Method and system for running applications based on oauth2 protocol and private device

Abstract

The application discloses an application running method and system based on an OAuth2 protocol and a private device, relates to the technical field of computer systems, and saves application data by building a private device, distributes the application to a client and the private device through an application platform, and realizes end-to-end data encryption transmission based on the OAuth2 protocol through installation, authorization, authentication, access and other operations of the application of the client and the private device, so that data leakage is avoided to the greatest extent, and the data of a user truly belongs to the user.

Description

Technical Field

[0001] This invention relates to the field of computer system technology, and specifically to an application operation method and system based on the OAuth2 protocol and private devices. Background Technology

[0002] In current computer systems, service providers store user application data in the cloud via cloud platforms, enabling data synchronization across different user devices. Data can be recovered from reset devices and downloaded to new devices, significantly improving convenience. However, if the cloud platform storing application data is maliciously compromised, data leakage can occur. To address this, service providers typically enhance data encryption algorithms to improve the security of cloud platform data storage. However, the data content remains transparent and accessible to the service provider, and this approach does not effectively prevent malicious attacks, cannot minimize the risk of application data leakage, and fails to guarantee data privacy and security. Summary of the Invention

[0003] The purpose of this invention is to propose an application operation method and system based on the OAuth2 protocol and private devices. By setting up a private device and storing application data, end-to-end encrypted data transmission between the client that installed the application and the private device is realized based on the OAuth2 protocol, thereby minimizing data leakage and ensuring that the user's data truly belongs to them.

[0004] To achieve the above objectives, the present invention adopts the following technical solution:

[0005] A method for running an application based on the OAuth2 protocol and a private device, implemented using a client, a private device, and an application platform, includes application query steps and application installation steps, wherein:

[0006] The application query steps include:

[0007] Users send application query requests to private devices via the client;

[0008] The private device requests the application's unique Applet ID and required service permissions from the application platform based on the application's query request.

[0009] The application platform generates the application's Applet ID and latest version information (Applet Version), as well as the private device's latest version information (Box Version), verifies whether the application download is correct, and then sends the Applet ID, AppletVersion, and Box Version to the private device;

[0010] The private device sends the returned Applet ID and Applet Version information to the client, and the user queries the list of currently installed applications through the client;

[0011] The application installation step includes:

[0012] The user selects an application to be installed on the client, and the client automatically sends an application installation request to the private device to request calling an installation interface;

[0013] The private device sends a request for downloading a resource package to the application platform, with the Applet ID, Applet Version of the application and the Box Version information of the private device;

[0014] The application platform queries the current latest version number of the application according to the Applet ID, evaluates and confirms the lowest version that can be supported by the private device, forms a return information and returns it to the private device;

[0015] After receiving the return information, the private device locally deploys the latest version of the application and records the installation information; if the version of the private device is too low to query the application, the private device prompts to upgrade the version of the private device; after the private device installs the latest version, the private device locally deploys the latest version of the application; if the private device supports the latest version of the application, the private device prompts that the support is successful;

[0016] The private device sends the application resource package to the client, and the client installs the application.

[0017] Preferably, if an available application has been installed on the private device, the user only needs to request the private device to download the local application resource package for installation when using, without the need to download through the application platform again.

[0018] Preferably, the method further includes an application updating step:

[0019] When the client updates the application, the client sends an application updating request to the private device, with the Applet ID and Applet Version information of the application;

[0020] After receiving the application updating request, the private device compares the Applet Version information carried in the request with the resource version information of the application that already exists locally to determine whether the application needs to be updated;

[0021] If the version needs to be updated, the private device sends a new request to the application platform, with the Applet ID, Applet Version and Box Version to request the latest resource information;

[0022] The application platform queries the latest version of the application and the minimum version Box Version information supported by the private device for the latest version of the application according to the Applet ID, and sends them to the private device;

[0023] After the private device receives the resource package of the latest version of the application, it is localized and deployed. If it cannot be supported due to the low version of the private device, the private device will feedback to the client that the private device does not support the latest version of the application, and prompt to upgrade the version of the private device; if the private device supports the latest version of the application, it will prompt successful support;

[0024] The client directly requests the local application resource package from the private device, and the private device sends the application resource package to the client for updating.

[0025] Preferably, the client includes a main client, a member client authenticated by the main client, other terminals authenticated by the main client, and other terminals of the member client authenticated by the main client.

[0026] Preferably, the client that is successfully bound to the private device for the first time is defaulted as the main client, the main client performs root authentication with the corresponding private device by using a public-private key, and the authentication of the member client or other terminal by the main client is based on the root authentication as a prerequisite.

[0027] Preferably, after the main client performs root authentication, that is, after the main client and the private device perform public-private key encryption exchange, the main client generates a unique identification code User ID of the administrator identity; when the main client authenticates the installed application, the application identifies and compares the string identification of the User ID, and then obtains the access permission Scope of the application; at the same time, the application generates an independent record list, including: the unique identification code Applet ID of the application, the authentication key Applet secret of the application, Scope, and User ID.

[0028] Preferably, after the member client is authenticated by the main client, a unique identification code User ID of the member user is generated, the access permission Scope of the application and the unique identification code Applet ID of the application are obtained; when the member client establishes authentication with the installed application, the application generates an independent record list, including: the Applet ID string, the authentication key Applet secret of the application, Scope, and User ID.

[0029] Preferably, the main client authorizes other terminals of the main client by setting an authentication mode; the member client authorizes other terminals of the member client by setting an authentication mode.

[0030] Preferably, the application distribution service provided by the application platform comprises: accepting an application designed by a developer, and providing registration, release, storage, installation and update services for the application, so that the application is normally installed and updated on the private device and the client.

[0031] Preferably, the ID information Box ID of the private device needs to be obtained before the application is run, and the Box ID is obtained by the user when the private device is bound with the client.

[0032] Preferably, the following four functions are realized based on the client, the private device and the application platform:

[0033] The authentication function refers to obtaining the authorization of the application permission by the client, cross-domain calling the user authorization information, and confirming the processing of the user authorization;

[0034] The management and distribution function refers to generating a storage management data list, and the data comprises an application unique identification code AppletID string, an application authentication key Applet secret string, an application access permission Scope and a user unique identification code User ID character;

[0035] The individual function refers to designing in combination with the individual function demand of the user, and legally calling the open interface of the required authorization permission;

[0036] The development and sharing function refers to providing the application development and design interface for the developer.

[0037] An application running system based on an OAuth2 protocol and a private device comprises:

[0038] The client is installed on a user terminal, and the user installs an application through the client and establishes data interaction with the private device through the application;

[0039] The private device comprises a processor and a memory, and is used for providing application services for the client and performing end-to-end data security sharing with the client through the application;

[0040] The application platform is used for providing an application distribution service for the private device and the client;

[0041] When an application query is performed, the user sends an application query request to the private device through the client; the private device applies for the unique identification code Applet ID of the application and the required service permission to the application platform according to the application query request; the application platform generates the Applet ID and the latest version information Applet Version of the application, and the latest version information Box Version of the private device, and checks whether the download of the application is correct, and then sends the Applet ID, the Applet Version and the Box Version to the private device; the private device sends the returned Applet ID and Applet Version information to the client, and the user queries the current installed application list through the client;

[0042] When an application installation is performed, the user selects an application to be installed on the client, and the client automatically sends an application installation request to the private device to request to call an installation interface; the private device sends a request for downloading a resource package to the application platform according to the Applet ID, the Applet Version and the Box Version information of the private device; the application platform queries the current latest version number of the application according to the Applet ID, evaluates and confirms the lowest version that can be supported by the private device, forms a return information and returns to the private device; if the version of the private device is too low to query the application, the private device is prompted to upgrade the version of the private device; after receiving the return information, the private device installs the latest version of the private device and locally deploys the latest version of the application, and records the installation information; if the private device supports the latest version of the application, it is prompted that the support is successful; the private device sends the application resource package to the client, and the client installs the application.

[0043] Preferably, the client includes a main client, a member client authenticated by the main client, other terminals authenticated by the main client, and other terminals of the member client authenticated by the main client.

[0044] The application proposes an application running method and system based on an OAuth2 protocol and a private device, the program application is run in a client or a private device, and a user can download and install an application into a corresponding client or private device to realize expansion of a function of the private device. The system can also provide a special developer mode for a third-party developer, based on which the third-party developer can submit a self-developed application to an application platform of the system, so that the user can enjoy more abundant functions and experience. Meanwhile, the implementation scheme of the system still specially pays attention to data security and privacy protection of the user, and the authorization, authentication and access device of the system are all based on the principle that the platform side cannot obtain user data. BRIEF DESCRIPTION OF DRAWINGS

[0045] Figure 1 is a schematic diagram of the interaction relationship among the client, the private device and the application platform in the embodiment.

[0046] Figure 2 is a schematic diagram of the application authentication process of the master client.

[0047] Figure 3 is a schematic diagram of the application authentication process of the member client.

[0048] Figure 4 is a schematic diagram of the application authentication process of the terminal of the master client.

[0049] Figure 5 is a schematic diagram of the application authentication process of the terminal of the member client.

[0050] Figure 6 is a schematic diagram of the functional module of the application. DETAILED DESCRIPTION

[0051] In order to make the above features and advantages of the present application more apparent and easy to understand, the following embodiments are specifically described, and the accompanying drawings are described in detail as follows.

[0052] The embodiment is specifically based on an application running system based on the OAuth2 protocol and the private device, and realizes an application running method based on the OAuth2 protocol and the private device. The system includes a client, a private device and an application platform. The system enables a user to expand the function by downloading an application from the application platform to the corresponding client or the private device. The embodiment takes an applet as an application example for illustration, but is not limited thereto. A third-party developer can contribute a personalized applet by self-development, realize the linkage of the private device and the client, and provide more rich function selection for the user. The system provides an authentication and authorization scheme based on the OAuth2 protocol, which is not only used for a single user and a single terminal, but also used for realizing convenient access of multiple users and multiple terminals.

[0053] The client corresponds to the private device, and the user can download an applet to the client side to realize the access to the private device. The applet is installed in the private device or the client, and is installed, authorized and selected by the user on the client side to use the required function and service. In order to protect the personal privacy and data security of the user, an end-to-end encryption security transmission scheme is used, so that the user can be guaranteed in the use of the expanded function and the data security at the same time.

[0054] The private device is a hardware device including a processor and a memory. The device starts to run and execute the end-to-end encryption security transmission module and the application service on the client side.

[0055] The application platform runs an application system, which is, for example, an application store or an application market, to provide an application distribution service for private devices and clients, including: accepting an application developed and designed by a developer, and providing registration, uploading, storage, downloading, updating, and the like for the application; the platform provides support for the demand of users for individualized functions realized by innovative applications, and optimizes the use experience on each terminal side. The system enables the developer to submit a small application to the application platform, so that the user can select one or more small applications and install them on the client or private device. For example, for a contact application, the user can select to download the application to realize contact synchronization, and ensure convenient access to the function on multiple terminals.

[0056] The interaction relationship between the client, the private device, and the application platform of the system is shown in Figure 1 as follows:

[0057] 1. The process of querying a small application Applet is as follows:

[0058] S11: The user selects a small application to be installed in the client, and the client automatically sends a request to query all applications to the private device;

[0059] S12: The private device side sends the query request to the application platform side, applies for an application unique identification code Applet ID and the corresponding required service permission, such as address book permission Addressbook, through the application platform;

[0060] S13: The application platform generates the Applet ID and the latest version information, which includes the version of the small application Applet Version and the version of the private device Box Version, and verifies whether the download of the small application is correct through H5, and then returns the Applet ID and the latest version information to the private device;

[0061] S14: The private device sends the returned Applet ID and Applet Version information to the client side, and the user can query the list of currently installed applications through the client.

[0062] 2. The process of installing a small application Applet is as follows:

[0063] S21: The user selects an application to be installed in the client, and the client automatically sends a corresponding installation request to the private device to request to call an installation interface;

[0064] S22: The private device sends a request to download an H5 resource package to the application platform side, carrying the Applet ID, Applet Version, and Box Version;

[0065] S23: The application platform side queries the current latest version number according to the Applet ID, evaluates and confirms the lowest version that is suitable for the current private device and forms a return information, and returns the information to the corresponding private device.

[0066] S24: If the required function of the corresponding applet cannot be queried due to the low version of the private device, the private device is prompted to upgrade the version of the private device. After receiving the return information, the private device starts running the web localization deployment and records the installed information, facilitating subsequent query and use. If the private device supports the latest version of the applet, success is prompted, and the local H5 resource is directly requested from the private device.

[0067] S25: The private device side returns the resource information, and the user can start using the applet.

[0068] According to some embodiments, if the available applet program has been installed on the private device, but the user does not replace the terminal for logging in and using the client, the user only needs to request the local H5 resource from the private device when using, without the need to download from the application platform.

[0069] According to some embodiments, if the update of the applet is requested by the client from the private device side, the Applet ID and the version number V1 are carried, the private device accepts the comparison of the requested version number and the existing resource version number V2 in the local device. If the version needs to be updated, the private device sends a new request to the application platform, carrying the Applet ID, the version number V1 and the Box Version, and requests the latest H5 resource. The application platform queries the latest version number according to the Applet ID and the lowest version Box Version that supports the latest version of the application by the private device, returns the information to the private device, and the private device receives the latest H5 resource package (application latest version), performs web localization re-deployment, and records the Applet update record in the database. If the private device cannot support due to the low version, the client is fed back the message that the private device does not support the initial version of the Applet, and is prompted to upgrade the version of the private device. If the private device supports the latest version of the Applet, success is prompted. After the above steps are performed, the local H5 resource is directly requested from the private device, the resource information is returned by the private device side, and the user can start using the applet.

[0070] According to some embodiments, when the user requests to uninstall the applet, the private device accepts the uninstall command, uninstalls the local application program, and deletes the installation record of the corresponding database. The user realizes the successful local uninstallation of the applet.

[0071] According to some embodiments, the client is a software installed on a terminal device for a user, and is an authorized subject of the authenticated application, which is not limited to a single user and is not limited to a single terminal. Specifically, the client side can have one user and simultaneously mean multiple terminals, wherein the first authenticated terminal client is the main client, and other terminal clients used by the user are other terminals of the main client. The client side can also have more than one user, wherein the first authenticated client user is the administrator, and other users are members, and the clients used by the members are member clients. Similarly, each member on the client side is not limited to using only one terminal, but can also use multiple terminals simultaneously, wherein the first authenticated terminal client is the member client, and other terminal clients used by the members are other terminals of the member client. According to the authentication hierarchy relationship between the client and the application, the authorized subject of the authenticated application is in turn: the main client, the member client authenticated by the main client, the other terminal authenticated by the main client, the other terminal of the member client authenticated by the main client; and the main client authorized based on the main client can be a trusted subject to ensure data security. The above terminals can be the same or different types of electronic devices, such as desktop computers, notebook computers, tablets, mobile phones, etc., and are not limited thereto.

[0072] According to some embodiments, the small application running requires a unique identification code Box ID of the private device to be obtained in advance, which is obtained when the user binds the private device using the client. The user's running use of the private device is effective after the user binds to obtain the Box ID based on the client activation of the terminal.

[0073] According to some embodiments, the client that is successfully bound to the private device for the first time is the default main client. As shown in Figure 2 The main client side has a pre-existing public-private key encryption exchange with the private device, and the main client generates a special administrator identity unique identification code User ID: Admin at this time. When the main client application is authenticated, the application side identifies and compares the string identification of the User ID to obtain the access permission of the application. In the process of mutual authentication, the application side generates an independent record list, including the Applet ID string, the application authentication key Applet Secret string, the application access permission Scope, and the User ID character Admin.

[0074] According to some embodiments, the authentication subject of the application is the member client. As shown in Figure 3As shown, there can be multiple users on the private device who can independently use the application, but the authorization of the main client administrator user is required, and the member client generates a member user identity unique identifier User ID at this time, and the authorized small application and client can be used in the same way. The authorized user is a member user, and the member user must first establish an authentication relationship with the main client to obtain access to the application and Applet ID. The member user establishes an authentication relationship with the application, and the application generates an independent record list including Applet ID string, Applet Secret string, Scope, and User ID character.

[0075] According to some embodiments, the authorized subject of the application includes other terminals authenticated by the client, and other terminals of the member client authenticated by the main client. To achieve convenient access, the users on the main client and the member client can authorize the login on other clients at any time, and realize the linkage use of the client and the application. As shown, Figure 4 As shown, to realize the use of the application anytime and anywhere on the main client side, the authentication method set on the main client side can be used, such as the combination of QR code scanning and authorization code, after verification, the user can log in on other terminals, and directly obtain the application function to realize convenient operation. As shown, Figure 5 As shown, multiple users and multiple terminals can also realize the access to the application anytime and anywhere.

[0076] According to some embodiments, when different users obtain the access permission of the same Applet ID, the specific function selection and function permission of the application are independently allocated and determined by each user, and the application calling data between users is isolated, and there is no possibility of random access, transmission, and calling of information in the default setting, so as to ensure the information security of each user and enjoy the self-determination right of personal data.

[0077] According to some embodiments, as shown, Figure 6 As shown, the system realizes the authorization authentication function, management allocation function, individual function, and development sharing function around the small application.

[0078] Among them, the authentication function refers to the authorization of the application permission of the main client, the member client, and other terminals, the cross-domain calling of user authorization information, the confirmation of user authorization, and the like.

[0079] The management allocation function refers to the generation of a storage management data list, and the data includes Applet ID string, Applet Secret string, Scope, and User ID character, and the like.

[0080] The individual function is a core function module for the small application. The small application can be designed to call the corresponding authorized permission according to the individual function demand of the user. The small application can be designed with one or more groups of permissions. After the user confirms, the open interface with the corresponding permission can be legally called. For example, the address book includes the read, write and other permissions of the configured address book. The small application itself is designed to expand the function, provide one or more selectable applications to the user and install the application to the client device or the private device, so that the user can select to download the individual application service. The application can generate an application directory (list) and display it to the user client device, so that the user can select to download the individual application service.

[0081] The development sharing function is a function module specially designed for the developer. The developer can develop and design the application based on the open sharing function, provide the code to the application platform, combine with the application platform, realize the user individual function demand through the innovative application, provide the support and optimize the use experience of each terminal side.

[0082] Although the present application has been disclosed as above with the embodiments, it is not intended to limit the present application. The appropriate modification or equivalent replacement of the technical solution of the present application made by the ordinary skilled in the art should be covered in the protection scope of the present application. The protection scope of the present application is defined by the claims.

Claims

1. A method for running an application based on an OAuth2 protocol and a private device, based on a client, a private device and an application platform, characterized in that, The method comprises an application query step and an application installation step, wherein: The application query step comprises: The user sends an application query request to the private device through the client; The private device applies for the unique identification code Applet ID of the application and the required service permission to the application platform according to the application query request; The application platform generates the Applet ID and the latest version information Applet Version of the application, and the latest version information Box Version of the private device, and verifies whether the download of the application is correct, and then sends the Applet ID, the Applet Version and the Box Version to the private device; The private device sends the returned Applet ID and Applet Version information to the client, and the user queries the list of the currently installed applications through the client; The application installation step comprises: The user selects an application to be installed on the client, and the client automatically sends an application installation request to the private device to request to call an installation interface; The private device sends a request for downloading a resource package to the application platform according to the Applet ID, the Applet Version and the Box Version of the private device; The application platform queries the current latest version number of the application according to the Applet ID, evaluates and confirms the lowest version that can be supported by the private device, forms a return information and returns to the private device; After receiving the return information, the private device locally deploys the latest version of the application and records the installation information; if the version of the private device is too low to query the application, the private device prompts to upgrade the version of the private device; after the private device installs the latest version, the private device locally deploys the latest version of the application; if the private device supports the latest version of the application, the private device prompts that the support is successful; The private device sends the application resource package to the client, and the client installs the application.

2. The method of claim 1, wherein, If the application that can be used has been installed on the private device, the user only needs to request the private device to download the local application resource package for installation when using, and does not need to download through the application platform again.

3. The method of claim 1, wherein, The method further comprises an application update step: When the client updates the application, the client sends an application update request to the private device, and carries the Applet ID and the Applet Version information of the application; After receiving the application update request, the private device compares the Applet Version information carried in the request with the resource version information of the application that already exists in the local to determine whether the application needs to be updated; If the version needs to be updated, the private device sends a new request to the application platform, carries the Applet ID, the Applet Version and the Box Version, and requests the latest resource information; The application platform queries the latest version of the application and the lowest version Box Version of the private device that supports the latest version of the application according to the Applet ID, and sends the information to the private device; The private device receives the resource package of the latest version of the application for localization deployment. If the private device cannot support the initial version of the application due to a too low version of the private device, the private device feeds back a message that the private device does not support the initial version of the application to the client and prompts to upgrade the version of the private device. If the private device supports the latest version of the application, the private device prompts successful support. The client directly requests the local application resource package from the private device, and the private device sends the application resource package to the client for updating.

4. The method of claim 1, wherein, The client includes a main client, a member client authenticated by the main client, other terminals authenticated by the main client, and other terminals of the member client authenticated by the main client. The client that is bound to the private device for the first time is defaulted as the main client. The main client performs root authentication with the corresponding private device by using a public-private key. The authentication of the member client or other terminal by the main client is based on the root authentication.

5. The method of claim 4, wherein, After the main client performs the root authentication, that is, after the main client and the private device perform the public-private key encryption exchange, the main client generates a unique identification code UserID of an administrator. When the main client authenticates the installed application, the application identifies and compares the string identification of the UserID, and then obtains the access permission Scope of the application. Meanwhile, the application generates an independent record list, including the unique identification code Applet ID of the application, the authentication key Applet secret of the application, the Scope, and the UserID. After the member client is authenticated by the main client, the member client generates a unique identification code UserID of a member user, obtains the access permission Scope of the application and the unique identification code Applet ID of the application. When the member client establishes authentication with the installed application, the application generates an independent record list, including the Applet ID string, the authentication key Applet secret of the application, the Scope, and the UserID.

6. The method of claim 4, wherein, The main client authorizes other terminals of the main client by setting an authentication mode. The member client authorizes other terminals of the member client by setting an authentication mode.

7. The method of claim 1, wherein, The application distribution service provided by the application platform includes: accepting the application developed and designed by a developer, and providing registration, publishing, storage, installation and updating services for the application, so that the application is normally installed and updated on the private device and the client. The application needs to obtain the ID information Box ID of the private device before running. The Box ID is obtained by the user when binding the private device by using the client.

8. The method of claim 1, wherein, The following four functions are realized based on the client, the private device and the application platform: The authentication function is that the client obtains the authorization of the application permission, cross-domain calls user authorization information, and confirms the processing of the user authorization. The management and distribution function is that a storage management data list is generated, and the data includes an application unique identification code Applet ID string, an application authentication key Applet secret string, an application access permission Scope, and a user unique identification code UserID character. The individual function is that an open interface of the required authorization permission is legally called in combination with the individual function design of the user. The shared function is developed, which refers to providing an application development design interface for developers.

9. An application running system based on an OAuth2 protocol and a private device, characterized by, The application comprises: a client installed on a user terminal, the user installs an application through the client, and establishes data interaction with a private device through the application; the private device, comprising a processor and a memory, for providing application services for the client and performing end-to-end data security sharing with the client through the application; an application platform for providing application distribution services for the private device and the client; wherein when the application is queried, the user sends an application query request to the private device through the client; the private device applies for an application unique identification code Applet ID and required service permissions to the application platform according to the application query request; the application platform generates the Applet ID and the latest version information Applet Version of the application, and the latest version information Box Version of the private device, and verifies whether the application download is correct, and then sends the Applet ID, the Applet Version and the Box Version to the private device; the private device sends the returned Applet ID and Applet Version information to the client, and the user queries the current installed application list through the client; when the application is installed, the user selects an application to be installed on the client, and the client automatically sends an application installation request to the private device to request to call an installation interface; the private device sends a request for downloading a resource package to the application platform according to the Applet ID, the Applet Version and the Box Version of the private device; the application platform queries the current latest version number of the application according to the Applet ID, evaluates and confirms the lowest version that can be supported by the private device, forms a return information and returns to the private device; if the version of the private device is too low to query the application, the private device is prompted to upgrade the version; after receiving the return information, the private device installs the latest version of the private device and locally deploys the latest version of the application, and records the installation information; if the private device supports the latest version of the application, it is prompted that the support is successful; the private device sends the application resource package to the client, and the client installs the application.

10. The system of claim 9, wherein, The client comprises a main client, a member client authenticated by the main client, other terminals authenticated by the main client, and other terminals of the member client authenticated by the main client.

Images