this specification may take the form of a computer program product implemented on one or more storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing program code. Computer-usable storage media include permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information may be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to: phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device.

[0104] like Figure 7 As shown, Figure 7 This is a block diagram illustrating a business processing apparatus according to an exemplary embodiment of this specification. The apparatus deploys at least one authorization policy, each authorization policy being encapsulated based on code logic corresponding to an authorization processing flow for an open platform; the apparatus includes:

[0105] Module 71 is used to obtain target account information of the target business system on the target open platform;

[0106] The authorization module 72 determines a target authorization policy from the at least one authorization policy according to the target open platform, and obtains access credentials from the target open platform using the target account information in accordance with the target authorization policy;

[0107] The transmission module 73 is used to transmit the access credential to the target business system when the target business system requests the access credential through the target interface.

[0108] The specific implementation process of the functions and roles of each module in the above-mentioned device can be found in the implementation process of the corresponding module in the above-mentioned managed authentication system, and will not be repeated here.

[0109] For the apparatus embodiment, since it basically corresponds to the method embodiment, the relevant parts can be referred to in the description of the method embodiment.

[0110] The device embodiments described above are merely illustrative. The modules described as separate components may or may not be physically separate, and the components shown as modules may or may not be physical modules; that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of the solution described in this specification, depending on actual needs. Those skilled in the art can understand and implement this without any inventive effort.

[0111] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0112] Other embodiments of this specification will readily occur to those skilled in the art upon consideration of the specification and practice of the invention claimed herein. This specification is intended to cover any variations, uses, or adaptations that follow the general principles of this specification and include common knowledge or customary techniques in the art not claimed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this specification are indicated by the following claims.

[0113] It should be understood that this specification is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this specification is limited only by the appended claims.

[0114] The above description is merely a preferred embodiment of this specification and is not intended to limit this specification. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of protection of this specification.

Claims

1. A service processing method characterized by, The method is applied to an authentication hosting system, the authentication hosting system is deployed with at least one authorization strategy, each authorization strategy is encapsulated based on code logic corresponding to an authorization processing flow of an open platform; the method comprises: obtaining target account information of a target business system on a target open platform; determining a target authorization strategy from the at least one authorization strategy according to the target open platform, and obtaining access credentials from the target open platform by using the target account information according to the target authorization strategy; when the target business system requests the access credentials through a target interface, delivering the access credentials to the target business system; the step of obtaining the access credentials from the target open platform by using the target account information comprises: accessing an authorization page of the target open platform; inputting authorization account information in the authorization page, the authorization account information being obtained according to the target account information; obtaining an authorization code sent by the target open platform, and applying for the access credentials from the target open platform according to the authorization code; the target authorization strategy comprises a strategy indicating an address splicing mode of splicing an authorization URL; before the step of accessing the authorization page of the target open platform, the method further comprises: constructing an authorization URL according to the address splicing mode indicated in the target authorization strategy, the authorization URL being used to access the authorization page of the target open platform.

2. The method of claim 1, wherein, The authentication hosting system is further deployed with at least one refresh strategy, each refresh strategy is encapsulated based on code logic corresponding to a refresh credential processing flow of an open platform; the method further comprises: detecting invalidation of the access credentials, when the access credentials satisfy a preset invalidation condition, determining a target refresh strategy for the target open platform from the at least one refresh strategy according to the target open platform, and refreshing the access credentials according to the target refresh strategy.

3. The method according to claim 1 or 2, characterized in that, the method further comprises: when the access credentials satisfy the preset invalidation condition, sending early warning information to a management user of the authentication hosting system and / or a management user of the target business system.

4. The method of claim 1, wherein, the method further comprises: storing a correspondence between an identifier of the target business system and the access credentials; the step of delivering the access credentials to the target business system comprises: obtaining the access credentials corresponding to the identifier from the request parameters delivered by the target business system when the target business system calls the target interface, and delivering the access credentials to the target business system.

5. The method according to any one of claims 1, 2, 4, characterized in that, The access credentials comprise an access token.

6. An authentication hosting system, characterized by The system comprises an information obtaining module, a business processing module, and an interface providing module, the business processing module is deployed with at least one authorization strategy, each authorization strategy is encapsulated based on code logic corresponding to an authorization processing flow of an open platform; wherein: the information obtaining module is configured to obtain target account information of a target business system on a target open platform; the business processing module is configured to determine a target authorization strategy from the at least one authorization strategy according to the target open platform, and obtain access credentials from the target open platform by using the target account information according to the target authorization strategy; The interface providing module is configured to pass the access credential to the target business system through a target interface; The business processing module comprises: An access submodule configured to access an authorization page of the target open platform; An input submodule configured to input authorization account information in the authorization page, the authorization account information being obtained according to the target account information; An application submodule configured to obtain an authorization code sent by the target open platform, and apply for an access credential from the target open platform according to the authorization code; The target authorization strategy comprises a strategy indicating an address splicing manner of splicing an authorization URL; the business processing module further comprises: A splicing submodule configured to construct an authorization URL according to the address splicing manner indicated in the target authorization strategy, and pass the authorization URL to the access submodule.

7. The system of claim 6, wherein, Further comprising: A dynamic refreshing module, the dynamic refreshing module being deployed with at least one refreshing strategy, each refreshing strategy being encapsulated based on code logic corresponding to a refreshing credential processing flow for one open platform; The dynamic refreshing module is configured to perform invalidity detection on the access credential, determine a target refreshing strategy for the target open platform from the at least one refreshing strategy when the access credential meets a preset invalidity condition, and refresh the access credential according to the target refreshing strategy.

8. The system of claim 6 or 7, wherein, Further comprising: An early warning module configured to send early warning information to a management user of the authentication hosting system and / or a management user of the target business system when the access credential meets a preset invalidity condition.

9. The system of claim 6, wherein, The information obtaining module is configured to: Provide an access page for a management user of the target business system to access and input target account information.

10. The system of claim 6, wherein, Further comprising: A storage module configured to store a correspondence between an identifier of the target business system and the access credential; The interface providing module is configured to: Obtain the access credential corresponding to the identifier from the storage module according to the identifier carried in a request parameter passed by the target business system when calling the target interface, and pass the access credential to the target business system.

11. The system of claim 6, wherein, Further comprising: A connection management module configured to obtain a new authorization strategy when connecting a new open platform, and deploy the new authorization strategy to the business processing module.

12. A service processing system, characterized by The system comprises at least one business system, an authentication hosting system, and at least one open platform, the authentication hosting system being deployed with at least one authorization strategy, each authorization strategy being encapsulated based on code logic corresponding to an authorization processing flow for one open platform; wherein: Each business system inputs account information into the authentication hosting system after being registered with the open platform; The authentication hosting system determines a target authorization strategy from the at least one authorization strategy according to an open platform connected by the business system, and obtains an access credential from the open platform connected by the business system according to the target authorization strategy and the account information, and provides a target interface to the business system, so that the business system obtains the access credential according to the target interface; The open platform authenticates the business system according to the account information, and passes access credentials to the authentication hosting system when the authentication is passed; The access credentials are obtained from the open platform connected with the business system by using the account information, and the method comprises the following steps: Accessing an authorization page of the open platform connected with the business system; Inputting authorization account information in the authorization page, wherein the authorization account information is obtained according to the account information; Obtaining an authorization code sent by the open platform connected with the business system, and applying for access credentials from the open platform connected with the business system according to the authorization code; The target authorization strategy comprises a strategy indicating an address splicing mode of splicing an authorization URL; Before the step of accessing the authorization page of the open platform connected with the business system, the method further comprises the following steps: According to the address splicing mode indicated in the target authorization strategy, an authorization URL is constructed, and the authorization URL is used to access the authorization page of the open platform connected with the business system.

13. A computer device, comprising: A computer program product, comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor implements the method of any one of claims 1 to 5 when executing the program.

14. A computer-readable storage medium, characterized in that, A computer program product, comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor implements the method of any one of claims 1 to 5 when executing the program.

Images