Application login control method and device, electronic device, and storage medium

Abstract

Embodiments of the present application disclose an application login control method and device, an electronic device, and a storage medium. The method comprises: obtaining a login universal credential, the login universal credential containing a plurality of signatures obtained by a plurality of application systems using their own private keys to respectively sign a credential content, the credential content being used to represent that an application system in the plurality of application systems has successfully performed user identity authentication; sending an access request to an application belonging to any application system in the plurality of application systems, the access request carrying the login universal credential, so that the application verifies a corresponding signature contained in the login universal credential according to a public key corresponding to the application system to which the application belongs; and logging in to the application after the corresponding signature contained in the login universal credential is verified by the application. The technical solution of the embodiments of the present application can be applied to cloud technology, artificial intelligence, intelligent transportation, block chain and other scenes to perform access of applications in the scenes and improve the security performance of application access.

Description

Technical Field

[0001] This application relates to the field of Internet technology, and more specifically, to an application login control method and device, electronic device, and computer-readable storage medium. Background Technology

[0002] In application development projects that require the construction of two-level centers, such as when a group company needs to build a parent center application belonging to the group and sub-center applications belonging to each of the companies under the group, both levels of centers can usually run independently, and the sub-centers do not strictly depend on the operation of the parent center. Therefore, both levels of centers need to have an identity authentication mechanism, and the two levels of centers also need to be able to verify the credentials issued by the other's identity authentication mechanism.

[0003] In the existing technical implementation, the client needs to store login credentials issued by both the parent center and the child center to access the parent center application or the child center application normally. In addition, the login credentials are in the form of random numbers. When accessing the application, the verification of the login credentials needs to be verified by the identity authentication authority that issued the credentials. This makes the credential verification between the parent center and the child center relatively complicated, resulting in poor performance when accessing the application. Summary of the Invention

[0004] To address the aforementioned technical problems, embodiments of this application provide an application login control method and apparatus, an electronic device, and a computer-readable storage medium.

[0005] According to one aspect of the embodiments of this application, an application login control method is provided, comprising: obtaining a general login credential, wherein the general login credential contains signatures obtained by multiple application systems using their own private keys to sign credential content, the credential content being used to indicate that one of the multiple application systems has successfully performed user authentication; sending an access request to an application belonging to any of the multiple application systems, the access request carrying the general login credential, so that the application verifies the corresponding signature contained in the general login credential based on the public key corresponding to the application system to which it belongs; and logging into the application after the application successfully verifies the corresponding signature contained in the general login credential.

[0006] According to another aspect of the embodiments of this application, an application login control method is provided, comprising: receiving an authentication request sent by an application belonging to a first application system; performing user authentication on a client according to the authentication request, and generating an initial login credential after successful user authentication, the initial login credential containing credential content and a first signature, the first signature being obtained by the first application system using its own private key to sign the credential content; requesting the second application system to perform identity authentication on the first authentication system according to the authentication key corresponding to the second application system and the initial login credential, and after successful identity authentication, using its own private key to sign the credential content contained in the initial login credential to obtain a second signature; obtaining a general login credential based on the credential content contained in the initial login credential, the first signature, and the second signature; and forwarding the general login credential sent by the second application system to the client, so that the client can access an application belonging to the first application system or the second application system carrying the general login credential.

[0007] According to another aspect of the embodiments of this application, an application login control method is provided, comprising: receiving an authentication request sent by an application belonging to a first application system; authenticating a client's identity based on the first authentication request, and generating an initial login credential after successful user authentication, wherein the initial login credential contains credential content and a first signature, the first signature being obtained by the first application system using its own private key to sign the credential content; returning the initial login credential to the client, so that the client carries the initial login credential to send an access request to an application belonging to a second application system, wherein after the second application system successfully authenticates the first application system based on the access request, it signs the credential content contained in the initial login credential to obtain a second signature, and obtains a general login credential based on the credential content contained in the initial login credential, the first signature, and the second signature.

[0008] According to one aspect of the embodiments of this application, an application login control device is provided, comprising: a login general credential acquisition module configured to acquire a login general credential, wherein the login general credential contains signatures obtained by multiple application systems using their own private keys to sign credential content, the credential content being used to indicate that one of the multiple application systems has successfully performed user authentication; an application access request module configured to send an access request to an application belonging to any of the multiple application systems, the access request carrying the login general credential, so that the application verifies the corresponding signature contained in the login general credential based on the public key corresponding to the application system to which it belongs; and an application login module configured to log in to the application after the application has successfully verified the corresponding signature contained in the login general credential.

[0009] According to another aspect of the embodiments of this application, an application login control device is provided, comprising: an authentication request receiving module configured to receive an authentication request sent by an application belonging to a first application system; a user identity authentication module configured to perform user identity authentication on a client according to the authentication request, and generate an initial login credential after successful user identity authentication, the initial login credential containing credential content and a first signature, the first signature being obtained by the first application system using its own private key to sign the credential content; an identity authentication request module configured to request the second application system to perform identity authentication on the first authentication system according to the authentication key corresponding to the second application system and the initial login credential, and after successful identity authentication, use its own private key to sign the credential content contained in the initial login credential to obtain a second signature, and obtain a general login credential based on the credential content contained in the initial login credential, the first signature, and the second signature; and a general login credential forwarding module configured to forward the general login credential sent by the second application system to the client, so that the client can carry the general login credential to access an application belonging to the first application system or the second application system.

[0010] According to another aspect of the embodiments of this application, an application login control device is provided, comprising: an authentication request receiving module configured to receive an authentication request sent by an application belonging to a first application system; a user identity authentication module configured to perform user identity authentication on a client according to the first authentication request, and generate an initial login credential after successful user identity authentication, the initial login credential containing credential content and a first signature, the first signature being obtained by the first application system using its own private key to sign the credential content; and an initial login credential return module configured to return the initial login credential to the client, so that the client carries the initial login credential to send an access request to an application belonging to a second application system, the second application system successfully authenticating the first application system based on the access request, signing the credential content contained in the initial login credential to obtain a second signature, and obtaining a general login credential based on the credential content contained in the initial login credential, the first signature, and the second signature.

[0011] According to one aspect of the embodiments of this application, an electronic device is provided, including: one or more processors; and a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the electronic device enables the application login control method as described above.

[0012] According to one aspect of the embodiments of this application, a computer-readable storage medium is provided, on which computer-readable instructions are stored, which, when executed by a computer's processor, cause the computer to perform the application login control method as described above.

[0013] According to one aspect of the embodiments of this application, a computer program product or computer program is provided, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the application login control method provided in the various optional embodiments described above.

[0014] In the technical solution provided by the embodiments of this application, multiple application systems are equivalent to multiple centers. By setting up a universal login credential that circulates among multiple application systems, the client only needs to store one universal login credential to realize login access to applications belonging to different application systems. Furthermore, the login pass credential is generated by signing and the universal login credential is verified by signature verification, eliminating the need for frequent credential verification between different application systems, thereby improving the performance of application access.

[0015] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0016] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application. It is obvious that the drawings described below are merely some embodiments of this application, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort. In the drawings:

[0017] Figure 1 This is a schematic diagram of the process in the existing technology where the user first logs into the sub-center application based on the client, and then logs into the parent center application.

[0018] Figure 2 This is a schematic diagram of the process in the existing technology implementation where the user first logs into the parent central application based on the client, and then logs into the child central application.

[0019] Figure 3 This is a flowchart illustrating an exemplary embodiment of the application login control method of this application;

[0020] Figure 4 yes Figure 3 Step S110 in the illustrated embodiment is a flowchart of an exemplary embodiment;

[0021] Figure 5 yes Figure 3 Step S110 in the illustrated embodiment is shown in a flowchart of another exemplary embodiment;

[0022] Figure 6 This is a flowchart illustrating an application login control method in another exemplary embodiment of this application;

[0023] Figure 7 This is a schematic diagram of the application access interaction process in an exemplary application scenario of this application;

[0024] Figure 8 This is a flowchart illustrating an application login control method in another exemplary embodiment of this application;

[0025] Figure 9 This is a schematic diagram of the application access interaction process in another exemplary application scenario of this application;

[0026] Figure 10 This is a block diagram illustrating an application login control device as an exemplary embodiment of this application;

[0027] Figure 11This is a block diagram illustrating an application login control device in another exemplary embodiment of this application;

[0028] Figure 12 This is a block diagram illustrating an application login control device in another exemplary embodiment of this application;

[0029] Figure 13 A schematic diagram of the structure of a computer system suitable for implementing the electronic device of the present application is shown. Detailed Implementation

[0030] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0031] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0032] The flowcharts shown in the accompanying drawings are merely illustrative and do not necessarily include all content and operations / steps, nor do they necessarily have to be performed in the described order. For example, some operations / steps can be broken down, while others can be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0033] In this application, "multiple" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. The character " / " generally indicates that the preceding and following related objects have an "or" relationship.

[0034] As mentioned earlier, in application development projects that require the construction of two-level centers, both levels of centers can usually operate independently, and the sub-center does not strictly depend on the operation of the parent center. Therefore, both levels of centers need to have an identity authentication mechanism, and they also need to be able to verify the credentials issued by each other's identity authentication mechanisms.

[0035] Please see Figure 1 and Figure 2 , Figure 1This is a schematic diagram illustrating the process in existing technologies where users first log in to the sub-center application via a client, and then log in to the parent center application. Figure 2 This is a schematic diagram of the process in the existing technology implementation where the user first logs into the parent central application based on the client, and then logs into the child central application.

[0036] The client is used to provide users with access to sub-center applications or parent center applications. For example, the client is a browser, and the sub-center applications and parent center applications are web applications, respectively. Sub-center applications and parent center applications belong to different center levels, i.e., sub-center and parent center, with the parent center at a higher level than the sub-center. Generally, higher-level centers should have broader or higher-level data permissions. For example, a parent center might correspond to a group company, and a sub-center to a subsidiary of that group company. The group company typically has access to most of the subsidiary's business data, while the subsidiary cannot access certain data from the group company. There can be one or more applications belonging to the same center level. For example, if a group company has multiple subsidiaries, each requiring its own independent application, then there can be multiple sub-center applications under a sub-center. This is not a limitation here. The sub-identity authentication center is the identity authentication authority deployed for the sub-center, used to authenticate client users accessing the sub-center application. Similarly, the parent identity authentication center is the identity authentication authority deployed for the parent center. For example, in practical application scenarios, the sub-identity authentication center and parent identity authentication center are correspondingly deployed authentication servers.

[0037] exist Figure 1The process illustrated involves a user logging into a sub-center application first, then the parent center application via a client. The client first authenticates its identity at the sub-authentication center and requests sub-center login credentials. These credentials are issued by the sub-authentication center after successful user authentication. The sub-authentication center also requests parent center login credentials from the parent authentication center. If the parent authentication center also successfully authenticates the user, it issues its own parent center login credentials and sends them to the sub-authentication center, which then returns both parent and sub-center login credentials to the client. The client then uses these credentials to log into sub-center application A. Sub-center application A, based on these credentials, requests verification of their validity from the sub-authentication center. Since the sub-authentication center cannot verify the parent login credentials, it requests verification of the parent login credentials from the parent authentication center. After both credentials pass verification, the client is allowed to log into sub-center application A. After a user logs in to sub-application A, they also log in to parent application B using both parent and sub-application login credentials. Parent application B, based on these credentials, requests the parent authentication center to verify their validity. Since the parent authentication center cannot verify the sub-application credentials, it requests the sub-application authentication center to verify them. Once both credentials are validated, the client is allowed to log in to parent application B.

[0038] exist Figure 2The process illustrated involves a user logging into a parent application and then a child application via a client. The client first authenticates with the parent authentication center and requests parent login credentials. The parent authentication center then requests child login credentials from the child authentication center. If the child authentication center also successfully authenticates the user, it issues its own child login credentials and sends them to the parent authentication center, which then returns both parent and child login credentials to the client. The client then uses these credentials to log into parent application B. Parent application B, based on these credentials, requests the parent authentication center to verify their validity. Since the parent authentication center cannot verify the child login credentials, it requests the child authentication center to verify them. If both credentials pass validity verification, the client is allowed to log into parent application B. After a user logs in to parent application B, they also log in to sub-application A using both parent and child login credentials. Sub-application A, based on these credentials, requests the sub-authentication center to verify their validity. If the sub-authentication center cannot verify the parent credentials, it requests the parent authentication center to verify the parent credentials. If both credentials pass validity verification, the client is allowed to log in to sub-application A.

[0039] according to Figure 1 and Figure 2 As can be seen from the process shown, the application login process in the existing technology has at least the following disadvantages:

[0040] First, the login credentials are in the form of random numbers. Each login credential must be verified by the identity authentication center that issued the credential to confirm its validity.

[0041] Secondly, the mutual authentication between the parent center and the child center can only be done by the one who issues the credential and verifies it. This results in a relatively complicated credential verification process between the parent center and the child center, which is complex and leads to poor application access performance.

[0042] Third, the client needs to store login credentials for both the parent and child centers simultaneously, resulting in a relatively large amount of data to be stored.

[0043] In order to solve at least one of the above-mentioned problems in the prior art, the embodiments of this application propose a variety of application login control methods and corresponding application login control devices, as well as an electronic device and a computer-readable storage medium. The contents of these embodiments will be described in detail below.

[0044] Please see Figure 3 , Figure 3 This is a flowchart illustrating an exemplary embodiment of an application login control method. This method can be executed by a client that provides application access to users; that is, users can access different applications based on this client. For example, the client can specifically be a browser, etc., without limitation.

[0045] like Figure 3 As shown, this exemplary application login method includes at least steps S110 to S150, which are described in detail below:

[0046] Step S110: Obtain the general login credential. The general login credential contains signatures obtained by multiple application systems using their own private keys to sign the credential content. The credential content is used to indicate that one of the multiple application systems has successfully authenticated the user.

[0047] First, it should be noted that the multiple application systems in this embodiment correspond to a scenario where an application development project has multiple centers. Different centers correspond to different application systems, and each center can operate independently without strictly depending on the operation of other centers. Each application system has its own identity authentication mechanism, such as deploying an authentication server for identity authentication. For example, in the scenario described above where a group company needs to build a parent center application belonging to the group and sub-center applications belonging to each of its subsidiaries, the multiple application systems include a parent center and sub-centers. Each application system has at least one application under it. This affiliation can be understood as the association between the application and the corresponding center. For example, each subsidiary of the aforementioned group company needs to build its own application, and these applications are all associated with the "subsidiary of the group company" center. Therefore, these applications can be referred to as applications belonging to the application system corresponding to the "subsidiary of the group company" center.

[0048] It should also be noted that multiple application systems can perform real-time data synchronization. For example, during the user registration phase, user registration information needs to be synchronized in real time across all application systems, allowing users to register only in one application system instead of registering separately in each system, thus simplifying the user registration process. Furthermore, based on the real-time data synchronization between multiple application systems, each application system can perform user authentication for registered users.

[0049] Additionally, it should be noted that each application system needs to pre-configure certain information, such as its own public / private key pair, the public keys of other application systems, the authentication keys of other application systems, and the callback address of its parent application. Applications belonging to each application system also need to pre-configure certain information, such as the authentication key and public key of their parent application system. It should be understood that the key corresponding to a particular application system is used for authentication between application systems; the authentication key typically includes a key identifier and a key body. The callback address is specifically a URL (Uniform Resource Locator) address, usually corresponding to a specific page (e.g., the homepage) within the application. Clients can access this specific page by accessing the callback address.

[0050] This embodiment sets a universal login credential as the credential for the client to log in and access different application systems. The purpose is to reduce the number of times the client requests the authentication server to verify the validity of the credential during the login process between different application systems. In other words, different application systems do not need to perform frequent credential verification, thereby improving the efficiency and performance of application access.

[0051] Specifically, the login credential contains a login credential. This credential is issued by one of the application systems after successfully authenticating a client user. Therefore, the credential content indicates that the application system has successfully authenticated the user. For example, the credential content includes header information and body information. The header information includes an algorithm identifier, which refers to the algorithm used for signature processing, typically including message digest algorithms and asymmetric encryption algorithms. The body information includes at least one piece of information such as the credential issuer, credential validity period, and credential recipient. The credential validity period refers to the time limit for which the credential is valid, such as the date the credential expires. Among them, message digest algorithms are a type of cryptographic algorithm that provides fingerprint information for all data to achieve functions such as data signing and data integrity verification; asymmetric encryption algorithms are a method of key confidentiality. Asymmetric encryption algorithms require the use of a pair of public keys and private keys. If data is encrypted using the public key, it can only be decrypted using the corresponding private key. If data is signed using the private key, the corresponding public key is required for signature verification.

[0052] The login credential also contains signatures obtained by multiple application systems using their own private keys to sign the credential content. Each application system's signature process involves using an encryption algorithm to calculate the credential content. For example, if the encryption algorithm uses Message Digest Algorithm SM3 (a standard hash function algorithm released by the State Cryptography Administration) and asymmetric encryption algorithm SM2 (an elliptic curve public-key cryptography algorithm released by the State Cryptography Administration), the signature process can be represented by the calculation process corresponding to the following formula:

[0053] sign=SM2(header+body,privatekey)+SM3(SM2(header+body,privatekey))

[0054] In the formula above, `sign` represents the signature result obtained from the signature processing. It can be seen that the process of signing the credential content includes first using the application system's private key and the SM2 algorithm to encrypt the credential content to obtain a first encrypted sequence, then using the SM3 algorithm to encrypt the first encrypted sequence to obtain a second encrypted sequence, and finally merging the first and second encrypted sequences to obtain the final signature result.

[0055] It should be understood that different application systems have their own public-private key pairs. Therefore, the signature results obtained by different application systems in signing the credential content should be different. Furthermore, in the application scenario described above, the encryption algorithm used for signature processing is not limited to the SM2 and SM3 algorithms mentioned above; it can be selected according to actual needs, and this embodiment does not impose any restrictions.

[0056] It's also important to understand that for the multiple signatures contained in the universal login credential, the signature corresponding to the application system that successfully authenticated the user's identity can be used to indicate that the application recognizes or accepts this credential, thus ensuring the client user's success under this application system. The signatures corresponding to other application systems, since they are obtained by signing the credential content, indicate that other applications also recognize or accept this credential; therefore, the client user should also have success under these application systems. Based on this, this embodiment allows the client to achieve success under multiple application systems by setting only one universal login credential, eliminating the need to store login credentials issued by different application systems separately, thus reducing the amount of data stored and transmitted by the client.

[0057] Step S130: Send an access request to any application belonging to one of the multiple application systems. The access request carries a general login credential, so that the application can verify the corresponding signature contained in the general login credential based on the public key of the application system to which it belongs.

[0058] After obtaining the universal login credentials, the client can send an access request to any application within one of the multiple application systems. Upon receiving the request, the application verifies the signature contained in the universal login credentials using the public key corresponding to its own application system. Since the signature is obtained by the application system signing the credential content, this indicates that the application system recognizes or accepts the credentials issued by the application system that has successfully authenticated the client user. If the application successfully verifies the signature in the universal login credentials using the public key corresponding to its own application system, the application can determine that the client user has successfully authenticated in a certain application system, and that its own application system recognizes or accepts the authentication result, thus ensuring security by allowing the client to log in.

[0059] Step S150: After the application verifies the corresponding signature contained in the login credentials, log in to the application.

[0060] As described above, the application allows the client to log in after successfully verifying the corresponding signature contained in the login credentials, thereby enabling the client to log in to the application.

[0061] It should also be mentioned that, considering that credentials usually have an expiration date, in some exemplary embodiments, after the application verifies the corresponding signature contained in the login credential, it also verifies whether the login credential is valid. Only if it is valid is the client user allowed to log in to the application. Specifically, the validity of the login credential can be determined by verifying whether the current time is within the validity period corresponding to the credential contained in the login credential. It is easy to understand that if the current time is within the validity period corresponding to the credential contained in the login credential, it indicates that the login credential is valid; otherwise, it indicates that the login credential is invalid.

[0062] Therefore, the method provided in this embodiment proposes a universal login credential for circulation between different application systems. During application login, the client only needs to verify the signature contained in the universal login credential using the public key corresponding to its own application system. Once the client successfully logs in, it can access the application without frequent credential verification between different application systems, thus effectively improving the performance and efficiency of client access to applications. Furthermore, the components of the universal login credential are specially configured to ensure the security and reliability of the application login method proposed in this embodiment.

[0063] In other exemplary embodiments, based on the application scenario of an application development project with a two-level center construction requirement, the following can be set up: Figure 3 The multiple application systems in the illustrated embodiment include a first application system and a second application system. One of the first application system and the second application system corresponds to a sub-center, and the other application system corresponds to a parent center. This embodiment does not impose any restrictions on this.

[0064] After successfully authenticating the client user, the first application system generates credential content and signs the credential content using its own private key to obtain a first signature. This first signature and the credential content then form the initial login credential. It can be seen that the first signature contained in the initial login credential can only be successfully verified by applications belonging to the first application system. Therefore, the client carrying the initial login credential can only successfully log in to applications belonging to the first application system, and cannot log in to applications belonging to the second application system.

[0065] After successfully authenticating with the first application system, the second application system uses its own private key to sign the credential content contained in the initial login credential to obtain a second signature. The credential content in the initial login credential, the first signature, and the obtained second signature then form a universal login credential. For example, the process of the second application system authenticating with the first application system may include: after receiving the initial login credential sent by the first application system, verifying the first signature contained in the initial login credential using the public key of the first application system; if the verification is successful, it indicates that the second application system has successfully authenticated with the first application system. Alternatively, the process of the second application system authenticating with the first application system may also include: the first application system sending the initial login credential and the authentication key corresponding to the second application system to the second application system; if the second application system verifies that the authentication key is correct, it indicates that the second application system has successfully authenticated with the first application system. For example, the first application system uses the authentication key corresponding to the second application system as the encryption key to encrypt the initial login credential, and transmits the encrypted data to the second application system. The second application system then uses its own authentication key to decrypt the encrypted data to obtain the initial login credential. If the decryption is successful, it means that the second application system has successfully authenticated the identity of the first application system.

[0066] As can be seen from the above, this embodiment... Figure 3Based on the illustrated embodiment, at least one additional element is added: the second application system obtains a second signature by signing the credential content contained in the initial login credential using its own private key after successfully authenticating with the first application system. This strengthens the credential attribute of the second signature for the login credential. In other words, the authentication performed by the second application system on the first application system before obtaining the second signature gives the second signature a first level of reliability. Furthermore, since the second signature is obtained by the second application system signing the credential content contained in the initial login credential issued by the first application system, it indicates that the second application system recognizes the credential, giving the second signature a second level of reliability. Therefore, when a client accesses an application belonging to the second application system with a general login credential, the application uses the public key corresponding to the second application system to verify the second signature. The successful verification result strongly indicates that the second application system recognizes the credential, making the application's permission for the client to log in more secure and reliable.

[0067] like Figure 4 As shown, in an exemplary embodiment, when the central level corresponding to the first application system is lower than the central level corresponding to the second application system, for example, the first application system corresponds to a sub-center and the second application system corresponds to a parent center, Figure 3 The process of obtaining the login credential in step S110 may include steps S111 to S113, which are described in detail below:

[0068] Step S111: Send an access request to the application belonging to the first application system, so that after determining that the user's login status is not logged in, the application belonging to the first application system requests the first application system to perform user authentication, and obtains the initial login credentials after the user authentication is successful.

[0069] This embodiment describes the scenario where a client obtains a general login credential through a first application system (i.e., a sub-center). First, the client sends an access request to an application belonging to the first application system. After receiving the access request, the application checks whether the user's login status is either not logged in or logged in. If it is not logged in, the application requests the first application system to authenticate the client's identity. If the authentication is successful, the first application system obtains the initial login credential.

[0070] Generally speaking, if a client is in a "logout" state, it is determined that the client is not logged in. "Logout" usually means logging out, which means that the client has cleared the logged-in user account. After clearing, the client can use other user accounts to log in.

[0071] The process by which the first application system obtains initial login credentials may include: displaying a login page to the client and obtaining the user authentication information entered on the login page; if the user authentication information is determined to be valid, the user's identity authentication is confirmed to be successful, and corresponding credential content is generated; the credential content is signed using its own private key to obtain a first signature, and initial login credentials are generated based on the first signature and the credential content. User authentication information refers to information related to the user registration stage, such as user account and password. If the user account and password entered on the login page are verified to be stored registered user information, then they are determined to be valid information.

[0072] For example, if we use ssign to represent the first signature, and header and sbody to represent the components of the credential content, where header represents the header information and sbody represents the body information, and the credential issuer is a sub-application, and scertX represents the initial login credential, the resulting general login credential can be represented as follows:

[0073] scertX=(base64(header+sbody+ssign))

[0074] It is important to understand that "header+sbody+ssign" is the data contained in the initial login credentials, and "base64" indicates the base64 bytecode encoding method. In other words, the initial login credentials are obtained by encoding the "header+sbody+ssign" data into base64 bytecode to facilitate transmission over the network.

[0075] If the first application system uses the Message Digest Algorithm SM3 and the asymmetric encryption algorithm SM2 for signature processing, the first signature ssign is obtained by the following formula:

[0076] ssign=SM2(header+sbody,sprivkey)+SM3(SM2(header+sbody,sprivkey))

[0077] Here, sprivkey represents the private key of the first application system itself.

[0078] Step S113: Receive the general login credentials returned by the first application system in response to the login request. The general login credentials are obtained by the second application system after successfully authenticating the identity of the first application system based on the initial login credentials.

[0079] Since client access to sub-center applications typically requires permission from the parent center, in this embodiment, after obtaining the initial login credentials, the first application system, based on the obtained initial login credentials and the authentication key corresponding to the second application system, requests the second application system to generate a universal login credential that circulates between the first and second application systems. The second application system authenticates the first application system by verifying the correctness of the authentication key. After successful authentication, the second application system signs the credential content contained in the initial login credentials to obtain a second signature, thereby generating a universal login credential based on the credential content, the first signature, and the second signature. The second application system then sends the obtained universal login credential to the first application system, which returns the universal login credential to the client so that the client can obtain the universal login credential.

[0080] For example, if ssign and fsign represent the first signature and the second signature respectively, and header and body represent the components of the credential content, where header represents header information, sbody represents body information and the credential issuer is the first application system, and sfcertX represents the general login credential, the final general login credential can be represented as follows:

[0081] sfcertX=(base64(header+sbody+fsign+ssign))

[0082] If the first application system uses the Message Digest Algorithm 3 (SM3) and the asymmetric encryption algorithm SM2 for signature processing, and the second application system's private key is represented as fprivkey, then the second signature fsign is obtained using the following formula:

[0083] fsign=SM2(header+sbody,fprivkey)+SM3(SM2(header+sbody,fprivkey))

[0084] Therefore, during the process of the client obtaining the universal login credential through the sub-center, only one credential verification is required between the sub-center and the parent center. Furthermore, when the client subsequently accesses applications under different centers based on the login credential, no further credential verification interaction between the sub-center and the parent center is needed, thus simplifying the process for the client to access applications under different centers. Moreover, the authentication between the sub-center and the parent center is based on a key, making the authentication process simple and reliable.

[0085] like Figure 5As shown, in another exemplary embodiment, when the central level corresponding to the first application system is higher than the central level corresponding to the second application system, for example, the first application system corresponds to the parent center and the second application system corresponds to the child center, Figure 3 The process of obtaining the login credential in step S110 may include steps S112 to S118, which are described in detail below:

[0086] Step S112: Send an access request to the application belonging to the first application system, so that after determining that the user's login status is not logged in, the application belonging to the first application system requests the first application system to perform user authentication, and obtains the initial login credentials after the user authentication is successful.

[0087] This embodiment describes a scenario where the client obtains a general login credential by first logging into an application belonging to the first application system (i.e., the parent center) and then logging into a second application system (i.e., the child center). The process by which the first application system obtains the initial login credential is similar to that in the previous embodiment, and will not be described in detail here.

[0088] To facilitate understanding of the technical solution of this embodiment, the following description of this embodiment directly describes the first application system and the second application system as a parent center and a child center, and the application belonging to the first application system is represented as the parent center application, and the application belonging to the second application system is represented as the child center application.

[0089] It should be noted that, since this embodiment involves the parent center authenticating the client user and issuing credentials accordingly, the initial login credential is represented as fcertX, the first signature as fsign, and the credential content as header and fbody. The header represents the header information, and the fbody represents the body information. The credential issuer is the parent center. The initial login credential is represented as follows:

[0090] fcertX=(base64(header+fbody+fsign))

[0091] If the first application system uses the Message Digest Algorithm SM3 and the asymmetric encryption algorithm SM2 for signature processing, the first signature fsign is obtained by the following formula:

[0092] fsign=SM2(header+fbody,fprivkey)+SM3(SM2(header+fbody,fprivkey))

[0093] Here, fprivkey represents the parent central key itself.

[0094] Step S114: Receive and store the initial login credentials returned by the first application system.

[0095] Since client access to the parent application typically does not require permission from the child application, in this embodiment, the parent application returns the initial login credentials to the client after obtaining them, rather than requesting the child application to verify those credentials. Once the parent application receives the initial login credentials, the client can successfully log in to the requested parent application.

[0096] Step S116: Based on the initial login credentials, an access request is sent to the application belonging to the second application system, so that after determining that the initial login credentials were not generated by the application system to which it belongs, the application belonging to the second application system requests the second application system to authenticate the identity of the first application system, and obtains the general login credentials based on the initial login credentials after successful authentication.

[0097] To obtain the universal login credential, the client also needs to send an access request to the sub-center application based on the initial login credential returned by the parent center, that is, to include the initial login credential in the access request. Upon receiving this access request, the sub-center application determines whether the initial login credential was generated by the sub-center by checking the credential issuer information contained in the initial login credential. In this embodiment, it should be confirmed that the initial login credential was not generated by the sub-center. Based on this, the sub-center application requests the sub-center to authenticate the parent center, and after successful authentication, obtains the universal login credential based on the initial login credential.

[0098] The process of a sub-center application requesting the sub-center to authenticate the parent center includes: using the public key corresponding to the sub-center to verify the first signature contained in the initial login credential; if the verification is successful, further verifying the validity of the credential; if the credential is valid, then signing the credential content contained in the initial login credential to obtain the second signature, and generating a general login credential based on the credential content contained in the initial login credential, the first signature, and the obtained second signature.

[0099] For example, if fsign and ssign represent the first signature and the second signature respectively, and header and fbody represent the components of the credential content, where header represents header information, fbody represents body information and the credential issuer is the parent center, and fscertX represents the general login credential, the general login credential obtained in this embodiment can be represented as follows:

[0100] fscertX=(base64(header+fbody+fsign+ssign))

[0101] If the parent center uses the Message Digest Algorithm 3 (SM3) and the asymmetric encryption algorithm SM2 for signature processing, and the child center's private key is represented as sprivkey, then the second signature ssign is obtained using the following formula:

[0102] ssign=SM2(header+fbody,sprivkey)+SM3(SM2(header+fbody,sprivkey))

[0103] Step S118: Receive the login general credential returned by the second application system, and update the stored initial login credential based on the login general credential.

[0104] After receiving the general login credentials returned by the sub-center, the client updates the stored initial login credentials based on the general login credentials, so that only one credential is always stored in the client, and the amount of stored data and transmitted data is small.

[0105] In this embodiment, during the process of the client obtaining a general login credential by first accessing the parent application and then the child application, no credential verification is required between the parent and child centers. Similarly, when the client subsequently accesses applications under different centers based on the login credential, no credential verification interaction between the parent and child centers is needed, thus simplifying the process for the client to access applications under different centers. Furthermore, the child center uses the public key corresponding to the parent center to authenticate the parent center's identity; this authentication process remains simple and reliable.

[0106] As can be seen from the above embodiments, the application login control method proposed in this application generates and verifies credentials through signature verification, reducing the number of credentials that the application requests from the application system for verification. Simultaneously, it employs public-private key technology to eliminate the need for frequent credential verification between the two application systems, and the client only needs to store one credential, eliminating the need to store two copies. This results in a smaller amount of stored and transmitted data. In summary, the embodiments of this application solve the technical problem while ensuring sufficiently high performance and efficiency.

[0107] It should also be mentioned that if the above embodiments use both the SM2 and SM3 algorithms issued by the State Cryptography Administration for signature processing, security is guaranteed at the algorithm level, and the technology is also guaranteed to be independent and controllable.

[0108] The following will detail the application login control process of the first application system in application scenarios where the central level of the first application system is lower than that of the second application system, or in application scenarios where the central level of the first application system is higher than that of the second application system.

[0109] Please see Figure 6 , Figure 6 This is a flowchart illustrating another exemplary embodiment of the present application, showing an application login control method. This method is applied to application scenarios where the central level of the first application system is lower than that of the second application system, and is specifically executed by the first application system. For example, the first application level corresponds to a sub-center, and the second application system corresponds to the parent center. Figure 6 As shown, the method includes at least steps S210 to S270, as follows:

[0110] Step S210: Receive an authentication request sent by an application belonging to the first application system. The authentication request is generated by the application belonging to the first application system after determining that the user login status of the client is not logged in based on the application login request initiated by the client.

[0111] Step S230: Perform user authentication on the client according to the authentication request, and generate initial login credentials after successful user authentication. The initial login credentials contain credentials content and a first signature. The first signature is obtained by the first application system using its own private key to sign the credentials content.

[0112] Step S250: Based on the authentication key and initial login credentials of the second application system, request the second application system to authenticate the identity of the first authentication system, and after successful authentication, use its own private key to sign the credential content contained in the initial login credentials to obtain a second signature, and obtain a general login credential based on the credential content contained in the initial login credentials, the first signature, and the second signature.

[0113] Step S270: Forward the login credentials sent by the second application system to the client, so that the client can use the login credentials to access applications belonging to the first or second application system.

[0114] Understandably, corresponding to the content described in step S210, an application belonging to the first application system will only allow the client to access the application if it is determined that the user corresponding to the client is logged in. This is to ensure the reliability of application access and the security of application data. Therefore, after determining that the user corresponding to the client is not logged in, the application needs to request the first application system to authenticate the client user and send an authentication request to the first application system.

[0115] Corresponding to the content described in step S230, the first application system performs user authentication on the client based on the received authentication request, including displaying a login page to the client and obtaining the user authentication information entered on the login page. As described in the previous embodiments, the user authentication information typically includes the user account and password. If the first application system determines that the user authentication information entered on the login page is the user account and password corresponding to a registered user, it indicates that the client user is a legitimate user and the entered user authentication information is legitimate, thus determining that the client has successfully performed user authentication. After successful user authentication, the first application system first generates credential content, then uses its own private key to sign the credential content to obtain a first signature, and then generates initial login credentials based on the credential content and the first signature.

[0116] Corresponding to the content described in step S250, since the central level of the first application system is lower than that of the second application system, users usually need permission from the second application system to access applications belonging to the first application system. Therefore, the first application system also requests the second application system to authenticate itself based on the authentication key corresponding to the second application system and carrying the initial login credentials. If the authentication key carried by the first application system is verified to be the authentication key preset by the second application system, the first application system passes the authentication. If the second application system determines that the first application system has passed the authentication, it means that the second application system will trust the credentials issued by the first application system. Therefore, it uses its own private key to sign the credential content contained in the initial login credentials to obtain a second signature, and forms a general login credential based on the credential content contained in the initial login credentials, the first signature, and the obtained second signature, and sends the obtained general login credential to the first application system.

[0117] Corresponding to the content described in step S270, the first application system forwards the login general credential sent by the second application system to the client, so that the client can use the login general credential to access any application belonging to the first application system or the second application system. This realizes the circulation of the login general credential between the first application system and the second application system. For the credential verification process involved in this process, please refer to the content described in the previous embodiment. This embodiment will not repeat it.

[0118] Furthermore, considering that the client is currently requesting access to an application belonging to the first application system, the first application system can also obtain a locally stored callback address. This callback address indicates a specific page contained within the application belonging to the first application system that the client is currently requesting access to. The first application system then sends the obtained callback address to the client, enabling the client to access the corresponding application based on that callback address. Thus, the client will receive the application page corresponding to the callback address, instead of an empty page, thereby meeting the user's need for application access.

[0119] The following is passed Figure 7 The following is a detailed explanation of the interaction flow example in an exemplary application scenario. Figure 6 The illustrated embodiment reveals an application login control method. In Figure 7 In the application scenario shown, sub-center application A corresponds to Figure 6 In the illustrated embodiment, the application belongs to the first application system, and the sub-identity authentication center is the identity authentication authority deployed by the first application system; the parent center application B corresponds to... Figure 6 In the illustrated embodiment, the application belongs to the second application system, and the parent identity authentication center is the identity authentication authority deployed by the second application system.

[0120] like Figure 7As shown, userX opens the client and attempts to log in to sub-center application A. Sub-center application A checks the user's login status accordingly. If the user is already logged in, the application allows the user to log in. If the user is not logged in, the application redirects to the sub-identity authentication center. The sub-identity authentication center displays a login page to the client to obtain the authentication information entered by the user on the login page. Based on the authentication information, the center authenticates the user. Upon successful authentication, an initial login credential (scertX = base64(header + sbody + ssign)) is generated for the user. This initial login credential contains the credential content and a first signature (ssign) obtained by signing the credential content using the sub-center's private key (sprivkey). The sub-identity authentication center also requests a general login credential from the parent identity authentication center for the user, carrying the initial login credential and the parent center's corresponding authentication keys (fauthkey and fauthsecret). Here, fauthkey represents the key identifier, and fauthsecret represents the key body. The parent authentication center verifies the correctness of the authentication key. If the verification is correct, it indicates that the parent authentication center recognizes the legitimacy of the child authentication center's identity and thus accepts the login credentials issued to the user by the child authentication center. Therefore, it uses the parent center's private key fprivkey to sign the credential content contained in the initial login credential, obtaining a second signature fsign. Then, based on the credential content contained in the initial login credential, the first signature, and the obtained signature, it generates a general login credential sfcertX = (base64(header+sbody+fsign+ssign)). The parent authentication center sends the obtained general login credential to the child authentication center. The child authentication center returns the received general login credential and the pre-set callback address corresponding to the child application A to the client. The client stores the received general login credential and sends it to the received callback address. The child application A uses the child center's public key spubkry to verify whether the first signature contained in the general login credential carried by the client is correct. If correct, it further verifies the validity of the general login credential. If the credential is determined to be valid, the user is allowed to log in to the child application A.

[0121] Furthermore, after obtaining the general login credentials, if a user initiates access to parent application B within the same client environment, the client will send an application access request to parent application B along with the general login credentials. Parent application B uses its parent public key fpubkry to verify the correctness of the second signature contained in the general login credentials. If correct, it further verifies the validity of the general login credentials. If the credentials are valid, the user is allowed to log in to parent application B.

[0122] It should also be noted that after obtaining the general login credentials, the client can initiate access to any application belonging to a sub-center or parent center within the same client environment. The client will then send the general login credentials to request access to the corresponding application. The application can then verify the signature contained in the general login credentials using the public key of the center to which it belongs. This process will not be elaborated further here.

[0123] As can be seen from the above, during the process of obtaining the general login credentials, the sub-authentication center and the parent authentication center only need to perform an interactive verification once. In the subsequent process of the client accessing the application, the verification of the general login credentials no longer requires the sub-authentication center or the parent authentication center to participate in the credential verification, which simplifies the process of the client accessing the application and thus improves the performance and efficiency of application access.

[0124] Please see Figure 8 , Figure 8 This is a flowchart illustrating another exemplary embodiment of the present application, showing an application login control method. This method is applied to application scenarios where the central hierarchy of the first application system is higher than that of the second application system, and is specifically executed by the first application system. For example, the first application hierarchy corresponds to the parent center, and the second application system corresponds to the child center. Figure 8 As shown, the method includes at least steps S310 to S350, as follows:

[0125] Step S310: Receive an authentication request sent by an application belonging to the first application system. The authentication request is generated by the application belonging to the first application system after determining that the user login status of the client is not logged in based on the application login request initiated by the client.

[0126] Step S330: Perform user authentication on the client according to the first authentication request, and generate an initial login credential after successful user authentication. The initial login credential contains credential content and a first signature. The first signature is obtained by the first application system using its own private key to sign the credential content.

[0127] In step S350, the initial login credential is returned to the client so that the client can send an access request to the application belonging to the second application system with the initial login credential. After the second application system successfully authenticates the identity of the first application system based on the access request, it signs the credential content contained in the initial login credential to obtain a second signature, and obtains the general login credential based on the credential content contained in the initial login credential, the first signature, and the second signature.

[0128] The content described above corresponding to steps S310 and S330 is consistent with... Figure 6The contents described in steps S210 and S230 of the illustrated embodiment are similar, and will not be repeated in this embodiment.

[0129] Corresponding to the content described in step S350, in this embodiment, since the central level of the first application system is higher than that of the second application system, users usually do not need permission from the second application system to access applications belonging to the first application system. Therefore, the first application system directly returns the initial login credential to the client, so that the client can request to access applications belonging to the second application system with the initial login credential, and obtain a general login credential in the process. Specifically, the application belonging to the second application system determines whether the credential is issued by the second application system based on the credential issuer information contained in the initial login credential. If it is not, it requests the second application system to verify the credential, which is equivalent to authenticating the identity of the first application system. After successful authentication, considering the validity period of the credential, it further determines whether the credential is valid based on the credential expiration date contained in the general login credential. If it is valid, it signs the credential content contained in the initial login credential using its own private key to obtain a second signature, and obtains the general login credential based on the credential content contained in the initial login credential, the first signature, and the second signature.

[0130] The following is passed Figure 9 The following is a detailed explanation of the interaction flow example in an exemplary application scenario. Figure 8 The illustrated embodiment reveals an application login control method. In Figure 9 In the application scenario shown, the parent application B corresponds to Figure 8 In the illustrated embodiment, the application belongs to the first application system, and the parent identity authentication center is the identity authentication authority deployed by the first application system; the sub-center application A corresponds to... Figure 8 In the illustrated embodiment, the application belongs to the second application system, and the sub-identity authentication center is the identity authentication authority deployed by the second application system.

[0131] like Figure 9As shown, userX opens the client and attempts to log in to parent application B. Parent application B checks the user's login status. If the user is already logged in, they are allowed to log in. If not, the user is redirected to the parent authentication center. The parent authentication center displays the login page to the client to obtain the authentication information entered by the user. It then authenticates the user based on this information. Upon successful authentication, it generates an initial login credential fcertX = (base64(header+fbody+fsign)). This credential contains the credential content and a first signature fsign obtained by signing the credential content using the parent application's private key fprivkey. The parent authentication center returns the initial login credential and the pre-set callback address corresponding to parent application B to the client. The client stores the received initial login credential and sends it to the received callback address. Parent application B uses its public key fpubkry to verify the first signature in the initial login credential. If correct, it further verifies the validity of the initial login credential. If the credential is valid, the user is allowed to log in to parent application B.

[0132] After obtaining the initial login credentials, if a user initiates access to sub-center application A within the same client environment, the client sends an application access request to sub-center application A along with the initial login credentials. Sub-center application A, based on markers contained in the initial login credentials, such as the credential issuer information in the credential content, determines that the initial login credentials are not issued by the sub-center and requests verification from the sub-identity authentication center. The sub-identity authentication center uses the parent center's public key `fpubkry` to verify the correctness of the first signature contained in the initial login credentials. If correct, it further verifies the validity of the initial login credentials. If the credentials are valid, it uses the sub-center's private key `sprivkey` to sign the credential content contained in the initial login credentials to obtain a second signature `ssign`. Based on the credential content, the first signature, and the obtained second signature, it generates a general login credential `fscertX = (base64(header+fbody+fsign+ssign))` and returns it to the client at the callback address corresponding to the general login credential and sub-center application A. The client updates the previously stored initial login credentials based on the received general login credential and then accesses sub-center application A with the general login credential. Sub-center application A uses the sub-center public key spubkry to verify whether the second signature contained in the login general credential carried by the client is correct. If it is correct, it further verifies the validity of the login general credential. If the credential is determined to be valid, it allows the user to log in to sub-center application A.

[0133] It should still be noted that after obtaining the general login credentials, the user can initiate access to any application belonging to a sub-center or parent center within the same client environment. The client will then send the general login credentials to request access to the corresponding application. The application can verify the signature contained in the general login credentials using the public key of the center to which it belongs. This will not be elaborated further here.

[0134] As can be seen from the above, in the process of obtaining the general login credentials, there is no need for the sub-authentication center and the parent authentication center to perform interactive verification. The sub-center only needs to use the parent center's public key to verify the signature contained in the initial login credentials. In the subsequent process of the client accessing the application, the verification of the general login credentials no longer requires the sub-authentication center or the parent authentication center to participate in the credential verification, which simplifies the process of the client accessing the application and can also improve the performance and efficiency of application access.

[0135] It should also be mentioned that the technical solutions provided in the above embodiments are applicable to scenarios such as cloud technology, artificial intelligence, smart transportation, and blockchain, enabling access to applications deployed in these scenarios and improving the security performance of application access. These scenarios correspond to application development projects with multiple centers, each corresponding to different application systems, and each center can operate independently without strictly depending on the operation of other centers. Each application system has its own identity authentication mechanism.

[0136] For example, in a cloud technology scenario, the identity authentication center deployed by the first application system and the identity authentication center deployed by the second application system can be deployed in the cloud, specifically as a cloud authentication server.

[0137] Alternatively, in a blockchain scenario, the non-private information such as public keys and authentication keys mentioned in the above embodiments can be stored on the blockchain. Applications or identity authentication centers can retrieve the relevant information from the blockchain as needed. If one party modifies its own key information, all parties can be notified in a timely manner, thereby ensuring the timeliness of data updates. It should be understood that blockchain is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and encryption algorithms. Essentially, it is a decentralized database, a chain of data blocks linked together using cryptographic methods. Each data block contains information about a batch of network transactions, used to verify the validity of the information (anti-counterfeiting) and generate the next block.

[0138] Alternatively, in the context of intelligent transportation, the first and second application systems can correspond to the first-level and second-level departments with traffic jurisdiction, such as the provincial traffic management department and the municipal traffic management department. The applications under the first and second application systems can deploy corresponding functions, such as querying map data within the jurisdiction, or querying information reported by vehicles, pedestrians, and road facilities under the Internet of Things deployed within the jurisdiction, etc., without limitation.

[0139] Figure 10 This is a block diagram illustrating an application login control device as an exemplary embodiment of this application. Figure 10 As shown, the exemplary application login control device 400 includes:

[0140] The login credential acquisition module 410 is configured to acquire a login credential containing signatures obtained by multiple application systems using their own private keys to sign the credential content. The credential content is used to indicate that one of the multiple application systems has successfully authenticated the user. The application access request module 430 is configured to send an access request to an application belonging to any of the multiple application systems. The access request carries the login credential, so that the application can verify the corresponding signature contained in the login credential using the public key of the application system to which it belongs. The application login module 450 is configured to log in to the application after the application has successfully verified the corresponding signature contained in the login credential.

[0141] In another exemplary embodiment, the multiple application systems include a first application system and a second application system; after successfully authenticating the user's identity, the first application system generates credential content and signs the credential content using its own private key to obtain a first signature, and the first signature and the credential content form an initial login credential; after successfully authenticating the user's identity with the first application system, the second application system signs the credential content contained in the initial login credential using its own private key to obtain a second signature, and the credential content contained in the initial login credential, the first signature, and the second signature form a general login credential.

[0142] In another exemplary embodiment, the central level corresponding to the first application system is lower than the central level corresponding to the second application system; the login general credential acquisition module 410 includes:

[0143] The first access request sending unit is configured to send an access request to an application belonging to the first application system, so that after determining that the user's login status is not logged in, the application belonging to the first application system requests the first application system to perform user authentication, and obtains the initial login credential after successful user authentication; the first login general credential receiving module is configured to receive the login general credential returned by the first application system in response to the login request. The login general credential is obtained by the second application system based on the initial login credential after successfully authenticating the first application system.

[0144] In another exemplary embodiment, the central level corresponding to the first application system is higher than the central level corresponding to the second system; the login general credential acquisition module 410 includes:

[0145] The second access request sending module is configured to send an access request to an application belonging to the first application system, so that the application belonging to the first application system, after determining that the user's login status is not logged in, requests the first application system to perform user authentication, and obtains an initial login credential after successful user authentication; the initial login credential receiving unit is configured to receive and store the initial login credential returned by the first application system; the third access request sending module is configured to send an access request to an application belonging to the second application system based on the initial login credential, so that the application belonging to the second application system, after determining that the initial login credential was not generated by its own application system, requests the second application system to perform authentication on the first application system, and obtains a general login credential based on the initial login credential after successful authentication; the second general login credential receiving module is configured to receive the general login credential returned by the second application system and update the stored initial login credential based on the general login credential.

[0146] In another exemplary embodiment, the login credential also includes a credential expiration period; the application login module 450 is configured to log in to the application if the credential is determined to be valid based on the credential expiration period contained in the login credential after the application has verified the corresponding signature contained in the login credential.

[0147] Figure 11 This is a block diagram illustrating an application login control device, as shown in another exemplary embodiment of this application. Figure 11 As shown, the exemplary application login control device 500 includes:

[0148] The authentication request receiving module 510 is configured to receive authentication requests sent by applications belonging to the first application system. These authentication requests are generated by the application belonging to the first application system after determining that the user's login status is not logged in based on the client's application login request. The user authentication module 530 is configured to perform user authentication on the client based on the authentication request, and generate initial login credentials after successful authentication. The initial login credentials contain credentials and a first signature, which is obtained by the first application system using its own private key to sign the credentials. The authentication request module 550 is configured to request the second application system to authenticate the first authentication system based on the authentication key and the initial login credentials. After successful authentication, it uses its own private key to sign the credentials contained in the initial login credentials to obtain a second signature. A general login credential is obtained based on the credentials contained in the initial login credentials, the first signature, and the second signature. The general login credential forwarding module 570 is configured to forward the general login credential sent by the second application system to the client, enabling the client to access applications belonging to either the first or second application system using the general login credential.

[0149] In another exemplary embodiment, the user authentication module 530 includes:

[0150] The user authentication information acquisition unit is configured to display a login page to the client and acquire the user authentication information entered on the login page; the credential content generation unit is configured to determine that the user's identity authentication is successful and generate the corresponding credential content if the user authentication information is determined to be valid.

[0151] The login initial credential generation unit is configured to sign the credential content using its own private key to obtain a first signature, and then generate the login initial credential based on the first signature and the credential content.

[0152] In another exemplary embodiment, the device further includes:

[0153] The callback address acquisition module is configured to acquire the callback address stored locally. The callback address is used to indicate a specific page contained in the application belonging to the first application system. The callback address sending module is configured to send the callback address to the client so that the client can access the application belonging to the first application system based on the callback address.

[0154] Figure 12 This is a block diagram illustrating an application login control device, as shown in another exemplary embodiment of this application. Figure 12 As shown, the exemplary application login control device 600 includes:

[0155] The authentication request receiving module 610 is configured to receive authentication requests sent by applications belonging to the first application system. The authentication request is generated by the application belonging to the first application system after determining that the user login status of the client is not logged in based on the application login request initiated by the client. The user authentication module 630 is configured to perform user authentication on the client based on the first authentication request, and generate an initial login credential after successful user authentication. The initial login credential contains credential content and a first signature. The first signature is obtained by the first application system using its own private key to sign the credential content. The initial login credential return module 650 is configured to return the initial login credential to the client, so that the client can send an access request to an application belonging to the second application system carrying the initial login credential. After the second application system successfully authenticates the first application system based on the access request, it signs the credential content contained in the initial login credential to obtain a second signature, and obtains a general login credential based on the credential content contained in the initial login credential, the first signature, and the second signature.

[0156] In another exemplary embodiment, the second application system verifies the first signature contained in the initial login credential based on the public key corresponding to the first application system stored locally. After successful verification, if the credential is determined to be valid based on the credential validity period contained in the general login credential, then the identity authentication of the first application system is determined to be successful.

[0157] It should be noted that the device provided in the above embodiments and the application login control method provided in the above embodiments belong to the same concept. The specific way in which each module and unit performs operations has been described in detail in the method embodiments, and will not be repeated here.

[0158] Embodiments of this application also provide an electronic device, including: one or more processors; and a storage device for storing one or more programs, which, when executed by the one or more processors, cause the electronic device to implement the application login control method provided in the above embodiments.

[0159] Figure 13 A schematic diagram of the structure of a computer system suitable for implementing the electronic device of the present application is shown.

[0160] It should be noted that, Figure 13 The computer system 800 of the electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0161] like Figure 13As shown, the computer system 800 includes a Central Processing Unit (CPU) 801, which can perform various appropriate actions and processes based on programs stored in Read-Only Memory (ROM) 802 or programs loaded from storage portion 808 into Random Access Memory (RAM) 803, such as performing the methods described in the above embodiments. The RAM 803 also stores various programs and data required for system operation. The CPU 801, ROM 802, and RAM 803 are interconnected via a bus 804. An Input / Output (I / O) interface 805 is also connected to the bus 804.

[0162] The following components are connected to I / O interface 805: an input section 806 including a keyboard, mouse, etc.; an output section 807 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 808 including a hard disk, etc.; and a communication section 809 including a network interface card such as a LAN (Local Area Network) card, modem, etc. The communication section 809 performs communication processing via a network such as the Internet. A drive 810 is also connected to I / O interface 805 as needed. A removable medium 811, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 810 as needed so that computer programs read from it can be installed into storage section 808 as needed.

[0163] Specifically, according to embodiments of this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program including a computer program for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 809, and / or installed from removable medium 811. When the computer program is executed by central processing unit (CPU) 801, it performs various functions defined in the system of this application.

[0164] It should be noted that the computer-readable medium shown in the embodiments of this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, optical fiber, portable compact disc read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying a computer-readable computer program. The transmitted data signal can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The computer program contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to wireless, wired, etc., or any suitable combination thereof.

[0165] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. Each block in a flowchart or block diagram may represent a module, segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0166] The units described in the embodiments of this application can be implemented in software or hardware, and the described units can also be located in a processor. The names of these units do not necessarily limit the specific unit itself.

[0167] Another aspect of this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the application login control method as described above. This computer-readable storage medium may be included in the electronic device described in the above embodiments, or it may exist independently and not assembled into the electronic device.

[0168] Another aspect of this application provides a computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the application login control method provided in the various embodiments described above.

[0169] The above description is merely a preferred exemplary embodiment of this application and is not intended to limit the implementation of this application. Those skilled in the art can easily make corresponding modifications or alterations based on the main concept and spirit of this application. Therefore, the scope of protection of this application should be determined by the scope of protection claimed in the claims.

Claims

1. An application log-in control method characterized by comprising: The method includes: Obtain a general login credential, which contains signatures obtained by multiple application systems using their own private keys to sign the credential content. The credential content is used to indicate that one of the multiple application systems has successfully authenticated the user. Send an access request to an application belonging to any of the multiple application systems, the access request carrying the login credential, so that the application can verify the corresponding signature contained in the login credential based on the public key corresponding to the application system to which it belongs; After the application verifies the corresponding signature contained in the login credentials, the user logs into the application. The plurality of application systems include a first application system and a second application system, wherein one of the first application system and the second application system corresponds to a sub-center and the other application system corresponds to a parent center; After successfully authenticating the user's identity, the first application system generates credential content and signs the credential content using its own private key to obtain a first signature. The first signature and the credential content form the initial login credential. After successfully authenticating the identity of the first application system, the second application system uses its own private key to sign the credential content contained in the initial login credential to obtain a second signature. The credential content contained in the initial login credential, the first signature, and the second signature form the general login credential.

2. The method of claim 1, wherein, The central level corresponding to the first application system is lower than the central level corresponding to the second application system; The process of obtaining the general login credential includes: Send an access request to the application belonging to the first application system, so that after the application belonging to the first application system determines that the user's login status is not logged in, it requests the first application system to perform user authentication, and obtains the initial login credentials after the user's authentication is successful. The system receives a general login credential returned by the first application system in response to the login request. The general login credential is obtained by the second application system after successfully authenticating the identity of the first application system, based on the initial login credential.

3. The method of claim 2, wherein, The method further includes: After determining that the user's login status is not logged in, the application belonging to the first application system sends an authentication request to the identity authentication center deployed by the first application system. The identity authentication center deployed in the first application system performs user authentication on the client according to the authentication request, and generates an initial login credential after successful user authentication. Based on the authentication key of the identity authentication center deployed in the second application system and the initial login credential, it requests the identity authentication center deployed in the second application system to perform identity authentication on the identity authentication center deployed in the first authentication system. After successfully authenticating the identity of the first authentication system's identity authentication center, the second application system's deployed identity authentication center uses its own private key to sign the credential content contained in the initial login credential to obtain a second signature. Based on the credential content contained in the initial login credential, the first signature, and the second signature, it obtains a general login credential and sends the obtained general login credential to the first application system's deployed identity authentication center. The identity authentication center deployed in the first application system forwards the received login credentials to the client.

4. The method of claim 3, wherein, The identity authentication center deployed in the first application system performs user authentication on the client based on the authentication request, and generates initial login credentials after successful user authentication, including: The identity authentication center deployed in the first application system displays a login page to the client and obtains the user authentication information entered on the login page. If the user authentication information is determined to be valid, the user identity authentication is confirmed to be successful, and the corresponding credential content is generated. The first signature is obtained by signing the credential content using the user's private key, and an initial login credential is generated based on the first signature and the credential content.

5. The method of claim 3, wherein, The method further includes: The identity authentication center deployed in the first application system also obtains a locally stored callback address, which is used to indicate a specific page contained in the application belonging to the first application system; The callback address and the login credentials are sent together to the client so that the client can access the application belonging to the first application system based on the callback address.

6. The method of claim 1, wherein, The central level corresponding to the first application system is higher than the central level corresponding to the second system; The process of obtaining the general login credential includes: Send an access request to the application belonging to the first application system, so that after the application belonging to the first application system determines that the user's login status is not logged in, it requests the first application system to perform user authentication, and obtains the initial login credentials after the user's authentication is successful. Receive and store the initial login credentials returned by the first application system; Based on the initial login credentials, an access request is sent to the application belonging to the second application system, so that after the application belonging to the second application system determines that the initial login credentials were not generated by the application system to which it belongs, it requests the second application system to authenticate the first application system, and obtains a general login credentials based on the initial login credentials after successful authentication. Receive the universal login credentials returned by the second application system, and update the stored initial login credentials based on the universal login credentials.

7. The method of claim 6, wherein, After determining that the user's login status is not logged in, the application belonging to the first application system requests the first application system to perform user authentication. Upon successful user authentication, it obtains initial login credentials, including: After determining that the user's login status is not logged in, the application belonging to the first application system sends an authentication request to the identity authentication center deployed by the first application system. The identity authentication center deployed in the first application system performs user authentication on the client according to the authentication request, and generates an initial login credential after successful user authentication, and returns the initial login credential and the callback address corresponding to the application to which the first application system belongs to to the client.

8. The method of claim 6, wherein, After determining that the initial login credential was not generated by its own application system, an application belonging to the second application system requests the second application system to authenticate the first application system. Upon successful authentication, the application obtains a general login credential based on the initial login credential, including: After determining that the initial login credential was not generated by the application system to which it belongs, the application belonging to the second application system sends an authentication request carrying the initial login credential to the identity authentication center deployed by the second application system. In response to the authentication request, the identity authentication center deployed in the second application system verifies the first signature contained in the initial login credential based on the public key of the identity authentication center deployed in the first application system stored locally. After successful verification, the system obtains the general login credential based on the initial login credential.

9. The method according to claim 8, characterized in that, The method further includes: After the first signature contained in the initial login credential is verified, if the identity authentication center deployed by the second application system determines that the credential is valid based on the credential time limit contained in the general login credential, then the general login credential is obtained based on the initial login credential.

10. The method according to claim 1, characterized in that, The login credential also includes a credential expiration period; the step of logging into the application after the application verifies the corresponding signature contained in the login credential, includes: After the application verifies the corresponding signature contained in the login credential, if the credential is determined to be valid according to the credential validity period contained in the login credential, then the user logs into the application.

11. An application login control method, characterized in that, The method includes: Receive authentication requests sent by applications belonging to the first application system; The client is authenticated according to the authentication request, and an initial login credential is generated after successful authentication. The initial login credential contains credential content and a first signature, which is obtained by the first application system using its own private key to sign the credential content. Based on the authentication key corresponding to the second application system and the initial login credential, the system requests the second application system to authenticate the identity of the first authentication system. After successful authentication, the system uses its own private key to sign the credential content contained in the initial login credential to obtain a second signature. Based on the credential content contained in the initial login credential, the first signature, and the second signature, a general login credential is obtained. The login credentials sent by the second application system are forwarded to the client, so that the client can use the login credentials to access applications belonging to the first application system or the second application system. In this system, one of the first application system and the second application system corresponds to a sub-center, and the other application system corresponds to a parent center.

12. An application login control method, characterized in that, The method includes: Receive authentication requests sent by applications belonging to the first application system; The client is authenticated according to the authentication request, and an initial login credential is generated after successful authentication. The initial login credential contains credential content and a first signature, which is obtained by the first application system using its own private key to sign the credential content. The initial login credential is returned to the client so that the client can send an access request to the application belonging to the second application system with the initial login credential. After the second application system successfully authenticates the identity of the first application system based on the access request, it signs the credential content contained in the initial login credential to obtain a second signature, and obtains a general login credential based on the credential content contained in the initial login credential, the first signature, and the second signature. In this system, one of the first application system and the second application system corresponds to a sub-center, and the other application system corresponds to a parent center.

13. An application login control device, characterized in that, The device includes: The login general credential acquisition module is configured to acquire a login general credential. The login general credential contains signatures obtained by multiple application systems using their own private keys to sign the credential content. The credential content is used to indicate that one of the multiple application systems has successfully authenticated the user. The application access request module is configured to send an access request to an application belonging to any of the multiple application systems. The access request carries the login general credential, so that the application can verify the corresponding signature contained in the login general credential based on the public key corresponding to the application system to which it belongs. The application login module is configured to log in to the application after the application has successfully verified the corresponding signature contained in the general login credentials; The plurality of application systems include a first application system and a second application system, wherein one of the first application system and the second application system corresponds to a sub-center and the other application system corresponds to a parent center; After successfully authenticating the user's identity, the first application system generates credential content and signs the credential content using its own private key to obtain a first signature. The first signature and the credential content form the initial login credential. After successfully authenticating the identity of the first application system, the second application system uses its own private key to sign the credential content contained in the initial login credential to obtain a second signature. The credential content contained in the initial login credential, the first signature, and the second signature form the general login credential.

14. An electronic device, characterized in that, include: One or more processors; A storage device for storing one or more programs, which, when executed by one or more processors, cause the electronic device to implement the application login control method as described in any one of claims 1 to 12.

15. A computer-readable storage medium, characterized in that, It stores computer-readable instructions that, when executed by the computer's processor, cause the computer to perform the application login control method as described in any one of claims 1 to 12.

16. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the application login control method according to any one of claims 1 to 12.

Images