A password-free login system, method, device, storage medium and equipment

Abstract

The specification discloses a password-free login system, method, device, storage medium and equipment, in the system, a terminal responds to a password-free login request of a user, judges whether there is an authorization token corresponding to an account identifier, if yes, sends the password-free login request carrying the account identifier and the authorization token to a server in the system, otherwise, displays a verification information input interface, responds to the verification information input by the user, sends the verification information and the account identifier in the password-free login request to the server, the server determines that the authentication information set when the account corresponding to the account identifier is registered matches the verification information, determines that the terminal logs in the account and generates an authorization token and returns the terminal, when receiving the password-free login request with the authorization token, determines that the terminal logs in the account. The terminal can request the server to log in the account of the user based on the stored authorization token instead of the account password, the operation of the user when logging in is more convenient, the password is not leaked due to the input of the password, and the security is higher.

Description

Technical Field

[0001] This specification relates to the field of communication technology, and in particular to a passwordless login system, method, apparatus, storage medium and device. Background Technology

[0002] Currently, users are increasingly concerned about their privacy. When logging into various clients, users typically need to use their registered username and password. However, logging in by entering a password is cumbersome and inconvenient, and repeatedly entering the password increases the risk of password leakage.

[0003] Therefore, this manual provides a method for passwordless login to the client. Summary of the Invention

[0004] This specification provides a passwordless login system, method, apparatus, storage medium, and device to at least partially solve the problems existing in the prior art.

[0005] The following technical solution is adopted in this specification:

[0006] This specification provides a passwordless login system, which includes a terminal and a server, wherein:

[0007] The terminal, in response to a received passwordless login request from a user, determines whether it stores an authorization token corresponding to an account identifier. If so, it sends a passwordless login request carrying the account identifier and the authorization token to the server. If not, it displays a verification information input interface, responds to the verification information input by the user, and sends the verification information and the account identifier in the passwordless login request to the server; it also receives and stores the authorization token returned by the server.

[0008] When the server receives a passwordless login request carrying the verification information and the account identifier, it determines the account corresponding to the account identifier and the authentication information set during account registration. When it determines that the authentication information matches the verification information, it determines that the terminal is logging into the account corresponding to the account identifier and generates an authorization token and returns it to the terminal. When it receives a passwordless login request carrying the account identifier and the authorization token, it determines that the terminal is logging into the account corresponding to the account identifier.

[0009] This manual provides a passwordless login method for use on a terminal, the method comprising:

[0010] In response to a received passwordless login request from a user, determine whether an authorization token corresponding to the account identifier is stored.

[0011] If not present, a verification information input interface is displayed. In response to the verification information input by the user, the verification information and the account identifier are sent to the server along with the passwordless login request. When the server receives the passwordless login request carrying the verification information and the account identifier, it determines the account corresponding to the account identifier based on the account identifier and determines the authentication information set during account registration. When the authentication information matches the verification information, the server determines that the terminal is logging into the account corresponding to the account identifier and generates an authorization token to return to the terminal.

[0012] Receive the authorization token returned by the server and store it;

[0013] If present, a passwordless login request carrying the account identifier and the authorization token is sent to the server, so that when the server receives the passwordless login request carrying the account identifier and the authorization token, it determines that the terminal is logging into the account corresponding to the account identifier.

[0014] This manual provides a passwordless login method for use on a server, the method comprising:

[0015] When a passwordless login request carrying verification information and an account identifier is received from a terminal, the account corresponding to the account identifier is determined based on the account identifier, and the authentication information set during account registration is determined; wherein, the verification information is entered by the user in the input interface of the terminal; the input interface is displayed by the terminal in response to the received passwordless login request entered by the user and when it is determined that no authorization token corresponding to the account identifier is stored.

[0016] When it is determined that the authentication information matches the verification information, the terminal is logged into the account corresponding to the account identifier, and an authorization token is generated and returned to the terminal.

[0017] When a passwordless login request carrying the account identifier and the authorization token is received, it is determined that the terminal is logging into the account corresponding to the account identifier. The passwordless login request carrying the authorization token is sent by the terminal in response to the received passwordless login request input by the user and after determining that it has stored the authorization token corresponding to the account identifier.

[0018] This specification provides a passwordless login system, which includes a first client, a second client, a first server, and a second server, wherein:

[0019] The first client is used to send a passwordless login request to the second client; receive the user's account identifier and authorization token sent by the second server, and forward them to the first server;

[0020] The second client is used to receive the passwordless login request sent by the first client, display the authorization interface and respond to the user's authorization operation, and generate an authorization request based on the account identifier logged in by the user on the second client and send it to the second server;

[0021] The second server is configured to receive an authorization request carrying the account identifier sent by the second client, determine the authorization token corresponding to the account identifier, store the correspondence between the account identifier and the authorization token, and send the authorization token and the account identifier to the first client; receive a verification request carrying the account identifier and the authorization token sent by the first server, perform verification according to the stored correspondence and the verification request, and return the verification result of the authorization token to the first server;

[0022] The first server is configured to receive the account identifier and the authorization token sent by the first client, and send them to the second server in a verification request; when the verification result sent by the second server is passed, it determines that the account corresponding to the account identifier has logged in on the first client.

[0023] This specification provides a passwordless login method applied to a first client, the method comprising:

[0024] A passwordless login request is sent to the second client, causing the second client to display an authorization interface and respond to the user's authorization operation based on the passwordless login request. An authorization request is generated based on the account identifier of the user logged in on the second client and sent to the second server, so that the second server receives the authorization request sent by the second client carrying the account identifier, determines the authorization token corresponding to the account identifier, and stores the correspondence between the account identifier and the authorization token.

[0025] Receive the account identifier and the authorization token sent by the second server;

[0026] The account identifier and the authorization token are forwarded to the first server, so that the first server sends the account identifier and the authorization token in a verification request to the second server, so that the second server receives the verification request sent by the first server carrying the account identifier and the authorization token, performs verification according to the stored correspondence and the verification request, and returns the verification result of the authorization token to the first server, so that when the first server receives the verification result as passed, it determines that the account corresponding to the account identifier is logged in on the first client.

[0027] This manual provides a passwordless login method for a second client, the method comprising:

[0028] Receive a passwordless login request sent by the first client, and display an authorization interface based on the passwordless login request;

[0029] In response to the user's authorization action, an authorization request is generated based on the account identifier that the user logged in on the second client;

[0030] The authorization request is sent to the second server, which determines the authorization token corresponding to the account identifier based on the authorization request, stores the correspondence between the account identifier and the authorization token, and sends the authorization token and the account identifier to the first client. The first client forwards the authorization token and the account identifier to the first server, which then sends the account identifier and the authorization token in a verification request to the second server. The second server performs verification based on the verification request and the stored correspondence, and returns the verification result of the authorization token to the first server. When the first server receives a successful verification result, it determines that the account corresponding to the account identifier is logged in on the first client.

[0031] This specification provides a passwordless login method applied to a first server, the method comprising:

[0032] The system receives an account identifier and an authorization token sent by a first client. The account identifier and the authorization token are obtained by the first client through a second client and a second server. The authorization token is generated by the second server based on the generation of an authorization request. The generation of the authorization request is determined by the second client in response to the user's operation on the authorization interface. The authorization interface is displayed by the second client based on the passwordless login request sent by the first client.

[0033] The account identifier and the authorization token are sent to the second server in the verification request, so that the second server performs verification according to the stored correspondence between the account identifier and the authorization token and the verification request, and returns the verification result of the authorization token to the first server;

[0034] When the verification result received from the second server is passed, it is determined that the account corresponding to the account identifier has logged in on the first client.

[0035] This manual provides a passwordless login method applied to a second server, the method comprising:

[0036] The system receives an authorization request carrying an account identifier from a second client. The authorization request is generated by the second client in response to the user's authorization operation on the authorization interface, based on the account identifier logged in by the user on the second client. The authorization interface is determined by the second client based on the passwordless login request sent by the first client.

[0037] Determine the authorization token corresponding to the account identifier, store the correspondence between the account identifier and the authorization token, and send the authorization token and the account identifier to the first client, so that the first client forwards the authorization token and the account identifier to the first server;

[0038] The system receives a verification request from the first server carrying the account identifier and the authorization token, performs verification according to the stored correspondence and the verification request, and returns the verification result of the authorization token to the first server. When the first server receives the verification result as passed, it determines that the account corresponding to the account identifier has logged in on the first client.

[0039] This specification provides a passwordless login system, the system comprising: a first client and a first server corresponding to the first client, a second client and a second server corresponding to the second client, and a third client and a third server corresponding to the third client; wherein:

[0040] The third client is used to send a passwordless login request to the third server; receive the account identifier and authorization token sent by the third server, and send them to the first client;

[0041] The third server is configured to receive a passwordless login request sent by the third client, determine the account identifier of the user corresponding to the third client on the second client, and send the account identifier to the second server in the passwordless login request; receive the account identifier and authorization token sent by the second server, store the correspondence between the account identifier and the authorization token, and send the account identifier and the authorization token to the third client; receive a first verification request sent by the first server carrying the account identifier and the authorization token, perform verification according to the stored account identifier, the authorization token and the first verification request, and return a first verification result of the authorization token to the first server;

[0042] The second server is configured to receive the passwordless login request sent by the third server and forward it to the second client; receive the authorization request sent by the second client carrying the account identifier, generate an authorization token corresponding to the account identifier, and send the authorization token and the account identifier to the third server;

[0043] The second client is used to receive the passwordless login request sent by the second server, display the authorization interface and respond to the user's authorization operation, and generate an authorization request based on the account identifier and send it to the second server;

[0044] The first client is configured to receive an account identifier and authorization token sent by the third client, and in response to the login request input by the user, forward the account identifier and authorization token to the first server corresponding to the first client; and receive service resources sent by the first server;

[0045] The first server is configured to receive the account identifier and authorization token sent by the first client, and send them to the third server in a first verification request; receive the first verification result of the authorization token sent by the third server, and when the first verification result is passed, determine that the account corresponding to the account identifier is logged in on the corresponding first client, and send the business resources of the account corresponding to the account identifier being logged in on the corresponding first client to the corresponding first client.

[0046] This specification provides a passwordless login method applied to a first client, the method comprising:

[0047] Receive account identifiers and authorization tokens sent by third-party clients;

[0048] In response to a login request entered by a user, the account identifier and the authorization token are forwarded to the first server corresponding to the first client, so that the first server sends the account identifier and the authorization token to the third server in the first verification request;

[0049] When the first verification result returned by the third server to the first server is passed, the service resources sent by the first server are received.

[0050] Wherein: the authorization token corresponding to the account identifier is generated by the second server based on the user's authorization operation on the authorization interface of the second client, and sent to the third client. The authorization interface is generated by the second client based on the third server and the passwordless login request of the third client forwarded by the second server.

[0051] This specification provides a passwordless login method applied to a first server, the method comprising:

[0052] Receives an account identifier and authorization token sent by the first client corresponding to itself, wherein the account identifier and authorization token are sent from the third client to the first client;

[0053] The account identifier and the authorization token are sent to the third server in the first verification request;

[0054] Receive the first verification result of the authorization token sent by the third server, and when the first verification result is passed, determine that the account corresponding to the account identifier is logged in on the corresponding first client, and send the business resources of the account corresponding to the account identifier to the corresponding first client, where the first client is in a logged-in state;

[0055] The authorization token corresponding to the account identifier is generated by the second server according to the authorization request and sent to the third client. The authorization request is generated by the second client based on the user's authorization operation on the authorization interface. The authorization interface is generated by the second client based on the third server and the passwordless login request of the third client forwarded by the second server.

[0056] This manual provides a passwordless login method for a second client, the method comprising:

[0057] Receive a passwordless login request sent by the second server, carrying the account identifier;

[0058] Display the authorization interface;

[0059] In response to the user's authorization operation, an authorization request is generated based on the account identifier and sent to the second server, causing the second server to generate an authorization token corresponding to the account identifier. The account identifier and the authorization token are then sent to the first client through the third server and the third client. The first client then performs passwordless login through the first server based on the authorization token corresponding to the account identifier.

[0060] The passwordless login request is sent from the third client to the second client through the third server and the second server.

[0061] This manual provides a passwordless login method applied to a second server, the method comprising:

[0062] Receive a passwordless login request sent by a third-party server, carrying an account identifier;

[0063] The passwordless login request is forwarded to the second client;

[0064] Receive the authorization request carrying the account identifier sent by the second client, and generate an authorization token corresponding to the account identifier;

[0065] The authorization token and the account identifier are sent to the third server, so that the third server stores the correspondence between the account identifier and the authorization token. When receiving the first verification request sent by the first server, the third server verifies the authorization token and the account identifier according to the stored information and returns the first verification result of the authorization token to the first server.

[0066] The first server determines whether the first client can log in without a password based on the first verification result.

[0067] This manual provides a passwordless login method for use on a third-party client. The method includes:

[0068] Send a passwordless login request to the third server, so that the third server carries the account identifier of the user corresponding to the third client in the passwordless login request and sends it to the second client through the second server, so that the second client responds to the user's authorization operation and generates an authorization request;

[0069] Receive the account identifier and authorization token sent by the third server, wherein the authorization token is generated by the second server based on the authorization request sent by the second client and sent to the third server;

[0070] The account identifier and the authorization token are sent to the first client, so that the first client responds to the login request entered by the user and forwards the account identifier and the authorization token to the first server;

[0071] Specifically, the first server determines whether the first client can log in without a password based on the first verification result of the authorization token sent by the third server.

[0072] This manual provides a passwordless login method applied to a third-party server, the method comprising:

[0073] Receive passwordless login requests sent by third-party clients;

[0074] The user's account identifier corresponding to the third client is determined on the second client, and the account identifier is carried in the passwordless login request and forwarded to the second client through the second server, so that the second client responds to the user's authorization operation, generates an authorization request and sends it to the second server;

[0075] The system receives the account identifier and authorization token sent by the second server, stores the correspondence between the account identifier and the authorization token, and forwards it to the first client through the third client, so that the first client sends it to the first server. The authorization token is generated by the second server according to the authorization request.

[0076] The system receives a first verification request sent by the first server, which carries the account identifier and the authorization token. It performs verification based on the stored account identifier, the authorization token and the first verification request, and returns the first verification result of the authorization token to the first server.

[0077] The first server determines whether the first client can log in without a password based on the first verification result of the authorization token.

[0078] This specification provides a passwordless login system, comprising: a first client, a first server, a proxy server, a second client, a second server, and a third server. The first client is a browser client, the first server is a business server for a specified application, and the second server is a business server for the second client.

[0079] The first client is configured to send a login page retrieval request for the specified application to the first server; receive the login page corresponding to the second client sent by the proxy server, and in response to the user's operation on the login page, send a passwordless login request carrying the user's account identifier in the second client to the proxy server; generate a resource retrieval request and send it to the proxy server based on the received account identifier and its corresponding authorization token; and receive business resources sent by the first server.

[0080] The proxy server is configured to: receive login page retrieval requests sent by the first client to the first server; and, when determining that the specified application does not support passwordless login, send the login page corresponding to the second client to the first client; receive passwordless login requests sent by the first client and forward them to the second client; receive account identifiers and their corresponding authorization tokens sent by the second client and forward them to the first client; and receive resource retrieval requests sent by the first client and forward them to the first server.

[0081] The second client is configured to receive a passwordless login request carrying the account identifier sent by the proxy server, display an authorization interface and respond to the user's authorization operation, generate an authorization request based on the account identifier and send it to the second server; receive the account identifier and its corresponding authorization token sent by the second server and send it to the proxy server.

[0082] The second server is configured to receive an authorization request carrying the account identifier sent by the second client and forward it to the third server; and to receive the account identifier and its corresponding authorization token sent by the third server and send them to the second client.

[0083] The third server is configured to receive the authorization request, determine the authorization token corresponding to the account identifier, and determine the correspondence between the account identifier and the authorization token, and send the user's account identifier in the second client and the determined authorization token to the second server; receive the verification request sent by the first server carrying the account identifier and the authorization token, perform verification according to the stored correspondence and the verification request, and return the verification result to the first server;

[0084] The first server is configured to receive the account identifier and authorization token carried in the resource acquisition request sent by the proxy server, and send them to the third server in the verification request; receive the verification result sent by the third server, and when the verification result is passed, determine the account of the second client corresponding to the account identifier in the specified application login, and send the business resources in the login state corresponding to the specified application to the first client.

[0085] This manual provides a passwordless login method applied to a browser client, the method comprising:

[0086] Send a request to the first server to retrieve the login page of the specified application;

[0087] The proxy server receives the login page corresponding to the second client, which is sent by the proxy server after obtaining the login page request and determining that the specified application does not support passwordless login.

[0088] In response to the user's operation on the login page, the proxy server sends a passwordless login request carrying the user's account identifier on the second client to the second client, causing the second client to display an authorization interface and respond to the user's authorization operation. The second client generates an authorization request based on the account identifier and forwards it to the third server through the second server. The third server determines the authorization token corresponding to the account identifier and sends it to the second client through the second server.

[0089] Based on the account identifier and its corresponding authorization token received from the second client through the proxy server, a resource acquisition request is generated and sent to the first server through the proxy server;

[0090] The system receives service resources in the login state corresponding to the specified application sent by the first server. These service resources are sent by the first server after determining that the account of the second client corresponding to the account identifier is logged in to the specified application, when the verification result of the authorization token sent by the third server is passed.

[0091] This manual provides a passwordless login method for use with a proxy server, the method comprising:

[0092] Obtain the login page retrieval request for the specified application sent by the browser client to the first server;

[0093] When it is determined that the specified application does not support passwordless login, the login page corresponding to the second client is sent to the browser client.

[0094] The browser client receives a passwordless login request sent in response to the user's operation on the login page, carrying the user's account identifier on the second client, and forwards it to the second client, causing the second client to display an authorization interface and respond to the user's authorization operation. The second client generates an authorization request based on the account identifier and forwards it to the third server through the second server.

[0095] The system receives the account identifier and its corresponding authorization token sent by the second client and forwards it to the browser client. The authorization token is determined by the third server based on the authorization request and sent to the second client by the second server.

[0096] Receive the resource acquisition request sent by the browser client, which carries the account identifier and the authorization token, and forward it to the first server;

[0097] When the first server receives a verification result from the third server indicating that the authorization token has passed, it determines the account of the second client corresponding to the account identifier in the specified application login and sends the business resources corresponding to the login status of the specified application to the browser client.

[0098] This specification provides a passwordless login method applied to a first server, the method comprising:

[0099] The system receives an account identifier and authorization token carried in a resource acquisition request sent by a browser client through a proxy server. The authorization token is determined by a third server based on an authorization request carrying the account identifier forwarded by a second client through the second server.

[0100] The account identifier and the authorization token are sent to the third server along with the verification request;

[0101] Receive the verification result returned by the third server based on the verification request, and when the verification result is passed, determine to log in to the account of the second client corresponding to the account identifier on the login page of the specified application;

[0102] Send the business resources corresponding to the login status of the specified application to the browser client;

[0103] The authorization request is generated by the second client based on the account identifier, which is forwarded by the browser client through the proxy server and carries the account identifier for passwordless login. The second client displays the authorization interface and responds to the user's authorization operation. The passwordless login request is determined by the browser client in response to the user's operation on the login page of the second client returned by the proxy server when the proxy server determines that the specified application corresponding to the login page requested by the browser client does not support passwordless login.

[0104] This manual provides a passwordless login method for a second client, the method comprising:

[0105] The browser client receives a passwordless login request sent through a proxy server, which carries the user's account identifier on the second client. The passwordless login request is determined by the browser client sending a request to the proxy server to obtain the login page of the specified application, and receiving the login page corresponding to the second client returned by the proxy server, in response to the user's operation on the login page.

[0106] The system displays an authorization interface and responds to the user's authorization operation. It generates an authorization request based on the account identifier and sends it to the third server through the second server, enabling the third server to determine the authorization token corresponding to the account identifier.

[0107] The system receives the account identifier and its corresponding authorization token sent by the third server through the second server, and forwards it to the browser client through the proxy server, so that the browser client carries it in the resource acquisition request and sends it to the first server through the proxy server, and obtains business resources through the first server.

[0108] Wherein, after the first server sends the account identifier and the authorization token to the third server in the verification request, when the verification result returned by the third server is passed, the first server determines the account of the second client corresponding to the account identifier in the specified application login, and sends the business resources corresponding to the login status of the specified application to the browser client.

[0109] This manual provides a passwordless login method applied to a second server, the method comprising:

[0110] The system receives an authorization request from a second client carrying the user's account identifier on the second client and forwards it to a third server. The authorization request is a passwordless login request carrying the account identifier forwarded by the second client through a proxy server based on the browser client. The system displays an authorization interface and responds to the user's authorization operation, and is generated based on the account identifier.

[0111] Receive the account identifier and its corresponding authorization token sent by the third server, wherein the authorization token is determined by the third server based on the authorization request;

[0112] The account identifier and its corresponding authorization token are sent to the browser client through the second client and the proxy server, so that the browser client carries the resource acquisition request and sends it to the first server through the proxy server, and obtains business resources through the first server.

[0113] Specifically, the passwordless login request is determined by the proxy server after it determines that the specified application corresponding to the login page requested by the browser client does not support passwordless login, and the browser client responds to the user's operation on the login page of the second client returned by the proxy server; the first server, upon receiving a verification result from the third server that the authorization token is passed, determines the account of the second client corresponding to the account identifier in the specified application login, and sends the business resources corresponding to the login status of the specified application to the browser client.

[0114] This manual provides a passwordless login method applied to a third-party server, the method comprising:

[0115] Receive an authorization request sent by a second client through a second server, carrying the user's account identifier on the second client; the authorization request is generated by the second client based on a passwordless login request forwarded by a browser client through a proxy server, carrying the account identifier;

[0116] Determine the authorization token corresponding to the account identifier, and the correspondence between the account identifier and the authorization token;

[0117] The account identifier and the determined authorization token are sent to the browser client through the second server, the second client, and the proxy server, causing the browser client to generate a resource acquisition request and send it to the first server through the proxy server.

[0118] Receive a verification request sent by the first server in accordance with the resource acquisition request, carrying the account identifier and the authorization token;

[0119] Verification is performed based on the stored correspondence and the verification request, and the verification result is returned to the first server. When the verification result is passed, the first server determines the account of the second client corresponding to the account identifier in the specified application login and sends the business resources corresponding to the login status of the specified application to the browser client.

[0120] The passwordless login request is determined by the browser client in response to the user's operation on the login page of the second client returned by the proxy server after the proxy server determines that the specified application corresponding to the login page requested by the browser client does not support passwordless login.

[0121] This specification provides a passwordless login device for use in a terminal, the device comprising:

[0122] The response module is used to respond to the received user input passwordless login request and determine whether an authorization token corresponding to the account identifier is stored.

[0123] The first sending module is used to display a verification information input interface if the verification information is not present, and in response to the verification information input by the user, send the verification information and the account identifier in a passwordless login request to the server. When the server receives the passwordless login request carrying the verification information and the account identifier, it determines the account corresponding to the account identifier based on the account identifier, and determines the authentication information set when the account is registered. When it is determined that the authentication information matches the verification information, it determines that the terminal is logging into the account corresponding to the account identifier, and generates an authorization token and returns it to the terminal.

[0124] A receiving module is used to receive and store the authorization token returned by the server.

[0125] The second sending module is used to send a passwordless login request carrying the account identifier and the authorization token to the server if such a request exists, so that when the server receives the passwordless login request carrying the account identifier and the authorization token, it determines that the terminal is logging into the account corresponding to the account identifier.

[0126] This specification provides a passwordless login device for use on a server, the device comprising:

[0127] The determination module is used to, when receiving a passwordless login request carrying verification information and an account identifier sent by a terminal, determine the account corresponding to the account identifier based on the account identifier, and determine the authentication information set during the registration of the account; wherein, the verification information is entered by the user in the input interface of the terminal; the input interface is displayed by the terminal in response to the received passwordless login request entered by the user and when it determines that no authorization token corresponding to the account identifier is stored;

[0128] The authorization module is used to determine the account corresponding to the account identifier when the authentication information matches the verification information, and to generate an authorization token and return it to the terminal.

[0129] The login module is used to determine that the terminal is logging into the account corresponding to the account identifier when it receives a passwordless login request carrying the account identifier and the authorization token. The passwordless login request carrying the authorization token is sent by the terminal in response to the passwordless login request input by the user and after determining that it has stored the authorization token corresponding to the account identifier.

[0130] This specification provides a passwordless login device for use with a first client, the device comprising:

[0131] The first sending module is used to send a passwordless login request to the second client, so that the second client displays an authorization interface and responds to the user's authorization operation according to the passwordless login request. Based on the account identifier of the user logged in on the second client, the module generates an authorization request and sends it to the second server, so that the second server receives the authorization request sent by the second client carrying the account identifier, determines the authorization token corresponding to the account identifier, and stores the correspondence between the account identifier and the authorization token.

[0132] A receiving module is used to receive the account identifier and the authorization token sent by the second server;

[0133] The second sending module is used to forward the account identifier and the authorization token to the first server, so that the first server sends the account identifier and the authorization token in a verification request to the second server, so that the second server receives the verification request sent by the first server carrying the account identifier and the authorization token, performs verification according to the stored correspondence and the verification request, and returns the verification result of the authorization token to the first server, so that when the first server receives the verification result as passed, it determines that the account corresponding to the account identifier is logged in on the first client.

[0134] This specification provides a passwordless login device for use with a second client, the device comprising:

[0135] The receiving module is used to receive the passwordless login request sent by the first client and display the authorization interface according to the passwordless login request;

[0136] The response module is used to respond to the user's authorization operation and generate an authorization request based on the account identifier of the user logged in on the second client;

[0137] The sending module is configured to send the authorization request to the second server, causing the second server to determine the authorization token corresponding to the account identifier based on the authorization request, store the correspondence between the account identifier and the authorization token, and send the authorization token and the account identifier to the first client, causing the first client to forward the authorization token and the account identifier to the first server, causing the first server to send the account identifier and the authorization token in a verification request to the second server, causing the second server to perform verification based on the verification request and the stored correspondence, and return the verification result of the authorization token to the first server, causing the first server to determine that the account corresponding to the account identifier is logged in on the first client when the received verification result is successful.

[0138] This specification provides a passwordless login device for use on a first server, the device comprising:

[0139] The receiving module is used to receive an account identifier and an authorization token sent by a first client. The account identifier and the authorization token are obtained by the first client through a second client and a second server. The authorization token is generated by the second server based on the generation of an authorization request. The generation of the authorization request is determined by the second client in response to the user's operation on the authorization interface. The authorization interface is displayed by the second client based on the passwordless login request sent by the first client.

[0140] The request module is used to send the account identifier and the authorization token in a verification request to the second server, so that the second server performs verification according to the stored correspondence between the account identifier and the authorization token and the verification request, and returns the verification result of the authorization token to the first server.

[0141] The login module is used to determine that the account corresponding to the account identifier has logged in on the first client when the verification result sent by the second server is passed.

[0142] This specification provides a passwordless login device for use on a second server, the device comprising:

[0143] The receiving module is used to receive an authorization request carrying an account identifier sent by a second client. The authorization request is generated by the second client in response to the user's authorization operation on the authorization interface, based on the account identifier logged in by the user on the second client. The authorization interface is determined by the second client based on the passwordless login request sent by the first client.

[0144] The authorization module is used to determine the authorization token corresponding to the account identifier, store the correspondence between the account identifier and the authorization token, and send the authorization token and the account identifier to the first client, so that the first client forwards the authorization token and the account identifier to the first server;

[0145] The verification module is used to receive a verification request sent by the first server, which carries the account identifier and the authorization token, perform verification according to the stored correspondence and the verification request, and return the verification result of the authorization token to the first server, so that when the first server receives the verification result as passed, it determines that the account corresponding to the account identifier has logged in on the first client.

[0146] This specification provides a passwordless login device for use with a first client, the device comprising:

[0147] The first receiving module is used to receive the account identifier and authorization token sent by the third client;

[0148] The response module is used to respond to the login request input by the user, forward the account identifier and the authorization token to the first server corresponding to the first client, so that the first server sends the account identifier and the authorization token to the third server in the first verification request;

[0149] The second receiving module is used to receive service resources sent by the first server when the first verification result returned by the third server to the first server is passed; wherein: the authorization token corresponding to the account identifier is generated by the second server based on the authorization operation of the user on the authorization interface of the second client and sent to the third client, and the authorization interface is generated by the second client based on the third server and the passwordless login request of the third client forwarded by the second server.

[0150] This specification provides a passwordless login device for use on a first server, the device comprising:

[0151] The receiving module is used to receive the account identifier and authorization token sent by the first client corresponding to itself, wherein the account identifier and authorization token are sent from the third client to the first client;

[0152] The sending module is used to send the account identifier and the authorization token to the third server in the first verification request;

[0153] The login module is used to receive the first verification result of the authorization token sent by the third server, and when the first verification result is successful, to determine that the account corresponding to the account identifier is logged in on the corresponding first client, and to send the business resources of the account corresponding to the account identifier to the corresponding first client, wherein the first client is in a logged-in state; wherein, the authorization token corresponding to the account identifier is generated by the second server according to the authorization request and sent to the third client, the authorization request is generated by the second client according to the user's authorization operation on the authorization interface, and the authorization interface is generated by the second client based on the third server and the passwordless login request of the third client forwarded by the second server.

[0154] This specification provides a passwordless login device for use with a second client, the device comprising:

[0155] The receiving module is used to receive passwordless login requests carrying account identifiers sent by the second server;

[0156] The display module is used to show the authorization interface;

[0157] The response module is used to respond to the user's authorization operation, generate an authorization request based on the account identifier and send it to the second server, so that the second server generates an authorization token corresponding to the account identifier, and sends the account identifier and the authorization token to the first client through the third server and the third client. The first client performs passwordless login through the first server based on the authorization token corresponding to the account identifier; wherein, the passwordless login request is sent from the third client to the second client through the third server and the second server.

[0158] This specification provides a passwordless login device for use on a second server, the device comprising:

[0159] The receiving module is used to receive passwordless login requests carrying account identifiers sent by a third server;

[0160] The first sending module is used to forward the passwordless login request to the second client;

[0161] The authorization module is used to receive an authorization request carrying the account identifier sent by the second client and generate an authorization token corresponding to the account identifier;

[0162] The second sending module is used to send the authorization token and the account identifier to the third server, so that the third server stores the correspondence between the account identifier and the authorization token, and when receiving the first verification request sent by the first server, it verifies the authorization token and the account identifier according to the stored information, and returns the first verification result of the authorization token to the first server; wherein, the first server determines whether the first client can log in without a password based on the first verification result.

[0163] This specification provides a passwordless login device for use with a third-party client. The device includes:

[0164] The first sending module is used to send a passwordless login request to the third server, so that the third server carries the account identifier of the user corresponding to the third client in the passwordless login request and sends it to the second client through the second server, so that the second client responds to the user's authorization operation and generates an authorization request;

[0165] The receiving module is used to receive the account identifier and authorization token sent by the third server, wherein the authorization token is generated by the second server according to the authorization request sent by the second client and sent to the third server;

[0166] The second sending module is used to send the account identifier and the authorization token to the first client, so that the first client, in response to the login request input by the user, forwards the account identifier and the authorization token to the first server; wherein, the first server determines whether the first client can log in without a password based on the first verification result of the authorization token sent by the third server.

[0167] This specification provides a passwordless login device for use on a third-party server, the device comprising:

[0168] The first receiving module is used to receive passwordless login requests sent by a third client;

[0169] The sending module is used to determine the account identifier of the user corresponding to the third client on the second client, and carry the account identifier in the passwordless login request, and forward it to the second client through the second server, so that the second client responds to the user's authorization operation, generates an authorization request and sends it to the second server;

[0170] The second receiving module is used to receive the account identifier and authorization token sent by the second server, store the correspondence between the account identifier and the authorization token, and forward it to the first client through the third client, so that the first client sends it to the first server. The authorization token is generated by the second server according to the authorization request.

[0171] The verification module is used to receive a first verification request sent by the first server, which carries the account identifier and the authorization token, perform verification based on the stored account identifier, the authorization token and the first verification request, and return a first verification result of the authorization token to the first server; wherein, the first server determines whether the first client can log in without a password based on the first verification result of the authorization token.

[0172] This specification provides a passwordless login device for use in browser clients, the device comprising:

[0173] The first request module is used to send a request to the first server to obtain the login page of the specified application.

[0174] The first receiving module is used to receive the login page corresponding to the second client sent by the proxy server. The login page is sent by the proxy server after obtaining the login page retrieval request and determining that the specified application does not support passwordless login.

[0175] The response module is used to respond to the user's operation on the login page. It sends a passwordless login request carrying the user's account identifier on the second client to the second client through the proxy server, so that the second client displays the authorization interface and responds to the user's authorization operation. It generates an authorization request based on the account identifier and forwards it to the third server through the second server. The third server determines the authorization token corresponding to the account identifier and sends it to the second client through the second server.

[0176] The second request module is used to generate a resource acquisition request based on the account identifier and its corresponding authorization token sent by the second client through the proxy server and send it to the first server through the proxy server.

[0177] The second receiving module is used to receive the service resources in the login state corresponding to the specified application sent by the first server. The service resources are sent by the first server after determining that the account of the second client corresponding to the account identifier of the specified application is logged in when the verification result of the authorization token sent by the third server is passed.

[0178] This specification provides a passwordless login device for use with a proxy server, the device comprising:

[0179] The acquisition module is used to acquire the login page acquisition request of the specified application sent by the browser client to the first server;

[0180] The first sending module is used to send the login page corresponding to the second client to the browser client when it is determined that the specified application does not support passwordless login;

[0181] The first forwarding module is used to receive the passwordless login request sent by the browser client in response to the user's operation on the login page, which carries the user's account identifier on the second client, and forward it to the second client, so that the second client displays the authorization interface and responds to the user's authorization operation, generates an authorization request according to the account identifier, and forwards it to the third server through the second server;

[0182] The second forwarding module is used to receive the account identifier and its corresponding authorization token sent by the second client, and forward it to the browser client. The authorization token is determined by the third server according to the authorization request and sent to the second client by the second server.

[0183] The third forwarding module is used to receive a resource acquisition request sent by the browser client carrying the account identifier and the authorization token, and forward it to the first server; wherein, when the first server receives a verification result of the authorization token sent by the third server and finds that it has passed, it determines the account of the second client corresponding to the account identifier in the specified application login, and sends the business resources corresponding to the login status of the specified application to the browser client.

[0184] This specification provides a passwordless login device for use on a first server, the device comprising:

[0185] The first receiving module is used to receive the account identifier and authorization token carried in the resource acquisition request sent by the browser client through the proxy server. The authorization token is determined by the third server based on the authorization request carrying the account identifier forwarded by the second client through the second server.

[0186] The sending module is used to send the account identifier and the authorization token in the verification request to a third server;

[0187] The second receiving module is used to receive the verification result returned by the third server according to the verification request, and when the verification result is passed, determine to log in the account of the second client corresponding to the account identifier on the login page of the specified application;

[0188] The login module is used to send business resources corresponding to the login status of the specified application to the browser client; wherein, the authorization request is generated by the second client based on the account identifier, which is forwarded by the browser client through the proxy server and carries the account identifier, and displays the authorization interface and responds to the user's authorization operation; the passwordless login request is determined by the browser client in response to the user's operation on the login page of the second client returned by the proxy server when the proxy server determines that the specified application corresponding to the login page requested by the browser client does not support passwordless login.

[0189] This specification provides a passwordless login device for use with a second client, the device comprising:

[0190] The first receiving module is used to receive a passwordless login request sent by a browser client through a proxy server, which carries the user's account identifier on the second client. The passwordless login request is determined by the browser client sending a request to the proxy server to obtain the login page of the specified application, and after receiving the login page corresponding to the second client returned by the proxy server, in response to the user's operation on the login page.

[0191] The display module is used to display the authorization interface and respond to the user's authorization operation. It generates an authorization request based on the account identifier and sends it to the third server through the second server, so that the third server can determine the authorization token corresponding to the account identifier.

[0192] The second receiving module is used to receive the account identifier and its corresponding authorization token sent by the third server through the second server, and forward it to the browser client through the proxy server, so that the browser client carries it in the resource acquisition request and sends it to the first server through the proxy server, and acquires business resources through the first server; wherein, after the first server sends the account identifier and the authorization token in the verification request to the third server, if the verification result returned by the third server is passed, the first server determines the account of the second client corresponding to the account identifier in the specified application login, and sends the business resources corresponding to the login status of the specified application to the browser client.

[0193] This specification provides a passwordless login device for use on a second server, the device comprising:

[0194] The first receiving module is used to receive an authorization request sent by the second client carrying the user's account identifier on the second client, and forward it to the third server. The authorization request is a passwordless login request carrying the account identifier forwarded by the second client through the proxy server based on the browser client. The module displays an authorization interface and responds to the user's authorization operation, and is generated based on the account identifier.

[0195] The second receiving module is used to receive the account identifier and its corresponding authorization token sent by the third server, wherein the authorization token is determined by the third server based on the authorization request;

[0196] The sending module is used to send the account identifier and its corresponding authorization token to the browser client through the second client and the proxy server, so that the browser client carries it in a resource acquisition request and sends it to the first server through the proxy server, and acquires business resources through the first server; wherein, the passwordless login request is determined by the browser client in response to the user's operation on the login page of the second client returned by the proxy server after the proxy server determines that the specified application corresponding to the login page requested by the browser client does not support passwordless login; the first server, when receiving the verification result of the authorization token sent by the third server as passed, determines the account of the second client corresponding to the account identifier in the specified application login, and sends the business resources in the login state corresponding to the specified application to the browser client.

[0197] This specification provides a passwordless login device for use on a third-party server, the device comprising:

[0198] The first receiving module is used to receive an authorization request sent by the second client through the second server, carrying the user's account identifier on the second client; the authorization request is generated by the second client based on a passwordless login request forwarded by the browser client through a proxy server, carrying the account identifier;

[0199] The authorization module is used to determine the authorization token corresponding to the account identifier, and the correspondence between the account identifier and the authorization token;

[0200] The sending module is used to send the account identifier and the determined authorization token to the browser client through the second server, the second client and the proxy server, so that the browser client generates a resource acquisition request and sends it to the first server through the proxy server;

[0201] The second receiving module is used to receive a verification request sent by the first server in accordance with the resource acquisition request, carrying the account identifier and the authorization token;

[0202] The verification module is used to perform verification based on the stored correspondence and the verification request, and return the verification result to the first server. When the verification result is successful, the first server determines the account of the second client corresponding to the account identifier in the specified application login, and sends the business resources corresponding to the login status of the specified application to the browser client. The passwordless login request is determined by the browser client in response to the user's operation on the login page of the second client returned by the proxy server after the proxy server determines that the specified application corresponding to the login page requested by the browser client does not support passwordless login.

[0203] This specification provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described passwordless login method.

[0204] This specification provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the above-described passwordless login method.

[0205] The above-mentioned technical solutions adopted in this specification can achieve the following beneficial effects:

[0206] The passwordless login system provided in this manual includes a terminal and a server. The terminal responds to a user's passwordless login request by determining whether an authorization token corresponding to the account identifier exists. If so, it sends a passwordless login request carrying the account identifier and authorization token to the server in the system. Otherwise, it displays a verification information input interface, responds to the user's input verification information, and sends the verification information and account identifier along with the verification information to the server. The server, upon determining that the authentication information set during account registration matches the verification information, confirms that the terminal is logged into the account and generates an authorization token, returning it to the terminal. The terminal can then receive and store the authorization token corresponding to the account identifier. When the server receives a passwordless login request carrying the account identifier and authorization token, it can confirm that the terminal is logged into the account.

[0207] As can be seen from the above, this manual enables the terminal to request login access to the user's account from the server based on an authorization token, rather than an account password. Since the authorization token does not require user input but is sent to the server by the terminal storing the token, the login process is more convenient, avoiding password leaks and authorization token leaks, thus enhancing security. Attached Figure Description

[0208] The accompanying drawings, which are included to provide a further understanding of this specification and form part of this specification, illustrate exemplary embodiments and their descriptions, serving to explain this specification and do not constitute an undue limitation thereof.

[0209] In the picture:

[0210] Figure 1 This is a schematic diagram of a passwordless login system provided in this specification;

[0211] Figure 2-3 The corresponding information provided in this specification Figure 1 A diagram illustrating the passwordless login method;

[0212] Figure 4-5 The corresponding information provided in this specification Figure 1 A schematic diagram of a passwordless login device;

[0213] Figure 6 This is a schematic diagram of a passwordless login system provided in this specification;

[0214] Figure 7-10 The corresponding information provided in this specification Figure 6 A diagram illustrating the passwordless login method;

[0215] Figure 11-14 The corresponding information provided in this specification Figure 6 A schematic diagram of a passwordless login device;

[0216] Figure 15 This is a schematic diagram of a passwordless login system provided in this specification;

[0217] Figure 16 This is a schematic diagram of a passwordless login system provided in this specification;

[0218] Figure 17-22 The corresponding information provided in this specification Figure 15 A diagram illustrating the passwordless login method;

[0219] Figure 23-28 The corresponding information provided in this specification Figure 15 A schematic diagram of a passwordless login device;

[0220] Figure 29 This is a schematic diagram of a passwordless login system provided in this specification;

[0221] Figures 30-35 The corresponding information provided in this specification Figure 29 A diagram illustrating the passwordless login method;

[0222] Figure 36-41 The corresponding information provided in this specification Figure 29 A schematic diagram of a passwordless login device;

[0223] Figure 42 This is a schematic diagram of an electronic device provided in this specification. Detailed Implementation

[0224] To make the objectives, technical solutions, and advantages of this specification clearer, the technical solutions of this specification will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this specification, and not all of them. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this specification.

[0225] The technical solutions provided in the various embodiments of this specification are described in detail below with reference to the accompanying drawings.

[0226] Figure 1 This is a schematic diagram of a passwordless login system described in this specification. Figure 1 This passwordless login system includes a terminal and a server. The terminal is the one with the client software installed for the user to log in. The server is the business server corresponding to that client software.

[0227] based on Figure 1 The corresponding passwordless login system includes at least two login entry points: a password login entry and a passwordless login entry. When logging in without a password, the user can access the passwordless login entry, and the terminal will respond by sending a passwordless login request to the server. This login request carries at least the user's account identifier on the client and an authorization token. The server can then determine whether the account corresponding to the identifier is eligible for passwordless login based on the account identifier and the authorization token.

[0228] The authorization token is pre-generated by the server and sent to the terminal. For example, after registering an account, when logging into the client for the first time, the user can enter a password through the password login portal. The terminal can then send a login request carrying the password and account identifier to the server. Upon successful password verification, the server can send an authorization token to the terminal. The terminal can store this authorization token. Subsequently, the user can use the terminal to access the client's passwordless login portal. In response, the terminal can send a passwordless login request carrying the authorization token to the server.

[0229] Since the user's authorization token is stored locally on the terminal, in addition to the user needing to access the password login portal and enter a password when logging into the client for the first time after registering an account, the user also needs to access the password login portal and enter a password when switching to another device, such as logging into the same account through another terminal, in order to obtain the authorization token corresponding to the other terminal and the account identifier from the server.

[0230] Based on this Figure 1 The interaction process between the terminal and the server, as shown, may include the following steps:

[0231] S100: In response to the passwordless login request, the terminal determines whether there is an authorization token corresponding to the account identifier. If so, step S102 is executed; otherwise, step S106 is executed.

[0232] In this manual, users can initiate a passwordless login request by accessing the passwordless login portal. The terminal can then receive the passwordless login request entered by the user. Since the user is requesting passwordless login, the passwordless login request can carry an authorization token corresponding to the account identifier requested by the user.

[0233] The account identifier refers to the account identifier of the user's registered account on the client. For example, the account identifier could be the user's User Identification (UID) on the client.

[0234] Since the terminal can request passwordless login to the client based on the authorization token corresponding to the account identifier after obtaining and storing the authorization token from the server in advance, it cannot achieve passwordless login if the terminal does not have the authorization token corresponding to the account identifier.

[0235] Therefore, when a user initiates a passwordless login request by accessing the passwordless login portal, the terminal can determine whether it has an authorization token corresponding to the account identifier for which the user is requesting passwordless login.

[0236] That is, the terminal can respond to the received passwordless login request input by the user and determine whether the authorization token corresponding to the account identifier is stored. If so, step S102 is executed; otherwise, step S106 is executed.

[0237] Of course, even if the terminal has previously obtained an authorization token from the server, there may be a situation where the terminal does not currently store the authorization token corresponding to the account identifier. For example, if the user clears the terminal's data, causing the authorization token to be deleted, or if the authorization token previously obtained by the terminal becomes invalid and needs to be obtained again, then the terminal does not store the authorization token corresponding to the account identifier.

[0238] In other words, an expired authorization token may not be used as the authorization token corresponding to that account identifier. Of course, the terminal may also be unsure whether the stored authorization token is expired, and the server may determine whether the received authorization token corresponding to the account identifier is valid.

[0239] S102: The terminal sends a passwordless login request carrying the account identifier and the authorization token.

[0240] When the terminal stores the authorization token corresponding to the account identifier, the terminal can send a passwordless login request carrying the account identifier and the authorization token to the server.

[0241] S104: When the server receives a passwordless login request carrying the account identifier and the authorization token, it determines that the terminal is logging into the account corresponding to the account identifier.

[0242] When the server receives a passwordless login request carrying the account identifier and the authorization token, it can determine that the terminal is logging into the account corresponding to the account identifier.

[0243] S106: The terminal displays a verification information input interface.

[0244] When the terminal does not have an authorization token corresponding to the account identifier, it can display a verification information input interface. The user can then enter verification information on the verification interface. The verification information serves as the basis for the terminal to determine whether to generate an authorization token corresponding to the account identifier.

[0245] Alternatively, the terminal can also display an account and password input interface, where the user can enter a password as a basis for the server to determine whether to generate an authorization token corresponding to the account identifier.

[0246] S108: The terminal, in response to the verification information input by the user, sends a passwordless login request to the server, carrying the verification information and the account identifier.

[0247] After the user enters the verification information, the terminal can respond to the user's input verification information by sending the verification information and the account identifier to the server in the passwordless login request.

[0248] Of course, as mentioned above, the user can also enter a password, and the terminal can also send the user's input verification information, password, and account identifier to the server in the passwordless login request.

[0249] S110: When the server receives a passwordless login request carrying the verification information and the account identifier, it determines the account corresponding to the account identifier and determines the authentication information set when the account was registered.

[0250] The server is used to receive passwordless login requests sent by the terminal, which carry the verification information and the account identifier.

[0251] When the server receives a passwordless login request carrying the verification information and the account identifier, it can determine the account corresponding to the account identifier and determine the authentication information set when the account was registered.

[0252] In one or more embodiments of this specification, the authentication information may include at least the standard answer to a specified question set by the user, and the verification information may include at least the answer to the specified question entered by the user.

[0253] Of course, since the passwordless login request can also include the password entered by the user, the terminal can also determine the correct password corresponding to the stored account identifier when it receives a passwordless login request carrying the password corresponding to the account identifier.

[0254] In addition, the passwordless login request may also carry other information, such as the dynamic verification code corresponding to the account identifier, etc., which are not restricted in this manual.

[0255] S112: When the server determines that the authentication information matches the verification information, it determines the account corresponding to the account identifier that the terminal is logged into, and generates an authorization token.

[0256] In one or more embodiments of this specification, the server may determine that the authentication information matches the verification information when it is determined that the standard answer contained in the authentication information is consistent with the answer contained in the verification information. Alternatively, it may determine that the authentication information matches the verification information when it is determined that the correct password corresponding to the pre-stored account identifier is consistent with the password carried in the passwordless login request. Furthermore, it may determine that the authentication information matches the verification information when it is determined that the standard answer contained in the authentication information is consistent with the answer contained in the verification information, and the correct password corresponding to the pre-stored account identifier is consistent with the password carried in the passwordless login request.

[0257] The authentication and verification information, along with the correct password and the password entered by the user, serve as strong verification information to confirm whether the terminal requesting login is legitimate. This information is also the basis for the server to determine whether to generate an authorization token, and for authorizing passwordless login requests initiated by the terminal. In this way, users can obtain an authorization token from the server through their terminal based on the verification information and / or password, enabling subsequent passwordless login without repeatedly entering their account and password. This reduces the probability of account and password leakage and improves security.

[0258] S114: The server sends the authorization token to the terminal.

[0259] After confirming that the authentication information matches the verification information and that the terminal is logged into the account corresponding to the account identifier, the server can generate an authorization token and return it to the terminal.

[0260] Of course, the authorization token is the authorization token corresponding to the account identifier, and the server can specifically return the authorization token and the account identifier to the terminal.

[0261] S116: The terminal receives the authorization token and stores it.

[0262] After the server returns the authorization token corresponding to the generated account identifier to the terminal, the terminal can receive and store the authorization token returned by the server so that when the user needs to log in to the corresponding account without a password, it can request passwordless login from the server based on the authorization token.

[0263] In addition, to prevent unauthorized logins to the user's account and to facilitate the verification of passwordless login requests carrying authorization tokens, the server is also used to store the correspondence between the authorization token and the account identifier after generating the authorization token corresponding to the account identifier in step S112.

[0264] When a passwordless login request carrying the account identifier and its corresponding authorization token is received, the server can verify the authorization token according to the stored correspondence. If the verification is successful, the server can determine that the terminal that sent the passwordless login request is logged into the account corresponding to the account identifier, and send the business resources of the logged-in account to the terminal.

[0265] In one or more embodiments of this specification, the server may determine that the verification is successful when it determines that the authorization token corresponding to the received account identifier is consistent with the authorization token corresponding to the account identifier in the stored correspondence.

[0266] It should be noted that the authorization token can be permanent or time-limited. For example, once the terminal obtains the authorization token, it can store it and use it to log in to the account without a password for an extended period. Alternatively, the authorization token can be valid for one month. After the authorization token has been generated for more than one month, the server can deactivate the account's login status on the terminal. When the user initiates a passwordless login request again, the terminal can re-display the verification information input interface, determine the verification information based on the user's input, and send the verification information and account identifier along with the passwordless login request to the server. The server can then regenerate the corresponding authorization token for the terminal.

[0267] Therefore, the server can also determine that the verification is successful when it finds that the authorization token corresponding to the received account identifier is consistent with the authorization token corresponding to the account identifier in the stored correspondence, and the authorization token is within the validity period.

[0268] This specification does not restrict the specific form of the authorization token. For example, the authorization token can be a session identity document (session ID). For instance, the server can determine a unique 32-bit random number as a session ID.

[0269] It can be seen that, based on Figure 1 In the system shown, the terminal responds to a user's passwordless login request by determining whether an authorization token corresponding to the account identifier exists. If so, it sends a passwordless login request carrying the account identifier and authorization token to the server in the system. Otherwise, it displays a verification information input interface, responds to the user's input verification information, and sends the verification information and account identifier along with the verification information to the server. The server, upon determining that the authentication information set during account registration matches the verification information, confirms that the terminal is logged into that account and generates an authorization token, returning it to the terminal. The terminal can then receive and store the authorization token corresponding to the account identifier. When the server receives a passwordless login request carrying the account identifier and authorization token, it can confirm that the terminal is logged into that account.

[0270] It can be seen that, based on Figure 1 The system shown allows a terminal to request login to a user's account from the server based on an authorization token, rather than an account password. Since the authorization token is sent to the server by the terminal storing it, the login process is more convenient. Furthermore, it reduces user reliance on passwords, minimizing the inconvenience of remembering complex passwords, and eliminates the risk of password or authorization token leakage, thus enhancing security.

[0271] Additionally, in one or more embodiments of this specification, the terminal can also be used to respond to user-inputted verification information by sending the verification information, the account identifier, and the terminal's basic information in a passwordless login request to the server. Alternatively, when an authorization token corresponding to the account identifier is stored, a passwordless login request carrying the authorization token, the account identifier, and the basic information can be sent to the server.

[0272] This basic information may include at least one of the following: the Internet Protocol (IP) address corresponding to the terminal, the serial number, etc.

[0273] The server is also used to receive passwordless login requests carrying the verification information, the account identifier, and the basic information, and after generating the authorization token corresponding to the account identifier, store the correspondence between the authorization token, the account identifier, and the basic information.

[0274] The server can also receive passwordless login requests that carry the account identifier, the authorization token, and the basic information.

[0275] When a passwordless login request carrying the authorization token, the account identifier, and the basic information is received, the server can verify the received authorization token, the account identifier, and the basic information according to the stored correspondence, and determine the account corresponding to the account identifier when the verification is successful.

[0276] The server determines that the verification is successful when it confirms that the correspondence between the authorization token, account identifier, and basic information carried in the received passwordless login request matches the pre-stored correspondence. Specifically, the server further determines that the verification is successful when it confirms that the correspondence between the authorization token, account identifier, and basic information carried in the received login request matches the pre-stored correspondence between the authorization token and basic information corresponding to the account identifier. For terminals whose verification is successful, the server records the terminal corresponding to the basic information as a trusted device.

[0277] Of course, the verification can also be confirmed if the correspondence between the received authorization token, the account identifier, and the basic information matches the stored correspondence, and the authorization token is within its validity period.

[0278] Based on this correspondence, the authorization token, the account identifier, and the basic information are verified to identify scenarios of login from different locations or different devices. In these scenarios, in order to prevent others from impersonating and logging into the account corresponding to the account identifier, the server verifies the authorization token, the account identifier, and the basic information, which makes the verification results more reliable and secure.

[0279] Of course, it's also possible that the user, as the account holder, switches devices or logs into the account from a different location. In this case, the user can enter verification information again through the verification information input interface displayed on the terminal. The terminal can then send this verification information and account identifier to the server again in the passwordless login request to obtain the authorization token from the server once more.

[0280] When the client in the terminal integrates multiple business systems, and some of these systems require login, the terminal can still log in to the client's business systems based on the obtained authorization token. For example, a user can click on the entry point for a specific business within the client, and the terminal can respond by sending a passwordless login request to the server, carrying the authorization token and the business identifier of the specified business. After the authorization token is verified, the server can then send the corresponding business resources to the terminal.

[0281] This avoids users having to enter their account and password for a specific service to log in.

[0282] For example, assuming one of the business systems integrated into the client is a Virtual Private Network (VPN), when the user clicks on the VPN entry point, the terminal can respond to the user's operation on the VPN entry point by sending a passwordless login request carrying the authorization token to the server.

[0283] This instruction manual also provides Figure 1 The system's corresponding login-free method, such as Figure 2 As shown.

[0284] Figure 2 This is a schematic diagram illustrating a passwordless login method provided in this manual. Figure 2 The passwordless login method shown is applied to a terminal, and the method includes the following steps:

[0285] S800: In response to the received user input passwordless login request, determine whether an authorization token corresponding to the account identifier is stored. If not, execute steps S802 to S804. If it is stored, execute step S806.

[0286] When a user enters a passwordless login request on the terminal, the terminal requests authorization from the server based on an authorization token to obtain business resources. Therefore, after the user enters a passwordless login request on the terminal, the terminal can respond to the received passwordless login request by determining whether it has an authorization token corresponding to the account identifier stored.

[0287] S802: Display the verification information input interface. In response to the verification information input by the user, send the verification information and the account identifier in a passwordless login request to the server. When the server receives the passwordless login request carrying the verification information and the account identifier, it determines the account corresponding to the account identifier based on the account identifier and determines the authentication information set during account registration. When it is determined that the authentication information matches the verification information, it determines that the terminal is logging into the account corresponding to the account identifier and generates an authorization token and returns it to the terminal.

[0288] When the terminal does not have the authorization token corresponding to the account identifier, the terminal can display a verification information input interface, and in response to the verification information input by the user, send the verification information and the account identifier to the server in the passwordless login request.

[0289] In one or more embodiments of this specification, specifically, the terminal can determine verification information in response to the answer to a pre-set question corresponding to the account identifier entered by the user on the verification information input interface.

[0290] Subsequently, the terminal can respond to the user's input verification information by sending the verification information and the account identifier to the server in the passwordless login request.

[0291] S804: Receive the authorization token returned by the server and store it.

[0292] After the server returns the authorization token corresponding to the account identifier, the terminal can store the authorization token. Then, the terminal can send a passwordless login request to the server, carrying the account identifier and the authorization token.

[0293] S806: The terminal sends the account identifier and the authorization token to the server, so that when the server receives a passwordless login request carrying the account identifier and the authorization token, it determines that the terminal is logging into the account corresponding to the account identifier.

[0294] When the terminal has an authorization token corresponding to the account identifier, it can send a passwordless login request to the server, carrying the account identifier and the authorization token. The server can then determine whether the terminal is logged into the account corresponding to the account identifier based on the passwordless login request and return the service resources in the logged-in status to the terminal.

[0295] Figure 2 For details of steps S800 to S806, please refer to the above. Figure 1 The relevant content will not be elaborated upon here.

[0296] This instruction manual also provides Figure 1 Another login-free method corresponding to the system, such as Figure 3 As shown.

[0297] Figure 3 This is a schematic diagram illustrating a passwordless login method provided in this manual. Figure 3 The passwordless login method shown is applied to the server, and the method includes the following steps:

[0298] S900: When a passwordless login request carrying verification information and an account identifier is received from a terminal, the account corresponding to the account identifier is determined based on the account identifier, and the authentication information set during account registration is determined; wherein, the verification information is entered by the user in the input interface of the terminal; the input interface is displayed by the terminal in response to the received passwordless login request entered by the user and when it is determined that no authorization token corresponding to the account identifier is stored.

[0299] When the server receives a passwordless login request from the terminal, it can determine the account corresponding to the account identifier and the authentication information set when the account was registered.

[0300] In one or more embodiments of this specification, the verification information may be the answer to a specified question entered by the user.

[0301] In one or more embodiments of this specification, when determining the authentication information set during account registration, specifically, the server may determine the standard answer to the specified question set during account registration as the authentication information.

[0302] S902: When it is determined that the authentication information matches the verification information, the terminal is logged into the account corresponding to the account identifier, and an authorization token is generated and returned to the terminal.

[0303] In one or more embodiments of this specification, when the server determines that the authentication information and the verification information are consistent, it determines that the authentication information and the verification information match, and determines that the terminal is logging into the account corresponding to the account identifier, and generates an authorization token and returns it to the terminal, so that the terminal stores the authorization token corresponding to the account identifier, so that it can request the login user's account from the server based on the authorization token.

[0304] In one or more embodiments of this specification, when generating an authorization token and returning it to the terminal, specifically, the server may generate an authorization token and store the correspondence between the authorization token and the account identifier. Then, the authorization token and the account identifier are returned to the terminal.

[0305] Alternatively, the server can generate an authorization token and store the correspondence between the authorization token, the account identifier, and the terminal's basic information. The server can then return the authorization token and the account identifier to the terminal. The basic information is carried in the passwordless login request sent by the terminal.

[0306] S904: When a passwordless login request carrying the account identifier and the authorization token is received, it is determined that the terminal is logging into the account corresponding to the account identifier. The passwordless login request carrying the authorization token is sent by the terminal in response to the received passwordless login request input by the user and when it determines that it has stored the authorization token corresponding to the account identifier.

[0307] In one or more embodiments of this specification, when a passwordless login request carrying the account identifier and the authorization token is received, and it is determined that the terminal is logging into the account corresponding to the account identifier, specifically, when the server receives the passwordless login request carrying the account identifier and the authorization token, it can verify the authorization token according to the stored correspondence.

[0308] Upon successful verification, the server can determine that the terminal is logged into the account corresponding to the account identifier and send the business resources under the login status of that account to the terminal.

[0309] Alternatively, when a passwordless login request carrying an account identifier, authorization token, and basic information is received, the server can verify the correspondence between the received authorization token, account identifier, and basic information according to the stored correspondence, and determine that the terminal is logging into the account corresponding to the account identifier when the verification is successful.

[0310] same, Figure 3 For details of steps S900 to S904, please refer to the above. Figure 1 The details of the above will not be repeated here.

[0311] This manual also provides a passwordless login device for use on terminals, such as... Figure 4 As shown. The device includes:

[0312] The response module 1000 is used to respond to the received user input passwordless login request and determine whether an authorization token corresponding to the account identifier is stored.

[0313] The first sending module 1001 is used to display a verification information input interface if the verification information is not present, and in response to the verification information input by the user, send the verification information and the account identifier in a passwordless login request to the server. When the server receives the passwordless login request carrying the verification information and the account identifier, it determines the account corresponding to the account identifier based on the account identifier, and determines the authentication information set when the account is registered. When it is determined that the authentication information matches the verification information, it determines that the terminal is logging into the account corresponding to the account identifier, and generates an authorization token and returns it to the terminal.

[0314] The receiving module 1002 is used to receive the authorization token returned by the server and store it;

[0315] The second sending module 1003 is used to send a passwordless login request carrying the account identifier and the authorization token to the server if such a request exists, so that when the server receives the passwordless login request carrying the account identifier and the authorization token, it determines that the terminal is logging into the account corresponding to the account identifier.

[0316] Optionally, the first sending module 1001 is further configured to determine verification information in response to the answer to the user-preset specified question corresponding to the account identifier entered by the user on the input interface, and send the verification information and the account identifier to the server in response to the verification information entered by the user.

[0317] This manual also provides a passwordless login device for use on servers, such as... Figure 5 As shown. The device includes:

[0318] The determination module 1100 is used to, when receiving a passwordless login request carrying verification information and an account identifier sent by a terminal, determine the account corresponding to the account identifier based on the account identifier, and determine the authentication information set during account registration; wherein, the verification information is entered by the user in the input interface of the terminal; the input interface is displayed by the terminal in response to the received passwordless login request entered by the user and when it determines that no authorization token corresponding to the account identifier is stored;

[0319] The authorization module 1101 is used to determine the account corresponding to the account identifier when it is determined that the authentication information matches the verification information, and to generate an authorization token and return it to the terminal.

[0320] The login module 1102 is used to determine that the terminal is logging into the account corresponding to the account identifier when it receives a passwordless login request carrying the account identifier and the authorization token. The passwordless login request carrying the authorization token is sent by the terminal in response to the passwordless login request input by the user and when it determines that it has stored the authorization token corresponding to the account identifier.

[0321] Optionally, the verification information is the answer to a specified question input by the user, and the determining module 1100 is further configured to determine the standard answer to the specified question set during account registration as authentication information.

[0322] Optionally, the authorization module 1101 is further configured to generate an authorization token, store the correspondence between the authorization token and the account identifier, return the authorization token and the account identifier to the terminal, and when a passwordless login request carrying the account identifier and the authorization token is received, determine that the terminal is logging into the account corresponding to the account identifier. Specifically, when a passwordless login request carrying the account identifier and the authorization token is received, verify the authorization token according to the stored correspondence, and when the verification is successful, determine that the terminal is logging into the account corresponding to the account identifier and send the service resources in the account login state to the terminal.

[0323] Optionally, the authorization module 1101 is further configured to generate an authorization token and store the correspondence between the authorization token, the account identifier, and the basic information of the terminal, wherein the basic information is carried in the passwordless login request sent by the terminal, and return the authorization token and the account identifier to the terminal. The login module 1102 is further configured to, when receiving a passwordless login request carrying the account identifier, authorization token, and basic information, verify the correspondence between the received authorization token, the account identifier, and the basic information according to the stored correspondence, and determine that the terminal is logging into the account corresponding to the account identifier when the verification is successful.

[0324] This specification also provides a computer-readable storage medium storing a computer program that can be used to execute the above-described... Figure 2 or Figure 3 The passwordless login method shown.

[0325] This instruction manual also provides Figure 6 The passwordless login system shown. Figure 6 The system includes a first client, a second client, a first server, and a second server. Based on this passwordless login system, users can log in to the first client using their account on the second client, thus achieving passwordless login on the first client.

[0326] The first client and the second client can be clients on the same terminal or clients on different terminals. Furthermore, the first client can be a client downloaded to the user's local terminal, or it can be a web client. When the first client is a web client, it can interact with the second client by calling the second client through the JSONP (JSON with padding) interface provided by the second client.

[0327] The first server can be the business server corresponding to the first client, and the second server can be the business server of the second client. The first client and the first server can correspond to the first platform, and the second client and the second server can correspond to the second platform. The first platform and the second platform can be two different platforms, or they can be two different sub-platforms under the same business platform.

[0328] exist Figure 6 In the corresponding passwordless login system, the first client is the client to be logged into. Users can log into this first client without a password, but rather with an authorization token that serves as the basis for trust.

[0329] The first client can request authorization from the second platform to obtain an authorization token corresponding to the user's account identifier on the second client. When the first client obtains the authorization token corresponding to the user's account identifier on the second client, the first client becomes a trusted client recognized by the second platform, and the first client is permitted by the second platform to act on the user's account identifier on the second client.

[0330] Log in to the first client using your account.

[0331] When the first client holds the authorization token corresponding to the account identifier of the second client, it can obtain business resources in the login state from the first server based on the authorization token. After the first server verifies that the authorization token is correct with the second platform, it can confirm the first platform and realize the login of the user's account on the second client from the first client.

[0332] Furthermore, once the first client possesses the authorization token, it can send a message carrying the account identifier and authorization order to the first server.

[0333] The system requests resources from the client to acquire business resources without requiring the user to enter a password. The authorization token is invisible and unknown to the user. When requesting passwordless login, the user does not need to enter the authorization token. The authorization token is sent to the first server by the first client, avoiding the risk of data leakage caused by user input. The user login operation is more convenient and more secure.

[0334] 5 Figure 6 The passwordless login system shown includes the first client, the second client, the first server, and the second server.

[0335] The interaction process is as follows:

[0336] S200: The first client sends a passwordless login request to the second client.

[0337] In one or more embodiments of this specification, a user can operate the passwordless login portal of the first client to initiate passwordless login.

[0338] In the case of passwordless login, the first client can respond to the user's operation on the passwordless login portal by sending a passwordless login request to the second client. This passwordless login request may include the account identifier of the second client.

[0339] In one or more embodiments of this specification, the first client supports account login of at least one second client.

[0340] When the first client supports login from multiple accounts of the second client, the first client can also respond.

[0341] Based on the user's actions regarding the passwordless login portal, the system identifies the second client selected by the user as the target client from among the various second clients, and determines the application identifier of the target client. Based on the target client's application identifier, the system then determines whether to send the passwordless login request.

[0342] Please specify which second client to send the message to.

[0343] The third client can send a passwordless login request to the third server in response to the user's operation on the passwordless login portal.

[0344] Furthermore, the passwordless login request may carry the application identifier of the first client.

[0345] 0S201: The second client displays the authorization interface.

[0346] S202: The second client, in response to the user's authorization operation, generates an authorization request based on the account identifier that the user logged in on the second client.

[0347] S203: The second client sends the authorization request to the second server.

[0348] After the first client sends a passwordless login request, the second client can receive the passwordless login request from the first client. To determine if the user corresponding to the second client is authorized to log in to the first client using the account logged in on the second client, the first client can display an authorization interface based on the received passwordless login request.

[0349] The authorization interface can display the application identifier of the first client, allowing users to clearly identify whether the first client requests to log in to the first client based on the account logged in on the second client, in order to decide whether to grant authorization.

[0350] After the authorization interface is displayed, users can perform authorization operations on the authorization interface when they are allowed to log in to the first client using their account on the second client.

[0351] The second client can then respond to the user's authorization action by generating an authorization request based on the account identifier logged in by the user on the second client and sending it to the second server.

[0352] That is, when the second client receives a passwordless login request from the first client, it displays an authorization interface and asks the user whether they agree to authorize. If the user agrees, they can perform the authorization operation through the authorization interface. The second client can then respond to the user's authorization operation by generating an authorization request based on the account identifier the user logged in on the second client and sending it to the second server to request an authorization token for logging into the first client.

[0353] S204: The second server determines the authorization token corresponding to the account identifier and stores the correspondence between the account identifier and the authorization token.

[0354] S205: The second server sends the authorization token and the account identifier to the first client.

[0355] In one or more embodiments of this specification, after the second client sends an authorization request to the second server, the second server can receive the authorization request carrying an account identifier sent by the second client, determine the authorization token corresponding to the account identifier, and store the correspondence between the account identifier and the authorization token so as to verify the received authorization token based on the correspondence in the future.

[0356] The second server can then send the authorization token and account identifier to the first client.

[0357] In one or more embodiments of this specification, after storing the correspondence, the second server can send the authorization token and account identifier to the first client. Alternatively, the second server can also return the authorization token and account identifier to the second client after storing the correspondence between the account identifier and the authorization token. The second client then sends the account identifier and its corresponding authorization token to the first client.

[0358] Then, the second client is also used to receive the account identifier and its corresponding authorization token returned by the second server, and forward it to the first client.

[0359] The second server can determine the authorization token corresponding to the account identifier by generating an authorization token corresponding to the account identifier. Alternatively, it can determine the authorization token corresponding to the account identifier based on a stored valid authorization token corresponding to the account identifier.

[0360] S206: The first client sends the authorization token and the account identifier to the first server.

[0361] After the second server determines that the authorization token corresponding to the account identifier has been sent to the first client, the first client can request the business resources in the logged-in state from the first server based on the authorization token.

[0362] That is, the first client receives the user's account identifier and authorization token sent by the second server, and forwards them to the first server to request the business resources of the first client in the logged-in state, so as to realize the login.

[0363] S207: The first server sends a verification request carrying the authorization token and the account identifier to the second server.

[0364] The first server receives the account identifier and authorization token sent by the first client. Since the second server generates the authorization token, to ensure that the authorization token is a compliant and valid authorization token determined by the second server, the first server may send the account identifier and authorization token to the second server in a verification request. The verification result of the authorization token determined by the second server can be used by the first server to determine whether the first client is allowed by the second server to log in to the first client without a password based on the user's account on the second client.

[0365] S208: The second server performs verification based on the stored correspondence and the verification request.

[0366] S209: The second server returns the verification result of the authorization token to the first server.

[0367] The second server is used to receive the verification request sent by the first server, which carries an account identifier and an authorization token, and to perform verification according to the stored correspondence between the account identifier and the authorization token and the verification request, and to return the verification result of the authorization token to the first server.

[0368] In one or more embodiments of this specification, the second server may determine that the verification result is passed if the authorization token corresponding to the account identifier carried in the received verification request matches the authorization token in the stored correspondence associated with the account identifier; otherwise, it is failed.

[0369] Alternatively, the second server may determine that the verification result is passed if the authorization token corresponding to the account identifier carried in the received verification request is consistent with the authorization token in the stored correspondence associated with the account identifier, and the authorization token is within its validity period; otherwise, it is failed.

[0370] S210: When the first server receives the verification result as passed, it determines that the account corresponding to the account identifier has logged in on the first client.

[0371] When the first server receives a successful verification result from the second server, it can determine that the account corresponding to the account identifier is logged in on the first client. Afterwards, the first server can send business resources in the logged-in state to the first client.

[0372] based on Figure 6 The passwordless login system shown involves a first client sending a passwordless login request to a second client. The request is based on the user's account on the second client. The second client displays an authorization interface and responds to the user's authorization action. Based on the user's logged-in account identifier on the second client, it generates an authorization request and sends it to a second server. The second server determines the authorization token corresponding to the account identifier, stores the mapping between the account identifier and the authorization token, and sends the authorization token and the account identifier to the first client. Upon receiving the authorization token and account identifier, the first client forwards the request to the first server, requesting passwordless login. The first server, based on the received account identifier and authorization token, sends a verification request to the second server. The second server then performs verification according to the stored mapping and the verification request and returns a verification result to the first server. If the verification result is successful, the first server confirms that the account corresponding to the account identifier is logged in on the first client.

[0373] As can be seen, the passwordless login system provided in this specification enables a first client to obtain an authorization token by requesting authorization from the second server corresponding to the second client. Based on the authorization token, the first client then requests passwordless login from its own corresponding first server, enabling login to the first client using the second client's account. This eliminates the need for the user to enter their account and password on the first client. Because logging in by entering an account and password is avoided, the risk of password leakage is lower, and login is more secure. Furthermore, it reduces the user's reliance on passwords and alleviates the inconvenience caused by remembering complex passwords.

[0374] In one or more embodiments of this specification, to enhance the security of user passwordless login to the client based on authorization tokens, in step S200, the passwordless login request sent by the first client to the second client may also carry basic information of the first client. This basic information may include at least one of the following: the Internet Protocol (IP) address corresponding to the terminal, a serial number, etc.

[0375] In step S204, the second server may also store the correspondence between the account identifier, the authorization token, and the basic information.

[0376] In step S206, the first client may also send its basic information, the authorization token, and the account identifier to the first server.

[0377] The first server can also send the first client's basic information, the authorization token, and the account identifier to the second server in the verification request.

[0378] Then, in step S209, the second server may determine that the authorization token verification result is passed when it determines that the authorization token in the stored correspondence of the account identifier is consistent with the authorization token corresponding to the account identifier carried in the verification information, and the basic information in the correspondence of the account identifier is consistent with the basic information corresponding to the account identifier carried in the verification information. Alternatively, it may determine that the authorization token verification result is passed when it determines that the authorization token in the stored correspondence of the account identifier is consistent with the authorization token corresponding to the account identifier carried in the verification information, the basic information in the correspondence of the account identifier is consistent with the basic information corresponding to the account identifier carried in the verification information, and the authorization token is within its validity period.

[0379] In addition, passwordless login can only be achieved by the first client requesting authorization from the first server in advance and obtaining and storing the authorization token corresponding to the user's account identifier on the second client. Otherwise, the first client cannot achieve passwordless login.

[0380] Therefore, after a user accesses the passwordless login portal of the first client, the first client can also respond to the user's passwordless login request by determining whether it stores the authorization token corresponding to the user's account identifier on the second client. If so, it sends the account identifier and the authorization token to the first server; otherwise, it sends a passwordless login request to the second client. That is, when the first client stores the authorization token corresponding to the user's account identifier on the second client, steps S206 to S210 are executed. When the first client does not store the authorization token corresponding to the user's account identifier on the second client, steps S200 to S210 are executed.

[0381] In one or more embodiments of this specification, the first client may also send a passwordless login request to the second server.

[0382] The second server can also receive passwordless login requests sent by the first client, determine the account identifier of the user corresponding to the first client who logs in on the second client, and send the account identifier to the second client along with the passwordless login request.

[0383] The account identifier used to log in on the second client is the account identifier of the account logged in on the second client.

[0384] The second client is also used to receive login requests sent by the second server, display the authorization interface and respond to the user's authorization operation on the authorization interface, and generate an authorization request carrying the account identifier based on the user's account identifier on the second client and send it to the second server.

[0385] This instruction manual also provides Figure 6 The corresponding passwordless login method is applied to the first client, such as... Figure 7 As shown.

[0386] Figure 7 A schematic diagram illustrating a passwordless login method provided in this specification includes:

[0387] S1200: Send a passwordless login request to the second client, so that the second client displays an authorization interface and responds to the user's authorization operation according to the passwordless login request. Generate an authorization request based on the account identifier of the user logged in on the second client and send it to the second server, so that the second server receives the authorization request sent by the second client carrying the account identifier, determines the authorization token corresponding to the account identifier, and stores the correspondence between the account identifier and the authorization token.

[0388] S1202: Receive the account identifier and authorization token sent by the second server.

[0389] S1204: Forward the account identifier and the authorization token to the first server, so that the first server sends the account identifier and the authorization token in a verification request to the second server, so that the second server receives the verification request sent by the first server carrying the account identifier and the authorization token, performs verification according to the stored correspondence and the verification request, and returns the verification result of the authorization token to the first server, so that when the first server receives the verification result as passed, it determines that the account corresponding to the account identifier is logged in on the first client.

[0390] Additionally, in step S1200, when sending a passwordless login request to the second client, specifically, the first client can respond to the user's input passwordless login request by determining whether an authorization token corresponding to the user's account identifier on the second client exists. If not, a passwordless login request is sent to the second client. If yes, the account identifier and authorization token are sent to the first server.

[0391] In one or more embodiments of this specification, the first client can also send a passwordless login request to the second client through the second server. That is, it can also send a passwordless login request to the second server, so that the second server can determine the account identifier of the user corresponding to the first client who logged in on the second client based on the passwordless login request, and send the account identifier along with the passwordless login request to the second client.

[0392] Figure 7 For details of steps S1200 to S1204, please refer to the above. Figure 6 The relevant content will not be elaborated upon here.

[0393] This instruction manual also provides Figure 6 The corresponding passwordless login method is applied to the second client, such as... Figure 8 As shown.

[0394] Figure 8 This is a schematic diagram of a passwordless login method provided in this specification, which includes:

[0395] S1300: Receive the passwordless login request sent by the first client, and display the authorization interface according to the passwordless login request.

[0396] S1302: In response to the user's authorization operation, generate an authorization request based on the account identifier that the user logged in on the second client.

[0397] S1304: The authorization request is sent to the second server, causing the second server to determine the authorization token corresponding to the account identifier based on the authorization request, store the correspondence between the account identifier and the authorization token, and send the authorization token and the account identifier to the first client, causing the first client to forward the authorization token and the account identifier to the first server, causing the first server to send the account identifier and the authorization token in a verification request to the second server, causing the second server to perform verification based on the verification request and the stored correspondence, and return the verification result of the authorization token to the first server, causing the first server to determine that the account corresponding to the account identifier is logged in on the first client when the received verification result is successful.

[0398] Additionally, in step S1300, the second client may choose not to receive a passwordless login request directly sent by the first client. This passwordless login request can also be sent from the first client to the second client via the second server. Therefore, the second client can also receive a passwordless login request carrying an account identifier sent by the second server.

[0399] The account identifier is determined by the second server after receiving the passwordless login request from the first client, based on the account logged in on the second client by the user corresponding to the first client. That is, after the first client sends the passwordless login request to the second server, the second server includes the account identifier in the passwordless login request and sends it to the second client.

[0400] In step S1304, after the second client sends the authorization request to the second server, it can also send the authorization token determined by the second server to the first client. Specifically, the second client can send the authorization request to the second server, allowing the second server to determine the authorization token corresponding to the account identifier based on the authorization request and store the correspondence between the account identifier and the authorization token. Afterward, the second client can return the account identifier and its corresponding authorization token to itself.

[0401] The second client can receive the account identifier and its corresponding authorization token sent by the second server, and forward the account identifier and authorization token to the first client.

[0402] Figure 8 For details of the corresponding steps S1300 to S1304, please refer to the above. Figure 6 The relevant content will not be elaborated upon here.

[0403] This instruction manual also provides Figure 6 The corresponding passwordless login method is applied to the first server, such as... Figure 9 As shown.

[0404] Figure 9 This is a schematic diagram of a passwordless login method provided in this specification, which includes:

[0405] S1400: Receive an account identifier and authorization token sent by the first client. The account identifier and authorization token are obtained by the first client through the second client and the second server. The authorization token is generated by the second server based on the generation of an authorization request. The generation of the authorization request is determined by the second client in response to the user's operation on the authorization interface. The authorization interface is displayed by the second client based on the passwordless login request sent by the first client.

[0406] S1402: The account identifier and the authorization token are sent to the second server in the verification request, so that the second server performs verification according to the stored correspondence between the account identifier and the authorization token and the verification request, and returns the verification result of the authorization token to the first server.

[0407] S1404: When the verification result sent by the second server is passed, it is determined that the account corresponding to the account identifier has logged in on the first client.

[0408] Figure 9 For details of the corresponding steps S1400 to S1404, please refer to the above. Figure 6 The relevant content will not be elaborated upon here.

[0409] This instruction manual also provides Figure 6 The corresponding passwordless login method is applied to the second server, such as... Figure 10 As shown.

[0410] Figure 10 This is a schematic diagram of a passwordless login method provided in this specification, which includes:

[0411] S1500: Receive an authorization request carrying an account identifier sent by the second client. The authorization request is generated by the second client in response to the user's authorization operation on the authorization interface, based on the account identifier logged in by the user on the second client. The authorization interface is determined by the second client based on the passwordless login request sent by the first client.

[0412] S1502: Determine the authorization token corresponding to the account identifier, store the correspondence between the account identifier and the authorization token, and send the authorization token and the account identifier to the first client, so that the first client forwards the authorization token and the account identifier to the first server.

[0413] S1504: Receive a verification request sent by the first server carrying the account identifier and the authorization token, perform verification according to the stored correspondence and the verification request, and return the verification result of the authorization token to the first server, so that when the first server receives the verification result as passed, it determines that the account corresponding to the account identifier has logged in on the first client.

[0414] Additionally, in step S1500, when receiving the authorization request carrying an account identifier from the second client, specifically, the second server can also receive the passwordless login request from the first client, determine the account identifier used by the user to log in on the second client, and send the account identifier along with the passwordless login request to the second client. This allows the second client to display an authorization interface based on the passwordless login request and respond to the user's authorization operation on the authorization interface, generating an authorization request based on the user's account identifier on the second client. Furthermore, the second client can send the authorization request to the second server.

[0415] The second server can then receive authorization requests sent by the second client, which carry account identifiers.

[0416] In step S1502, when the second server sends the authorization token and account identifier to the first client, it can specifically send them through the second client. That is, the second server can return the authorization token and account identifier to the second client, allowing the second client to forward them to the first client.

[0417] Figure 10 For details of steps S1500 to S1504, please refer to the above. Figure 6 The relevant content will not be elaborated upon here.

[0418] This manual also provides a passwordless login device for use on the first client, such as... Figure 11 As shown.

[0419] Figure 11 The passwordless login device shown includes:

[0420] The first sending module 1600 is used to send a passwordless login request to the second client, so that the second client displays an authorization interface and responds to the user's authorization operation according to the passwordless login request. Based on the account identifier of the user logged in on the second client, the module generates an authorization request and sends it to the second server, so that the second server receives the authorization request carrying the account identifier sent by the second client, determines the authorization token corresponding to the account identifier, and stores the correspondence between the account identifier and the authorization token.

[0421] The receiving module 1601 is used to receive the account identifier and the authorization token sent by the second server;

[0422] The second sending module 1602 is used to forward the account identifier and the authorization token to the first server, so that the first server sends the account identifier and the authorization token in a verification request to the second server, so that the second server receives the verification request sent by the first server carrying the account identifier and the authorization token, performs verification according to the stored correspondence and the verification request, and returns the verification result of the authorization token to the first server, so that when the first server receives the verification result as passed, it determines that the account corresponding to the account identifier is logged in on the first client.

[0423] Optionally, the first sending module 1600 is further configured to respond to a passwordless login request input by the user, determine whether there is an authorization token corresponding to the user's account identifier on the second client, and if not, send a passwordless login request to the second client; if so, send the account identifier and the authorization token to the first server.

[0424] Optionally, the first sending module 1600 is further configured to send a passwordless login request to the second server, so that the second server determines the account identifier of the user corresponding to the first client who logs in on the second client based on the passwordless login request, and sends the account identifier to the second client along with the passwordless login request.

[0425] This manual also provides a passwordless login device for use on a second client, such as... Figure 12 As shown.

[0426] Figure 12 The passwordless login device shown includes:

[0427] The receiving module 1700 is used to receive the passwordless login request sent by the first client and display the authorization interface according to the passwordless login request;

[0428] The response module 1701 is used to respond to the user's authorization operation by generating an authorization request based on the account identifier of the user logged in on the second client;

[0429] The sending module 1702 is used to send the authorization request to the second server, so that the second server determines the authorization token corresponding to the account identifier according to the authorization request, stores the correspondence between the account identifier and the authorization token, and sends the authorization token and the account identifier to the first client, so that the first client forwards the authorization token and the account identifier to the first server, so that the first server sends the account identifier and the authorization token in a verification request to the second server, so that the second server performs verification according to the verification request and the stored correspondence, and returns the verification result of the authorization token to the first server, so that when the first server receives the verification result as passed, it determines that the account corresponding to the account identifier is logged in on the first client.

[0430] Optionally, the sending module 1702 is further configured to send the authorization request to the second server, so that the second server determines the authorization token corresponding to the account identifier according to the authorization request, stores the correspondence between the account identifier and the authorization token, receives the account identifier and its corresponding authorization token sent by the second server, and forwards the account identifier and the authorization token to the first client.

[0431] Optionally, the receiving module 1701 is further configured to receive a passwordless login request carrying an account identifier sent by the second server, wherein the account identifier is determined by the second server after receiving the passwordless login request sent by the first client, based on the account logged in by the user corresponding to the first client on the second client.

[0432] This manual also provides a passwordless login device, applied to the first server, such as... Figure 13 As shown.

[0433] Figure 13 The passwordless login device shown includes:

[0434] The receiving module 1800 is used to receive an account identifier and an authorization token sent by a first client. The account identifier and the authorization token are obtained by the first client through a second client and a second server. The authorization token is generated by the second server based on the generation of an authorization request. The generation of the authorization request is determined by the second client in response to the user's operation on the authorization interface. The authorization interface is displayed by the second client based on the passwordless login request sent by the first client.

[0435] The request module 1801 is used to send the account identifier and the authorization token in the verification request to the second server, so that the second server performs verification according to the stored correspondence between the account identifier and the authorization token and the verification request, and returns the verification result of the authorization token to the first server.

[0436] The login module 1802 is used to determine that the account corresponding to the account identifier has logged in on the first client when the verification result sent by the second server is passed.

[0437] This manual also provides a passwordless login device for use on a second server, such as... Figure 14 As shown.

[0438] Figure 14 The passwordless login device shown includes:

[0439] The receiving module 1900 is used to receive an authorization request carrying an account identifier sent by a second client. The authorization request is generated by the second client in response to the user's authorization operation on the authorization interface, based on the account identifier logged in by the user on the second client. The authorization interface is determined by the second client based on the passwordless login request sent by the first client.

[0440] The authorization module 1901 is used to determine the authorization token corresponding to the account identifier, store the correspondence between the account identifier and the authorization token, and send the authorization token and the account identifier to the first client, so that the first client forwards the authorization token and the account identifier to the first server;

[0441] The verification module 1902 is used to receive a verification request sent by the first server carrying the account identifier and the authorization token, perform verification according to the stored correspondence and the verification request, and return the verification result of the authorization token to the first server, so that when the first server receives the verification result as passed, it determines that the account corresponding to the account identifier has logged in on the first client.

[0442] Optionally, the authorization module 1901 is further configured to return the authorization token and the account identifier to the second client, so that the second client forwards them to the first client.

[0443] Optionally, the receiving module 1900 is further configured to receive a passwordless login request sent by the first client, determine the account identifier of the user logged in on the second client, send the account identifier along with the passwordless login request to the second client, so that the second client displays an authorization interface and responds to the user's authorization operation on the authorization interface according to the passwordless login request, generates an authorization request according to the user's account identifier on the second client, and receives the authorization request with the account identifier sent by the second client.

[0444] This specification also provides a computer-readable storage medium storing a computer program that can be used to execute the above-described... Figures 7-10 The passwordless login method shown.

[0445] This instruction manual also provides Figure 15 The passwordless login system shown. Figure 15 The system includes a first client and a corresponding first server, a second client and a corresponding second server, and a third client and a corresponding third server. The first client and the first server can correspond to a business platform (hereinafter referred to as the first business platform), the second client and the second server can correspond to a business platform (hereinafter referred to as the second business platform), and the third server and the third client can also correspond to a business platform (hereinafter referred to as the third business platform).

[0446] The first business platform, the second business platform, and the third business platform can be different business platforms, or they can be sub-platforms belonging to the same business platform. This specification does not impose any restrictions on these.

[0447] The first client is the client that needs to be logged in. The third client can be a web client or a client downloaded to the user's local terminal.

[0448] based on Figure 15 The system shown allows users to log in to the first client without a password, but instead use an authorization token, which serves as a trusted basis, to log in to the first client using their account on the second client without a password.

[0449] The third business platform is used to assist the first business platform and the second business platform in interacting and establishing a trust connection. It also assists the first business platform in obtaining authorization from the second business platform and acquiring the authorization token generated by the second business platform corresponding to the user's account on the second client. This allows the first client of the first business platform to log in to the user account based on the authorization token generated by the second business platform and obtain business resources in the logged-in state from the first server, thus achieving passwordless login.

[0450] That is, based on the trust relationship between the first business platform and the third business platform, and the trust relationship between the second business platform and the third business platform, a trust chain from the first business platform to the third business platform is built through the third business platform to realize authorization and passwordless login.

[0451] Thus, by providing users with a passwordless login method, users can avoid frequently entering their account and password to log in to the client, resulting in higher security and greater convenience. Furthermore, it reduces users' reliance on passwords and minimizes the inconvenience caused by the difficulty in remembering complex passwords.

[0452] When the first client obtains the authorization token corresponding to the user's account identifier on the second client of the second business platform through the third business platform, the first client is a trusted client recognized by the second business platform, and the first client is allowed by the second business platform to log in to the first client based on the user's account on the second client.

[0453] When the first client possesses an authorization token corresponding to the account identifier of the second client, it can request business resources in its logged-in state from its corresponding first server based on that authorization token. Upon receiving the authorization token from the first client, the first server, since its direct trusted party is the third business platform, can verify the authorization token with the third business platform. After verifying the authorization token with the third business platform and confirming its validity, the first client's login is confirmed, thus enabling the user to log in to the second client's account on the first client.

[0454] Once the first client possesses the authorization token, it can send the account identifier and the authorization token along with the resource acquisition request to the first server to request business resources, without requiring the user to enter a password. Furthermore, the authorization token is invisible to the user and remains unnoticed. When requesting passwordless login, the first client sends the authorization token directly to the first server, eliminating the risk of data leakage due to user input. This makes the login process more convenient and secure. It also reduces user reliance on passwords and alleviates the inconvenience caused by remembering complex passwords.

[0455] Figure 15 The passwordless login system shown includes a first client, a first server, a second client, a second server, a third client, and the interaction process between the third server is as follows:

[0456] S500: The third client sends a passwordless login request to the third server.

[0457] The third client can send a passwordless login request to the third server in response to the user's operation on the passwordless login portal.

[0458] The passwordless login request may carry the application identifier of the first client.

[0459] Furthermore, since the third server requests authorization from other business platforms based on the passwordless login request, the passwordless login request can also carry the application identifier of the second client, so that the third server can clearly indicate that it needs to send a passwordless login request to the second business platform.

[0460] When the second server acts as a business server for other clients in addition to serving as a business server for the second client, the passwordless login request may also carry the application identifier of the second client.

[0461] S501: The third server determines the account identifier of the user corresponding to the third client on the second client.

[0462] S502: The third server sends a passwordless login request carrying the account identifier to the second server.

[0463] After the third client sends a passwordless login request to the third server, the third server can receive the passwordless login request sent by the third client, determine the account identifier of the user corresponding to the third client on the second client, and send the account identifier in the passwordless login request to the second server.

[0464] The third client corresponds to the user's account identifier on the second client, that is, the account identifier of the user's account logged in on the third client.

[0465] S503: The second server sends a login request carrying the account identifier to the second client.

[0466] The second server is used to receive passwordless login requests sent by the third server and forward them to the second client.

[0467] S504: The second client displays the authorization interface.

[0468] S505: The second client, in response to the user's authorization operation, generates an authorization request based on the account identifier.

[0469] S506: The second client sends the authorization request to the second server.

[0470] The second client is used to receive passwordless login requests sent by the second server, display the authorization interface and respond to the user's authorization operation, and generate an authorization request based on the account identifier and send it to the second server.

[0471] The authorization interface can display the application identifier of the first client, allowing users to clearly identify whether the first client requests to log in to the first client based on the account logged in on the second client, in order to decide whether to grant authorization.

[0472] S507: The second server generates an authorization token corresponding to the account identifier and stores the correspondence between the account identifier and the authorization token.

[0473] S508: The second server sends the authorization token and the account identifier to the third server.

[0474] The second server is used to receive the authorization request sent by the second client carrying the account identifier, generate the authorization token corresponding to the account identifier, and send the authorization token and the account identifier to the third server.

[0475] S509: The third server stores the correspondence between the account identifier and the authorization token.

[0476] S510; The third server sends the authorization token and the account identifier to the third client.

[0477] The third server is used to receive the account identifier and authorization token sent by the second server, store the correspondence between the account identifier and the authorization token, and send the account identifier and authorization token to the third client.

[0478] S511: The third client sends the account identifier and the authorization token to the first client.

[0479] The third client is used to receive the account identifier and authorization token sent by the third server. Thus, the third client successfully obtained the authorization token from the second business platform for the first client.

[0480] The third client can send the received account identifier and authorization token to the first client.

[0481] In one or more embodiments of this specification, the third client may also include the account identifier and authorization token in the startup command and send it to the first client to wake up the first client and start it. Of course, the user may also open the first client, and this specification does not limit this.

[0482] S512: The first client sends the account identifier and the authorization token to the first server.

[0483] After the third client sends the account identifier and authorization token, the first client receives the account identifier and authorization token sent by the third client and, in response to the login request entered by the user, forwards the account identifier and authorization token to the first server corresponding to the first client.

[0484] S513: The first server sends a first verification request carrying the account identifier and the authorization token to the third server.

[0485] After the first client sends the account identifier and authorization token, the first server receives the account identifier and authorization token sent by the first client. To ensure that the received authorization token is valid, the first server may send the account identifier and authorization token to the third server in the first verification request.

[0486] S514: The third server performs verification based on the stored account identifier, the authorization token, and the first verification request.

[0487] S515: The third server sends the first verification result to the first server.

[0488] After the first client sends the first verification request, the third server receives the first verification request sent by the first server, which carries the account identifier and authorization token. The server then performs verification based on the stored account identifier, authorization token, and first verification request, and returns the first verification result of the authorization token to the first server.

[0489] The stored account identifier and authorization token refer to the account identifier and authorization token in the correspondence between the account identifier and authorization token stored by the third server in step S509.

[0490] The third server can determine that the first verification result of the authorization token is passed when it finds that the authorization token corresponding to the stored account identifier is consistent with the authorization token corresponding to the account identifier carried in the first verification request.

[0491] Alternatively, the third server may determine that the first verification result of the authorization token is passed when it is determined that the authorization token corresponding to the stored account identifier is consistent with the authorization token corresponding to the account identifier carried in the first verification request, and the authorization token is within the validity period.

[0492] S516: When the first verification result is passed, the first server determines that the account corresponding to the account identifier has logged in on the corresponding first client.

[0493] S517: The first server sends the business resources of the account corresponding to the account identifier to the first client, indicating that the account is logged in on the first client.

[0494] The first server is used to receive the first verification result of the authorization token sent by the third server. The first verification result may carry the account identifier and the authorization token.

[0495] When the first verification result is passed, the first server can determine that the first client that sent the authorization token is trustworthy and has been authorized, and determine that the account corresponding to the account identifier is logged in on the corresponding first client. The server then sends the business resources of the account corresponding to the account identifier to the first client, indicating that the account is logged in on the corresponding first client.

[0496] The first client can then receive business resources sent by the first server.

[0497] In addition, in step S508, the second server can also send the authorization token and account identifier to the third server through the second client.

[0498] Therefore, the second server is also used to receive an authorization request carrying an account identifier sent by the second client, generate an authorization token corresponding to the account identifier, store the correspondence between the account identifier and the authorization token, and send the authorization token and the account identifier to the second client.

[0499] The second client can then receive the authorization token and account identifier sent by the second server and forward them to the third server.

[0500] Furthermore, since the first server's direct trusted party is the third business platform, when the first server receives the authorization token sent by the first client, it verifies the validity of the authorization token with the third server. The authorization token is generated by the second business platform. Therefore, after receiving the authorization token corresponding to the account identifier sent by the second client, the third server can first verify it with the second server; only after successful verification can it be sent to the first client.

[0501] Therefore, the third server is also used to receive the account identifier and authorization token sent by the second client, and send them to the second server in the second verification request.

[0502] The second server is also used to receive a second verification request sent by the third server, perform verification according to the stored correspondence and the second verification request, and return the second verification result of the authorization token to the third server.

[0503] The third server is also configured to receive the second verification result of the authorization token sent by the second server, and when the second verification result is successful, store the correspondence between the account identifier and the authorization token, and send the account identifier and the authorization token to the third client. The third client can then execute step S511.

[0504] therefore, Figure 15 The passwordless login system shown includes the interaction process between the first client, the first server, the second client, the second server, the third client, and the third server, and can also be described as follows: Figure 16 As shown:

[0505] S600: The third client sends a passwordless login request to the third server.

[0506] S601: The third server determines the account identifier of the user corresponding to the third client on the second client.

[0507] S602: The third server sends a passwordless login request carrying the account identifier to the second server.

[0508] S603: The second server sends a passwordless login request carrying the account identifier to the second client.

[0509] S604: The second client displays the authorization interface.

[0510] S605: The second client, in response to the user's authorization operation, generates an authorization request based on the account identifier.

[0511] S606: The second client sends the authorization request to the second server.

[0512] S607: The second server generates an authorization token corresponding to the account identifier and stores the correspondence between the account identifier and the authorization token.

[0513] S608: The second server sends the authorization token and the account identifier to the second client.

[0514] S609: The second client sends the authorization token and the account identifier to the third server.

[0515] S610: The third server sends a second verification request carrying the authorization token and the account identifier to the second server.

[0516] S611: The second server performs verification based on the stored correspondence and the second verification request.

[0517] S612: The second server returns a second verification result of the authorization token to the third server.

[0518] S613: When the second verification result is passed, the third server stores the correspondence between the account identifier and the authorization token.

[0519] S614: The third server sends the account identifier and the authorization token to the third client.

[0520] S615: The third client sends the account identifier and the authorization token to the first client.

[0521] S616: The first client sends the account identifier and the authorization token to the corresponding first server.

[0522] S617: The first server sends a first verification request carrying the account identifier and the authorization token to the third server.

[0523] S618: The third server performs verification based on the stored account identifier, the authorization token, and the first verification request.

[0524] S619: The third server sends the first verification result to the first server.

[0525] S620: When the first verification result is passed, the first server determines that the account corresponding to the account identifier has logged in on the corresponding first client.

[0526] S621; The first server sends the business resources of the account corresponding to the account identifier to the corresponding first client, indicating that the account is logged in on the corresponding first client.

[0527] In addition, the first client and the third client can be clients in the same terminal, or they can be clients in different terminals.

[0528] In one or more embodiments of this specification, there may be multiple first clients and multiple first servers, with a one-to-one correspondence between each first client and a first server. That is, one first client corresponds to one first server. Therefore, in step S511, the third client sends the user's account identifier and authorization token to each first client, and in step S615, the third client also sends the user's account identifier and authorization token to each first client. This allows each first client to send the received account identifier and authorization token to its corresponding first server, and obtain the business resources from its corresponding first server where the account corresponding to the account identifier is logged in on the first client.

[0529] In addition to assisting the interaction between the first client, the first server, and the second client and the second server to establish a trust chain, the third business platform obtains a unified authorization token from each first client through interaction with the second business platform and distributes it to each first client. This enables each first client to log in to each first client using the user's account on the second client based on the unified authorization token.

[0530] In one or more embodiments of this specification, the third client can determine each first client based on a pre-stored whitelist and send the authorization token and account identifier to each first client.

[0531] Furthermore, since the second business platform trusts the third business platform, not the first client, and the authorization token generated by the second business platform is used by the first client, the third client can verify the accuracy and validity of the whitelist to ensure the security of the authorization token and prevent it from being stolen. For example, the third client can periodically verify each first client in the whitelist to check for any unauthorized applications. This is to prevent the whitelist from being tampered with, to prevent the authorization token from being leaked, or to prevent some of the first clients from becoming invalid.

[0532] In one or more embodiments of this specification, each first client may be pre-opened by the user, or it may be invoked by a startup command sent by a third client when sending an authorization token and account identifier to the first client.

[0533] Furthermore, the login request input by the user mentioned in step S512 can be a login request triggered by the user opening each of the first clients. Alternatively, after the first client receives the account identifier and authorization token sent by the third client, the first client can display a prompt page reminding the user that they are about to log in to the first client based on the account on the second client. The user can click "confirm" on the prompt page to trigger the login operation and realize the login request input. Or, the first client can display a prompt page, and if the user does not perform any operation on the prompt page within a preset time, it confirms that the user has entered a login request.

[0534] Of course, after the first client receives the account identifier and authorization token sent by the third client, it can also directly forward it to the corresponding first server to request business resources from the first server without needing to confirm user input.

[0535] In one or more embodiments of this specification, the third client can determine whether it is opened in a mobile browser based on the browser's User-Agent (UA) field, and send the determination result to the third server. If the determination result is yes, it can be determined that the third client and the second client are on the same terminal, and the third server can directly execute the above steps S501 and S502. Otherwise, it can interact with the second server through the JSONP (JSON with padding) interface provided by the second service platform.

[0536] This instruction manual also provides Figure 15 The passwordless login system shown here, and the corresponding passwordless login method, are applied to the first client, such as... Figure 17 As shown.

[0537] Figure 17 This diagram illustrates a passwordless login method provided in this specification, which includes the following steps:

[0538] S2000: Receives account identifiers and authorization tokens sent by third-party clients.

[0539] Specifically: the authorization token corresponding to the account identifier is generated by the second server based on the user's authorization operation on the authorization interface of the second client, and then sent to the third client. This authorization interface is generated by the second client based on the third server and the passwordless login request forwarded by the second server from the third client.

[0540] S2002: In response to the login request entered by the user, the account identifier and the authorization token are forwarded to the first server corresponding to the first client, so that the first server sends the account identifier and the authorization token to the third server in the first verification request.

[0541] S2004: When the first verification result returned by the third server to the first server is passed, the service resources sent by the first server are received.

[0542] Wherein: the authorization token corresponding to the account identifier is generated by the second server based on the user's authorization operation on the authorization interface of the second client, and sent to the third client. The authorization interface is generated by the second client based on the third server and the passwordless login request of the third client forwarded by the second server.

[0543] Figure 17 For details of steps S2000 to S2004, please refer to the above. Figure 15 The relevant content will not be elaborated upon here.

[0544] This instruction manual also provides Figure 15 The passwordless login system shown here, and the corresponding passwordless login method, are applied to the first server, such as... Figure 18 As shown.

[0545] Figure 18 This diagram illustrates a passwordless login method provided in this specification, which includes the following steps:

[0546] S2100: Receives an account identifier and authorization token sent by the first client corresponding to itself, wherein the account identifier and authorization token are sent from the third client to the first client.

[0547] The account identifier is the account identifier of the user's account logged in on the second client, corresponding to the third client. The authorization token corresponding to this account identifier is generated by the second server based on the authorization request and sent to the third client. The authorization request is generated by the second client based on the user's authorization operation on the authorization interface. The authorization interface is generated by the second client based on the third server and the passwordless login request forwarded by the second server from the third client.

[0548] S2102: Send the account identifier and the authorization token to the third server in the first verification request.

[0549] S2104: Receive the first verification result of the authorization token sent by the third server, and when the first verification result is passed, determine that the account corresponding to the account identifier is logged in on the corresponding first client, and send the business resources of the account corresponding to the account identifier to the corresponding first client, where the first client is in a logged-in state.

[0550] Figure 18 For details of steps S2100 to S2104, please refer to the above. Figure 15 The relevant content will not be elaborated upon here.

[0551] This instruction manual also provides Figure 15 The passwordless login system shown here, and the corresponding passwordless login method, are applied to the second client, such as... Figure 19 As shown.

[0552] Figure 19 This diagram illustrates a passwordless login method provided in this specification, which includes the following steps:

[0553] S2200: Receives a passwordless login request carrying an account identifier sent by the second server.

[0554] Specifically, the passwordless login request is sent from the third client to the second client via the third server and the second server. That is, it is sent from the third client to the second server via the third server. The account identifier is the account identifier of the user corresponding to the third client who logs in on the second client.

[0555] S2202: Display the authorization interface.

[0556] S2204: In response to the user's authorization operation, an authorization request is generated based on the account identifier and sent to the second server, causing the second server to generate an authorization token corresponding to the account identifier, and the account identifier and the authorization token are sent to the first client through the third server and the third client, and the first client performs passwordless login through the first server based on the authorization token corresponding to the account identifier.

[0557] In addition, after generating an authorization request based on the account identifier and sending it to the second server, the second client can also receive the authorization token and account identifier sent by the second server.

[0558] The authorization token and account identifier are then sent to the first client via a third server and a third client.

[0559] Figure 19 For details of steps S2200 to S2204, please refer to the above. Figure 15 The relevant content will not be elaborated upon here.

[0560] This instruction manual also provides Figure 15 The passwordless login system shown here, and the corresponding passwordless login method, are applied to the second server, such as... Figure 20 As shown.

[0561] Figure 20 This diagram illustrates a passwordless login method provided in this specification, which includes the following steps:

[0562] S2300: Receives a passwordless login request sent by a third server, carrying an account identifier.

[0563] S2302: Forward the passwordless login request to the second client.

[0564] S2304: Receive the authorization request carrying the account identifier sent by the second client, and generate an authorization token corresponding to the account identifier.

[0565] S2306: Send the authorization token and the account identifier to the third server, so that the third server stores the correspondence between the account identifier and the authorization token, and when receiving the first verification request sent by the first server, performs verification based on the stored authorization token and the account identifier, and returns the first verification result of the authorization token to the first server.

[0566] The first server determines whether the first client can log in without a password based on the first verification result.

[0567] Figure 20 For details of steps S2300 to S2306, please refer to the above. Figure 15 The relevant content will not be elaborated upon here.

[0568] This instruction manual also provides Figure 15 The passwordless login system shown corresponds to a passwordless login method that is applied to a third-party client, such as... Figure 21 As shown.

[0569] Figure 21 This diagram illustrates a passwordless login method provided in this specification, which includes the following steps:

[0570] S2400: Send a passwordless login request to the third server, so that the third server carries the account identifier of the user corresponding to the third client in the passwordless login request and sends it to the second client through the second server, so that the second client responds to the user's authorization operation and generates an authorization request.

[0571] S2402: Receive the account identifier and authorization token sent by the third server, wherein the authorization token is generated by the second server based on the authorization request sent by the second client and sent to the third server.

[0572] S2404: Send the account identifier and the authorization token to the first client, so that the first client responds to the login request entered by the user and forwards the account identifier and the authorization token to the first server.

[0573] The first server determines whether the first client can log in without a password based on the first verification result of the authorization token sent by the third server.

[0574] Figure 21 For details of steps S2400 to S2404, please refer to the above. Figure 15 The relevant content will not be elaborated upon here.

[0575] This instruction manual also provides Figure 15 The passwordless login system shown corresponds to a passwordless login method applied to a third-party server, such as... Figure 22 As shown.

[0576] Figure 22 This diagram illustrates a passwordless login method provided in this specification, which includes the following steps:

[0577] S2500: Receives passwordless login requests sent by third-party clients.

[0578] S2502: Determine the account identifier of the user corresponding to the third client on the second client, and carry the account identifier in the passwordless login request, and forward it to the second client through the second server, so that the second client responds to the user's authorization operation, generates an authorization request and sends it to the second server.

[0579] S2504: Receive the account identifier and authorization token sent by the second server, store the correspondence between the account identifier and the authorization token, and forward it to the first client through the third client, so that the first client sends it to the first server. The authorization token is generated by the second server according to the authorization request.

[0580] S2506: Receive a first verification request sent by the first server, carrying the account identifier and the authorization token; perform verification based on the stored account identifier, the authorization token and the first verification request; and return the first verification result of the authorization token to the first server.

[0581] The first server determines whether the first client can log in without a password based on the first verification result of the authorization token.

[0582] Figure 22 For details of steps S2500 to S2506, please refer to the above. Figure 15 The relevant content will not be elaborated upon here.

[0583] This manual also provides a passwordless login device for use on the first client, such as... Figure 23As shown.

[0584] Figure 23 The passwordless login device shown includes:

[0585] The first receiving module 2600 is used to receive the account identifier and authorization token sent by the third client;

[0586] The response module 2601 is used to respond to a login request input by a user, forward the account identifier and the authorization token to the first server corresponding to the first client, and cause the first server to send the account identifier and the authorization token to the third server in the first verification request;

[0587] The second receiving module 2602 is used to receive the service resources sent by the first server when the first verification result returned by the third server to the first server is passed; wherein: the authorization token corresponding to the account identifier is generated by the second server based on the authorization operation of the user on the authorization interface of the second client and sent to the third client, and the authorization interface is generated by the second client based on the third server and the passwordless login request of the third client forwarded by the second server.

[0588] This manual also provides a passwordless login device, applied to the first server, such as... Figure 24 As shown. The device includes:

[0589] The receiving module 2700 is used to receive an account identifier and an authorization token sent by the first client corresponding to itself, wherein the account identifier and the authorization token are sent from the third client to the first client;

[0590] Sending module 2701 is used to send the account identifier and the authorization token to the third server in the first verification request;

[0591] The login module 2702 is used to receive the first verification result of the authorization token sent by the third server, and when the first verification result is successful, determine that the account corresponding to the account identifier is logged in on the corresponding first client, and send the business resources of the account corresponding to the account identifier to the corresponding first client, wherein the first client is in a logged-in state; wherein, the authorization token corresponding to the account identifier is generated by the second server according to the authorization request and sent to the third client, the authorization request is generated by the second client according to the user's authorization operation on the authorization interface, and the authorization interface is generated by the second client based on the third server and the passwordless login request of the third client forwarded by the second server.

[0592] This manual also provides a passwordless login device for use on a second client, such as... Figure 25 As shown. The device includes:

[0593] The receiving module 2800 is used to receive a passwordless login request carrying an account identifier sent by the second server;

[0594] Display module 2801 is used to display the authorization interface;

[0595] The response module 2802 is used to respond to the user's authorization operation, generate an authorization request based on the account identifier and send it to the second server, so that the second server generates an authorization token corresponding to the account identifier, and sends the account identifier and the authorization token to the first client through the third server and the third client. The first client performs passwordless login through the first server based on the authorization token corresponding to the account identifier; wherein, the passwordless login request is sent from the third client to the second client through the third server and the second server.

[0596] This manual also provides a passwordless login device for use on a second server, such as... Figure 26 As shown. The device includes:

[0597] The receiving module 2900 is used to receive a passwordless login request carrying an account identifier sent by a third server;

[0598] The first sending module 2901 is used to forward the passwordless login request to the second client;

[0599] The authorization module 2902 is used to receive an authorization request carrying the account identifier sent by the second client and generate an authorization token corresponding to the account identifier;

[0600] The second sending module 2903 is used to send the authorization token and the account identifier to the third server, so that the third server stores the correspondence between the account identifier and the authorization token, and when receiving the first verification request sent by the first server, verifies the authorization token and the account identifier according to the stored information, and returns the first verification result of the authorization token to the first server; wherein, the first server determines whether the first client can log in without a password based on the first verification result.

[0601] This manual also provides a passwordless login device for use with third-party clients, such as... Figure 27 As shown. The device includes: 0. A first sending module 3000, used to send a passwordless login request to a third server, causing the third server to...

[0602] The user's account identifier corresponding to the third client is carried in the passwordless login request and sent to the second client through the second server, so that the second client responds to the user's authorization operation and generates an authorization request;

[0603] The receiving module 3001 is used to receive the account identifier and authorization token sent by the third server, wherein the authorization token 5 is generated by the second server according to the authorization request sent by the second client and sent to the third server;

[0604] The second sending module 3002 is used to send the account identifier and the authorization token to the first client, so that the first client, in response to the login request input by the user, forwards the account identifier and the authorization token to the first server; wherein, the first server determines whether the first client can log in without a password based on the first verification result of the authorization token sent by the third server.

[0605] This manual also provides a passwordless login device for use with third-party servers, such as... Figure 28 As shown. The device includes:

[0606] The first receiving module 3100 is used to receive passwordless login requests sent by a third client;

[0607] The sending module 3101 is used to determine the account identifier of the user corresponding to the third client on the second client, and carry the account identifier in the passwordless login request, and forward it to the second client through the second server, so that the second client responds to the user's authorization operation, generates an authorization request and sends it to the second server;

[0608] 5. Second receiving module 3102, used to receive the account identifier and authorization token sent by the second server, and store them.

[0609] The correspondence between the account identifier and the authorization token is forwarded to the first client through the third client, so that the first client sends it to the first server. The authorization token is generated by the second server according to the authorization request.

[0610] Verification module 3103 is used to receive a first verification request sent by the first server, carrying the account identifier and authorization token, and to perform verification based on the stored account identifier, authorization token, and the first verification request.

[0611] The first server returns a first verification result of the authorization token to the first server; wherein, the first server determines whether the first client can log in without a password based on the first verification result of the authorization token.

[0612] This specification also provides a computer-readable storage medium storing a computer program that can be used to execute the above-described... Figures 17-22 The passwordless login method shown.

[0613] 5. Typically, whether a user's account is allowed to log in to the client is determined by the server corresponding to the client. After confirming that the user's account is allowed to log in, the server sends the client the business resources in the logged-in state, that is, the business resources that can only be used after logging in. In the account-password login method, the client requests business resources from the server based on the account and password entered by the user, and the server verifies the password to determine whether to allow the client to log in. In this specification, to achieve passwordless login, the client can request an authorization token from the server. The client then uses its own stored authorization token to obtain business resources from the server without requiring user input. However, not all clients support passwordless login. To solve this problem, this specification provides... Figure 29 The passwordless login system shown.

[0614] This instruction manual provides Figure 29 The passwordless login system shown. Figure 29 The system includes a first client, a first server, a proxy server, a second client, a second server, and a third server. The first client is a browser client, the first server is a business server for a specified application, and the second server is a business server for the second client.

[0615] The designated application refers to the client that needs to be logged into in the browser client. The third server is a dedicated third-party server used to generate and verify authorization tokens. This third server is used to generate authorization tokens and store the correspondence between the user's account identifier on the second client, the account identifier in the designated application, and the authorization tokens.

[0616] This instruction manual is based on Figure 29 The system shown enables passwordless login to designated applications. The designated application can be either an application that supports passwordless login or an application that does not.

[0617] exist Figure 29The system shown includes a proxy server. The proxy server determines whether the application requested by the user supports passwordless login. Depending on the situation, different methods are used to achieve passwordless login: When the application supports passwordless login, the first client can send a login page retrieval request to the first server to obtain the application's login page. In response to the user's actions on the specified page, the proxy server sends a passwordless login request to the first client and retrieves the application's business resources in the logged-in state from the first server. When the application does not support passwordless login, the proxy server intercepts the first client's login page retrieval request and returns a login page for a second client that supports passwordless login to the first client. This allows the user to initiate a passwordless login request to the second client by interacting with the second client's login page. After the first client's passwordless login request to the second client is authorized, the first client obtains an authorization token and uses this token to retrieve business resources from the first server, thus achieving passwordless login.

[0618] In other words, when a specified application does not support passwordless login, a second client and a second server that do support passwordless login act as a channel for the browser client requesting login to the specified application to obtain an authorization token from a third server. Since the first server trusts the third server, even if the specified application does not support passwordless login, an authorization token can still be obtained through the second client and the second server, allowing the client to request business resources from the first server based on the authorization token. Based on the trust chains between the browser client, the second client, the second server, and the third server, as well as the trust chains between the browser client, the first server, and the third server, passwordless login to the specified application can be achieved.

[0619] Figure 29 The system shown enables passwordless login, which improves login security and convenience, reduces users' reliance on passwords, reduces the inconvenience caused by users' difficulty in remembering complex passwords, and reduces the risk of password leakage caused by logging in by entering account and password.

[0620] In this specification, the third server can be a Lightweight Directory Access Protocol (LDAP) server. Furthermore, when the specified application does not support passwordless login, the specified application is one that supports LDAP. This proxy server can be Nginx (engine x).

[0621] Figure 29 The interaction process between the first client, first server, proxy server, second client, second server, and third server in the passwordless login system shown is as follows:

[0622] S700: The proxy server obtains the login page retrieval request for the specified application sent by the first client to the first server.

[0623] As described above, the first client is a browser client. Users can enter the URL of a specified application into the browser client, which can then request the login page for that application from the corresponding first server. Therefore, the first client can send a request to the first server to retrieve the login page for the specified application.

[0624] Then, the proxy server can intercept the login page request and determine whether the specified application supports passwordless login.

[0625] Then, the first client is used to send a request to the first server to obtain the login page of the specified application.

[0626] S701: When the proxy server determines that the specified application does not support passwordless login, it sends the login page corresponding to the second client to the first client.

[0627] That is, the proxy server can obtain the login page request sent by the first client to the first server, and when it determines that the specified application does not support passwordless login, it sends the login page corresponding to the second client to the first client.

[0628] S702: The first client, in response to the user's operation on the login page, sends a passwordless login request carrying the user's account identifier on the second client to the proxy server.

[0629] After the proxy server returns the login page for the second client, the first client is used to receive the login page corresponding to the second client sent by the proxy server, and in response to the user's operation on the login page, send a passwordless login request carrying the user's account identifier on the second client to the proxy server.

[0630] Alternatively, after receiving the login page corresponding to the second client from the proxy server, the first client can also display a prompt page asking the user whether they are sure they want to log in without a password on the second client's login page. After the user confirms on the prompt page, the first client can respond by displaying the login page corresponding to the second client. After the user performs a login operation through the passwordless login entry on the login page, the first client can respond by sending a passwordless login request carrying the user's account identifier on the second client to the proxy server.

[0631] In one or more embodiments of this specification, the passwordless login request may also carry the application identifier of the specified application.

[0632] The user's account identifier on the second client can be entered by the user on the login page and stored in cookies by the first client. Of course, all data generated and received by the first client during interactions with other servers can also be stored in cookies. Furthermore, the account identifier stored in cookies can be one entered historically by the user, not just the one entered during the current passwordless login request. Alternatively, if the user's account identifier is not stored in cookies, the first client can display an interface on the login page for entering the account identifier, which the user can then use to enter the second client's account identifier.

[0633] S703: The proxy server sends the passwordless login request to the second client.

[0634] This proxy server is used to receive passwordless login requests sent by the first client and forward them to the second client.

[0635] S704: The second client displays the authorization interface.

[0636] S705: The second client, in response to the user's authorization operation, generates an authorization request based on the account identifier.

[0637] S706: The second client sends the authorization request to the second server.

[0638] The second client receives passwordless login requests carrying account identifiers from the proxy server and displays the authorization interface. This authorization interface can display the application identifier of a specified application, allowing the user to determine whether to authorize through the interface based on the displayed application identifier.

[0639] After the user performs the authorization operation on the authorization interface, the second client can respond to the user's authorization operation by generating an authorization request based on the account identifier and sending it to the second server.

[0640] S707: The second server sends the authorization request to the third server.

[0641] The second server is used to receive authorization requests sent by the second client carrying the account identifier and forward them to the third server.

[0642] S708: The third server determines the authorization token corresponding to the account identifier, and determines the correspondence between the account identifier and the authorization token.

[0643] S709: The third server receives the user's account identifier and the determined authorization token sent by the second server to the second client.

[0644] After the second server sends the authorization request, the third server receives the authorization request carrying the account identifier sent by the second server, determines the authorization token corresponding to the account identifier, determines the correspondence between the account identifier and the authorization token, and sends the user's account identifier on the second client and the determined authorization token to the second server.

[0645] In one or more embodiments of this specification, specifically, the third server can determine the authorization token corresponding to the account identifier by generating the authorization token corresponding to the account identifier and storing the correspondence between the account identifier and the authorization token, or determine the authorization token corresponding to the account identifier based on the stored correspondence between the account identifier and the authorization token.

[0646] S710: The second server sends the account identifier and the determined authorization token to the second client.

[0647] The second server is used to receive the account identifier and its corresponding authorization token sent by the third server, and then send them to the second client.

[0648] S711: The second client sends the account identifier and the authorization token to the proxy server.

[0649] The second client is used to receive the account identifier and its corresponding authorization token sent by the second server, and then send them to the proxy server.

[0650] S712: The proxy server sends the account identifier and its corresponding authorization token to the first client.

[0651] The proxy server then receives the account identifier and its corresponding authorization token sent by the second client and forwards it to the first client.

[0652] S713: The first client generates a resource acquisition request based on the received account identifier and its corresponding authorization token.

[0653] S714: The first client sends the resource acquisition request to the proxy server.

[0654] The first client is used to receive the account identifier and its corresponding authorization token forwarded by the proxy server, and generate a resource acquisition request based on the received account identifier and its corresponding authorization token and send it to the proxy server.

[0655] S715: The proxy server sends the resource acquisition request to the first server.

[0656] The proxy server is used to receive resource acquisition requests sent by the first client, which carry account identifiers and authorization tokens, and forward them to the first server.

[0657] S716: The first server sends a verification request to the third server.

[0658] The first server receives the account identifier and authorization token carried in the resource acquisition request sent by the proxy server. The first server can then send the account identifier and authorization token in a verification request to the third server to verify the validity of the authorization token corresponding to the account identifier.

[0659] S717: The third server performs verification based on the stored correspondence and the verification request.

[0660] The third server can receive a verification request sent by the first server, which carries the account identifier and the authorization token. Since the third server stores the correspondence between the account identifier and the authorization token after generating the authorization token, it can perform verification based on the stored correspondence and the verification request.

[0661] The third server can determine that the verification result is passed if the correspondence between the authorization token and the account identifier carried in the verification request matches the stored correspondence.

[0662] S718: The third server sends the verification result to the first server.

[0663] Once the third server determines the verification result, it can return the verification result to the first server.

[0664] S719: When the verification result is passed, the first server determines the account of the second client corresponding to the account identifier in the specified application login.

[0665] S720: The first server sends the business resources corresponding to the login status of the specified application to the first client.

[0666] The first server can receive the verification result sent by the third server, and when the verification result is successful, it determines to log in to the account of the second client corresponding to the account identifier on the login page of the specified application, and sends the business resources corresponding to the login status of the specified application to the first client.

[0667] The first client can then receive business resources sent by the first server, and the specified application will then log in.

[0668] In addition, the first client can also respond to the user's actions on the login page of the second client by determining whether it stores an authorization token corresponding to the user's account identifier on the second client. If yes, it sends a resource acquisition request carrying the account identifier and the authorization token to the proxy server; otherwise, it sends a passwordless login request carrying the account identifier to the proxy server.

[0669] Specifically, the first client can determine whether the cookie data contains an authorization token corresponding to the user's account identifier on the second client.

[0670] In one or more embodiments of this specification, in step S701, when the proxy server determines that the specified application supports passwordless login, the login page retrieval request can be sent to the first server corresponding to the specified application.

[0671] The first server can then receive the login page request and return the login page of the specified application to the first client.

[0672] The first client then displays the login page of the specified application. The user can then initiate a passwordless login operation through the login page of the specified application. In response to the user's operation, the first client sends a passwordless login request carrying the user's account identifier in the specified application to the first server.

[0673] The first server can then receive the passwordless login request, determine the authorization token corresponding to the account identifier, and send it to the first client.

[0674] The first client can request business resources by sending the account identifier and authorization token to the first server, such as by including them in a resource acquisition request.

[0675] After the authorization token is verified, the first server can then return the business resources of the specified application login status to the first client.

[0676] It should be noted that, in Figure 29In the passwordless login system shown, all data obtained by the proxy server is intercepted data. After the first client displays the login interface of the second client, the passwordless login request sent by the first client with the purpose of interacting with the second client is obtained by the proxy server and sent to the second client. The resource acquisition request generated by the first client is also sent with the purpose of being sent to the first server, and is obtained by the proxy server and sent to the first server. The account identifier and its corresponding authorization token sent by the second server to the second client are also sent with the purpose of being sent to the first client, and are obtained by the proxy server and forwarded to the first client.

[0677] Similarly, after receiving a resource acquisition request, the first server can obtain and forward the business resources specified by the application login status sent to the first client by the proxy server.

[0678] This instruction manual also provides Figure 29 The passwordless login system shown corresponds to a passwordless login method applied to browser clients, such as... Figure 30 As shown.

[0679] Figure 30 This diagram illustrates a passwordless login method provided in this specification, which includes the following steps:

[0680] S3200: Sends a request to the first server to retrieve the login page of the specified application.

[0681] S3202: Receive the login page corresponding to the second client sent by the proxy server. The login page is sent by the proxy server after obtaining the login page retrieval request and determining that the specified application does not support passwordless login.

[0682] S3204: In response to the user's operation on the login page, the proxy server sends a passwordless login request carrying the user's account identifier on the second client to the second client, causing the second client to display an authorization interface and respond to the user's authorization operation. The second client generates an authorization request based on the account identifier and forwards it to the third server through the second server, so that the third server determines the authorization token corresponding to the account identifier and sends it to the second client through the second server.

[0683] S3206: Based on the account identifier and its corresponding authorization token received from the second client through the proxy server, generate a resource acquisition request and send it to the first server through the proxy server;

[0684] S3208: Receive the service resources in the login state corresponding to the specified application sent by the first server. The service resources are sent by the first server after determining that the second client account corresponding to the account identifier of the specified application is logged in when the verification result of the authorization token sent by the third server is passed.

[0685] In addition, in one or more embodiments of this specification, in step S3204, when responding to the user's operation on the login page, when sending a passwordless login request carrying the user's account identifier on the second client through the proxy server, specifically, the browser client may, in response to the user's operation on the login page, determine whether an authorization token corresponding to the user's account identifier on the second client is stored.

[0686] If yes, a resource acquisition request carrying the account identifier and authorization token is sent to the proxy server. If no, a passwordless login request carrying the user's account identifier on the second client is sent to the second client through the proxy server.

[0687] Figure 30 For details of steps S3200 to S3208, please refer to the above. Figure 29 The relevant content will not be elaborated upon here.

[0688] This instruction manual also provides Figure 29 The passwordless login system shown corresponds to a passwordless login method applied to a proxy server, such as... Figure 31 As shown.

[0689] Figure 31 This diagram illustrates a passwordless login method provided in this specification, which includes the following steps:

[0690] S3300: Obtain the login page retrieval request for the specified application sent by the browser client to the first server.

[0691] S3302: When it is determined that the specified application does not support passwordless login, the login page corresponding to the second client is sent to the browser client.

[0692] S3304: Receive the passwordless login request sent by the browser client in response to the user's operation on the login page, carrying the user's account identifier on the second client, and forward it to the second client, so that the second client displays the authorization interface and responds to the user's authorization operation, generates an authorization request according to the account identifier, and forwards it to the third server through the second server.

[0693] S3306: Receive the account identifier and its corresponding authorization token sent by the second client, and forward it to the browser client. The authorization token is determined by the third server according to the authorization request and sent to the second client by the second server.

[0694] S3308: Receive the resource acquisition request sent by the browser client, which carries the account identifier and the authorization token, and forward it to the first server.

[0695] When the first server receives a verification result from the third server indicating that the authorization token has been verified, it determines the account of the second client corresponding to the account identifier in the specified application login and sends the business resources corresponding to the login status of the specified application to the browser client.

[0696] Figure 31 For details of steps S3300 to S3308, please refer to the above. Figure 29 The relevant content will not be elaborated upon here.

[0697] This instruction manual also provides Figure 29 The passwordless login system shown here, and the corresponding passwordless login method, are applied to the first server, such as... Figure 32 As shown.

[0698] Figure 32 This diagram illustrates a passwordless login method provided in this specification, which includes the following steps:

[0699] S3400: Receives an account identifier and authorization token carried in a resource acquisition request sent by a browser client through a proxy server. The authorization token is determined by a third server based on an authorization request carrying the account identifier forwarded by a second client through the second server.

[0700] Specifically, the authorization request is generated by the second client based on the passwordless login request forwarded by the browser client through the proxy server, carrying the account identifier, displaying the authorization interface, and responding to the user's authorization operation. The passwordless login request is determined by the browser client in response to the user's operation on the login page returned by the proxy server to the second client when the proxy server determines that the specified application corresponding to the login page requested by the browser client does not support passwordless login.

[0701] S3402: Send the account identifier and the authorization token to the third server in the verification request.

[0702] S3404: Receive the verification result returned by the third server according to the verification request, and when the verification result is passed, determine to log in the account of the second client corresponding to the account identifier on the login page of the specified application.

[0703] S3406: Send the business resources corresponding to the login status of the specified application to the browser client.

[0704] Figure 32 For details of steps S3400 to S3406, please refer to the above. Figure 29 The relevant content will not be elaborated upon here.

[0705] This instruction manual also provides Figure 29 The passwordless login system shown here, and the corresponding passwordless login method, are applied to the second client, such as... Figure 33 As shown.

[0706] Figure 33 This diagram illustrates a passwordless login method provided in this specification, which includes the following steps:

[0707] S3500: Receive a passwordless login request sent by the browser client through the proxy server, which carries the user's account identifier on the second client. The passwordless login request is determined by the browser client sending a request to the proxy server to obtain the login page of the specified application, and receiving the login page corresponding to the second client returned by the proxy server, in response to the user's operation on the login page.

[0708] S3502: Display the authorization interface and respond to the user's authorization operation, generate an authorization request based on the account identifier, and send it to the third server through the second server, so that the third server can determine the authorization token corresponding to the account identifier.

[0709] S3504: Receive the account identifier and its corresponding authorization token sent by the third server through the second server, and forward it to the browser client through the proxy server, so that the browser client carries it in the resource acquisition request and sends it to the first server through the proxy server, and obtains business resources through the first server.

[0710] The first server sends the account identifier and authorization token to the third server in the verification request. When the verification result returned by the third server is passed, the first server determines the account of the second client corresponding to the account identifier in the specified application and sends the business resources corresponding to the login status of the specified application to the browser client.

[0711] Figure 33For details of steps S3500 to S3504, please refer to the above. Figure 29 The relevant content will not be elaborated upon here.

[0712] This instruction manual also provides Figure 29 The passwordless login system shown here, and the corresponding passwordless login method, are applied to the second server, such as... Figure 34 As shown.

[0713] Figure 34 This diagram illustrates a passwordless login method provided in this specification, which includes the following steps:

[0714] S3600: Receives an authorization request sent by the second client carrying the user's account identifier on the second client, and forwards it to the third server. The authorization request is a passwordless login request carrying the account identifier forwarded by the second client through the proxy server based on the browser client. The server displays the authorization interface and responds to the user's authorization operation, and is generated based on the account identifier.

[0715] Specifically, the passwordless login request is determined by the proxy server after it determines that the specified application corresponding to the login page requested by the browser client does not support passwordless login. This is the browser client's response to the user's operation on the login page of the second client returned by the proxy server.

[0716] S3602: Receive the account identifier and its corresponding authorization token sent by the third server, wherein the authorization token is determined by the third server based on the authorization request.

[0717] S3604: The account identifier and its corresponding authorization token are sent to the browser client through the second client and the proxy server, so that the browser client carries the resource acquisition request and sends it to the first server through the proxy server, and obtains business resources through the first server.

[0718] When the first server receives a verification result from the third server indicating that the authorization token has been verified, it determines the account of the second client corresponding to the account identifier in the specified application login and sends the business resources corresponding to the login status of the specified application to the browser client.

[0719] Figure 34 For details of steps S3600 to S3604, please refer to the above. Figure 29 The relevant content will not be elaborated upon here.

[0720] This instruction manual also provides Figure 29 The passwordless login system shown corresponds to a passwordless login method applied to a third-party server, such as... Figure 35 As shown.

[0721] Figure 35 This diagram illustrates a passwordless login method provided in this specification, which includes the following steps:

[0722] S3700: Receive an authorization request sent by the second client through the second server, carrying the user's account identifier on the second client; the authorization request is generated by the second client based on a passwordless login request forwarded by the browser client through a proxy server, carrying the account identifier.

[0723] S3702: Determine the authorization token corresponding to the account identifier, and the correspondence between the account identifier and the authorization token.

[0724] S3704: The account identifier and the determined authorization token are sent to the browser client through the second server, the second client, and the proxy server, so that the browser client generates a resource acquisition request and sends it to the first server through the proxy server.

[0725] S3706: Receive a verification request sent by the first server based on the resource acquisition request, carrying the account identifier and the authorization token.

[0726] S3708: Verify according to the stored correspondence and the verification request, and return the verification result to the first server. When the verification result is passed, the first server determines the account of the second client corresponding to the account identifier in the specified application login, and sends the business resources corresponding to the login status of the specified application to the browser client.

[0727] Specifically, the passwordless login request is determined by the browser client in response to the user's operation on the login page of the second client returned by the proxy server after the proxy server determines that the specified application corresponding to the login page requested by the browser client does not support passwordless login.

[0728] Figure 35 For details of steps S3700 to S3708, please refer to the above. Figure 29 The relevant content will not be elaborated upon here.

[0729] This manual also provides a passwordless login device for use in browser clients, such as... Figure 36 As shown. The device includes:

[0730] The first request module 3800 is used to send a request to the first server to obtain the login page of the specified application;

[0731] The first receiving module 3801 is used to receive the login page corresponding to the second client sent by the proxy server. The login page is sent by the proxy server after obtaining the login page acquisition request and determining that the specified application does not support passwordless login.

[0732] The response module 3802 is used to respond to the user's operation on the login page, and send a passwordless login request carrying the user's account identifier on the second client to the second client through the proxy server, so that the second client displays the authorization interface and responds to the user's authorization operation, generates an authorization request according to the account identifier, and forwards it to the third server through the second server, so that the third server determines the authorization token corresponding to the account identifier and sends it to the second client through the second server;

[0733] The second request module 3803 is used to generate a resource acquisition request based on the account identifier and its corresponding authorization token sent by the second client through the proxy server and send it to the first server through the proxy server.

[0734] The second receiving module 3804 is used to receive the service resources in the login state corresponding to the specified application sent by the first server. The service resources are sent by the first server after determining that the account of the second client corresponding to the account identifier of the specified application is logged in when the verification result of the authorization token sent by the third server is passed.

[0735] This manual also provides a passwordless login device for use with proxy servers, such as... Figure 37 As shown. The device includes:

[0736] The acquisition module 3900 is used to acquire the login page acquisition request of the specified application sent by the browser client to the first server;

[0737] The first sending module 3901 is used to send the login page corresponding to the second client to the browser client when it is determined that the specified application does not support passwordless login;

[0738] The first forwarding module 3902 is used to receive the passwordless login request sent by the browser client in response to the user's operation on the login page, which carries the user's account identifier on the second client, and forward it to the second client, so that the second client displays the authorization interface and responds to the user's authorization operation, generates an authorization request according to the account identifier, and forwards it to the third server through the second server;

[0739] The second forwarding module 3903 is used to receive the account identifier and its corresponding authorization token sent by the second client, and forward it to the browser client. The authorization token is determined by the third server according to the authorization request and sent to the second client by the second server.

[0740] The third forwarding module 3904 is used to receive a resource acquisition request sent by the browser client carrying the account identifier and the authorization token, and forward it to the first server; wherein, when the first server receives a verification result of the authorization token sent by the third server that the verification result is successful, it determines the account of the second client corresponding to the account identifier in the specified application login, and sends the business resources corresponding to the login status of the specified application to the browser client.

[0741] This manual also provides a passwordless login device, applied to the first server, such as... Figure 38 As shown. The device includes:

[0742] The first receiving module 4000 is used to receive the account identifier and authorization token carried in the resource acquisition request sent by the browser client through the proxy server. The authorization token is determined by the third server based on the authorization request carrying the account identifier forwarded by the second client through the second server.

[0743] The sending module 4001 is used to send the account identifier and the authorization token in the verification request to the third server;

[0744] The second receiving module 4002 is used to receive the verification result returned by the third server according to the verification request, and when the verification result is passed, determine to log in the account of the second client corresponding to the account identifier on the login page of the specified application;

[0745] The login module 4003 is used to send business resources corresponding to the login status of the specified application to the browser client; wherein, the authorization request is generated by the second client based on the account identifier, which is forwarded by the browser client through the proxy server and carries the account identifier, and displays the authorization interface and responds to the user's authorization operation; the passwordless login request is determined by the browser client in response to the user's operation on the login page of the second client returned by the proxy server when the proxy server determines that the specified application corresponding to the login page requested by the browser client does not support passwordless login.

[0746] This manual also provides a passwordless login device for use on a second client, such as... Figure 39 As shown. The device includes:

[0747] The first receiving module 4100 is used to receive a passwordless login request sent by a browser client through a proxy server, which carries the user's account identifier on the second client. The passwordless login request is determined by the browser client sending a request to the proxy server to obtain the login page of the specified application, and receiving the login page corresponding to the second client returned by the proxy server, in response to the user's operation on the login page.

[0748] The display module 4101 is used to display the authorization interface and respond to the user's authorization operation. It generates an authorization request based on the account identifier and sends it to the third server through the second server, so that the third server can determine the authorization token corresponding to the account identifier.

[0749] The second receiving module 4102 is used to receive the account identifier and its corresponding authorization token sent by the third server through the second server, and forward it to the browser client through the proxy server, so that the browser client carries it in the resource acquisition request and sends it to the first server through the proxy server, and acquires business resources through the first server; wherein, after the first server sends the account identifier and the authorization token in the verification request to the third server, when the verification result returned by the third server is passed, the first server determines the account of the second client corresponding to the account identifier in the specified application login, and sends the business resources in the login state corresponding to the specified application to the browser client.

[0750] This manual also provides a passwordless login device for use on a second server, such as... Figure 40 As shown. The device includes:

[0751] The first receiving module 4200 is used to receive an authorization request sent by the second client carrying the user's account identifier on the second client, and forward it to the third server. The authorization request is a passwordless login request carrying the account identifier forwarded by the second client through the proxy server based on the browser client. The authorization interface is displayed and the authorization operation is responded to by the user. The authorization request is generated based on the account identifier.

[0752] The second receiving module 4201 is used to receive the account identifier and its corresponding authorization token sent by the third server, wherein the authorization token is determined by the third server based on the authorization request;

[0753] The sending module 4202 is used to send the account identifier and its corresponding authorization token to the browser client through the second client and the proxy server, so that the browser client carries it in a resource acquisition request and sends it to the first server through the proxy server, and acquires business resources through the first server; wherein, the passwordless login request is determined by the browser client in response to the user's operation on the login page of the second client returned by the proxy server after the proxy server determines that the specified application corresponding to the login page requested by the browser client does not support passwordless login; the first server, when receiving the verification result of the authorization token sent by the third server as passed, determines that the account of the second client corresponding to the account identifier is logged in in the specified application, and sends the business resources in the login state corresponding to the specified application to the browser client.

[0754] This manual also provides a passwordless login device for use with third-party servers, such as... Figure 41 As shown. The device includes:

[0755] The first receiving module 4300 is used to receive an authorization request sent by the second client through the second server, carrying the user's account identifier on the second client; the authorization request is generated by the second client based on a passwordless login request forwarded by the browser client through a proxy server, carrying the account identifier;

[0756] The authorization module 4301 is used to determine the authorization token corresponding to the account identifier, and the correspondence between the account identifier and the authorization token;

[0757] The sending module 4302 is used to send the account identifier and the determined authorization token to the browser client through the second server, the second client and the proxy server, so that the browser client generates a resource acquisition request and sends it to the first server through the proxy server.

[0758] The second receiving module 4303 is used to receive a verification request sent by the first server in accordance with the resource acquisition request, carrying the account identifier and the authorization token;

[0759] The verification module 4304 is used to perform verification based on the stored correspondence and the verification request, and return the verification result to the first server. When the verification result is successful, the first server determines the account of the second client corresponding to the account identifier in the specified application login, and sends the business resources corresponding to the login status of the specified application to the browser client. The passwordless login request is determined by the browser client in response to the user's operation on the login page of the second client returned by the proxy server after the proxy server determines that the specified application corresponding to the login page requested by the browser client does not support passwordless login.

[0760] This specification also provides a computer-readable storage medium storing a computer program that can be used to execute the above-described... Figures 30-35 The passwordless login method shown.

[0761] This instruction manual also provides Figure 42 The diagram shows a schematic structural representation of the electronic device. Figure 42 As shown, at the hardware level, the electronic device includes a processor, internal bus, network interface, memory, and non-volatile memory, and may also include other hardware required for business operations. The processor reads the corresponding computer program from the non-volatile memory into memory and then runs it to implement the aforementioned passwordless login system or method. Of course, in addition to software implementation, this specification does not exclude other implementation methods, such as logic devices or a combination of hardware and software, etc. That is to say, the execution subject of the following processing flow is not limited to individual logic units, but can also be hardware or logic devices.

[0762] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many methodological improvements today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that a methodological improvement cannot be implemented using hardware physical modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program and "integrate" a digital system onto a PLD themselves, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0763] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, ASICs, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0764] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0765] For ease of description, the above devices are described in terms of function, divided into various units. Of course, in implementing this specification, the functions of each unit can be implemented in one or more software and / or hardware components.

[0766] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0767] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0768] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0769] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0770] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0771] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0772] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0773] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0774] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this specification may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0775] This specification can be described in the general context of computer-executable instructions that are executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. This specification can also be practiced in distributed computing environments, where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0776] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0777] The above description is merely an embodiment of this specification and is not intended to limit this specification. Various modifications and variations can be made to this specification by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims of this specification.

Claims

1. A passwordless login system, the system comprising: A first client and a first server corresponding to the first client, a second client and a second server corresponding to the second client, a third client and a third server corresponding to the third client; wherein: The third client is used to send a passwordless login request to the third server; receive the account identifier and authorization token sent by the third server, and send them to the first client; The third server is configured to receive a passwordless login request sent by the third client, determine the account identifier of the user corresponding to the third client on the second client, and send the account identifier to the second server in the passwordless login request; receive the account identifier and authorization token sent by the second server, store the correspondence between the account identifier and the authorization token, and send the account identifier and the authorization token to the third client; receive a first verification request sent by the first server carrying the account identifier and the authorization token, perform verification according to the stored account identifier, the authorization token and the first verification request, and return a first verification result of the authorization token to the first server; The second server is configured to receive the passwordless login request sent by the third server and forward it to the second client; receive the authorization request sent by the second client carrying the account identifier, generate an authorization token corresponding to the account identifier, and send the authorization token and the account identifier to the third server; The second client is used to receive the passwordless login request sent by the second server, display the authorization interface and respond to the user's authorization operation, and generate an authorization request based on the account identifier and send it to the second server; The first client is configured to receive an account identifier and authorization token sent by the third client, and in response to the login request input by the user, forward the account identifier and authorization token to the first server corresponding to the first client; and receive service resources sent by the first server; The first server is configured to receive the account identifier and authorization token sent by the first client, and send them to the third server in a first verification request; receive the first verification result of the authorization token sent by the third server, and when the first verification result is passed, determine that the account corresponding to the account identifier is logged in on the corresponding first client, and send the business resources of the account corresponding to the account identifier being logged in on the corresponding first client to the corresponding first client.

2. The system as described in claim 1, wherein the second server is further configured to receive an authorization request carrying the account identifier sent by the second client, generate an authorization token corresponding to the account identifier, store the correspondence between the account identifier and the authorization token, and send the authorization token and the account identifier to the second client; receive a second verification request sent by the third server, perform verification according to the stored correspondence and the second verification request, and return a second verification result of the authorization token to the third server; The second client is also configured to receive the authorization token and the account identifier sent by the second server, and forward them to the third server; The third server is further configured to receive the account identifier and authorization token sent by the second client, and send them to the second server in a second verification request; receive the second verification result of the authorization token sent by the second server, and when the second verification result is passed, store the correspondence between the account identifier and the authorization token, and send the account identifier and the authorization token to the third client.

3. The system as described in claim 1 or 2, wherein the first client and the third client are clients within the same terminal, there are multiple first clients, there are multiple first servers, and each first client corresponds to one first server.

4. A passwordless login method, applied to a first client, the method comprising: Receive account identifiers and authorization tokens sent by third-party clients; In response to a login request entered by the user, the account identifier and the authorization token are forwarded to the first server corresponding to the first client, so that the first server sends the account identifier and the authorization token to the third server in the first verification request; When the first verification result returned by the third server to the first server is passed, the service resources sent by the first server are received. Wherein: the authorization token corresponding to the account identifier is generated by the second server based on the user's authorization operation on the authorization interface of the second client, and sent to the third client. The authorization interface is generated by the second client based on the third server and the passwordless login request of the third client forwarded by the second server.

5. A passwordless login method, applied to a first server, the method comprising: Receives an account identifier and authorization token sent by the first client corresponding to itself, wherein the account identifier and authorization token are sent from the third client to the first client; The account identifier and the authorization token are sent to the third server in the first verification request; Receive the first verification result of the authorization token sent by the third server, and when the first verification result is passed, determine that the account corresponding to the account identifier is logged in on the corresponding first client, and send the business resources of the account corresponding to the account identifier being logged in on the corresponding first client to the corresponding first client; The authorization token corresponding to the account identifier is generated by the second server according to the authorization request and sent to the third client. The authorization request is generated by the second client based on the user's authorization operation on the authorization interface. The authorization interface is generated by the second client based on the third server and the passwordless login request of the third client forwarded by the second server.

6. A passwordless login method, applied to a second client, the method comprising: Receive a passwordless login request sent by the second server, carrying the account identifier; Display the authorization interface; In response to the user's authorization operation, an authorization request is generated based on the account identifier and sent to the second server, causing the second server to generate an authorization token corresponding to the account identifier. The account identifier and the authorization token are then sent to the first client through a third server and a third client. The first client then performs passwordless login through the first server based on the authorization token corresponding to the account identifier. The passwordless login request is sent from the third client to the second client through the third server and the second server; the first server sends the account identifier and the authorization token to the third server in the first verification request. The system receives the first verification result of the authorization token sent by the third server, and when the first verification result is successful, determines that the account corresponding to the account identifier is logged in on the corresponding first client, and sends the business resources of the account corresponding to the account identifier being logged in on the corresponding first client to the corresponding first client.

7. A passwordless login method applied to a second server, the method comprising: Receive a passwordless login request carrying an account identifier sent by a third server; wherein, the third server receives the passwordless login request from a third client; The passwordless login request is forwarded to the second client; Receive the authorization request carrying the account identifier sent by the second client, and generate an authorization token corresponding to the account identifier; The authorization token and the account identifier are sent to the third server, which stores the correspondence between the account identifier and the authorization token. Upon receiving a first verification request from the first server, the third server verifies the stored authorization token and account identifier and returns a first verification result for the authorization token to the first server. The account identifier and the authorization token are then sent to the first client via the third server and the third client. The first client performs passwordless login via the first server using the authorization token corresponding to the account identifier. The first server determines whether the first client can log in without a password based on the first verification result.

8. A passwordless login method, applied to a third-party client, the method comprising: Send a passwordless login request to the third server, so that the third server carries the account identifier of the user corresponding to the third client in the passwordless login request and sends it to the second client through the second server, so that the second client responds to the user's authorization operation and generates an authorization request; Receive the account identifier and authorization token sent by the third server, wherein the authorization token is generated by the second server based on the authorization request sent by the second client and sent to the third server; The account identifier and the authorization token are sent to the first client, so that the first client responds to the login request entered by the user and forwards the account identifier and the authorization token to the first server; Specifically, the first server determines whether the first client can log in without a password based on the first verification result of the authorization token sent by the third server.

9. A passwordless login method applied to a third-party server, the method comprising: Receive passwordless login requests sent by third-party clients; The user's account identifier corresponding to the third client is determined on the second client, and the account identifier is carried in the passwordless login request and forwarded to the second client through the second server, so that the second client responds to the user's authorization operation, generates an authorization request and sends it to the second server; The system receives the account identifier and authorization token sent by the second server, stores the correspondence between the account identifier and the authorization token, and forwards it to the first client through the third client, so that the first client sends it to the first server. The authorization token is generated by the second server according to the authorization request. The system receives a first verification request sent by the first server, which carries the account identifier and the authorization token. It performs verification based on the stored account identifier, the authorization token, and the first verification request, and returns a first verification result of the authorization token to the first server. The first server determines whether the first client can log in without a password based on the first verification result of the authorization token.

10. A passwordless login device, applied to a first client, the device comprising: The first receiving module is used to receive the account identifier and authorization token sent by the third client; The response module is used to respond to the login request input by the user, forward the account identifier and the authorization token to the first server corresponding to the first client, so that the first server sends the account identifier and the authorization token to the third server in the first verification request; The second receiving module is used to receive service resources sent by the first server when the first verification result returned by the third server to the first server is passed; wherein: the authorization token corresponding to the account identifier is generated by the second server based on the authorization operation of the user on the authorization interface of the second client and sent to the third client, and the authorization interface is generated by the second client based on the third server and the passwordless login request of the third client forwarded by the second server.

11. A passwordless login device, applied to a first server, the device comprising: The receiving module is used to receive the account identifier and authorization token sent by the first client corresponding to itself, wherein the account identifier and authorization token are sent from the third client to the first client; The sending module is used to send the account identifier and the authorization token to the third server in the first verification request; The login module is used to receive the first verification result of the authorization token sent by the third server, and when the first verification result is successful, determine that the account corresponding to the account identifier is logged in on the corresponding first client, and send the business resources of the account corresponding to the account identifier to the corresponding first client, wherein the first client is in a logged-in state; wherein, the authorization token corresponding to the account identifier is generated by the second server according to the authorization request and sent to the third client, the authorization request is generated by the second client according to the user's authorization operation on the authorization interface, and the authorization interface is generated by the second client based on the third server and the passwordless login request of the third client forwarded by the second server.

12. A passwordless login device, applied to a second client, the device comprising: The receiving module is used to receive passwordless login requests carrying account identifiers sent by the second server; The display module is used to show the authorization interface; A response module is used to respond to a user's authorization operation. It generates an authorization request based on the account identifier and sends it to the second server. This causes the second server to generate an authorization token corresponding to the account identifier. The second server then sends the account identifier and the authorization token to the first client via a third server and a third client. The first client then performs passwordless login via the first server using the authorization token corresponding to the account identifier. The passwordless login request is sent from the third client to the second client via the third server and the second server. The first server sends the account identifier and the authorization token to the third server in a first verification request. The system receives the first verification result of the authorization token sent by the third server, and when the first verification result is successful, determines that the account corresponding to the account identifier is logged in on the corresponding first client, and sends the business resources of the account corresponding to the account identifier being logged in on the corresponding first client to the corresponding first client.

13. A passwordless login device, applied to a second server, the device comprising: The receiving module is used to receive passwordless login requests carrying account identifiers sent by a third server; The first sending module is used to forward the passwordless login request to the second client; The authorization module is used to receive an authorization request carrying the account identifier sent by the second client and generate an authorization token corresponding to the account identifier; wherein, the third server receives the passwordless login request from the third client; The second sending module is used to send the authorization token and the account identifier to the third server, so that the third server stores the correspondence between the account identifier and the authorization token, and when receiving the first verification request sent by the first server, verifies the authorization token and the account identifier according to the stored information, and returns the first verification result of the authorization token to the first server; the account identifier and the authorization token are sent to the first client through the third server and the third client, and the first client performs passwordless login through the first server according to the authorization token corresponding to the account identifier; The first server determines whether the first client can log in without a password based on the first verification result.

14. A passwordless login device, applied to a third client, the device comprising: The first sending module is used to send a passwordless login request to the third server, so that the third server carries the account identifier of the user corresponding to the third client in the passwordless login request and sends it to the second client through the second server, so that the second client responds to the user's authorization operation and generates an authorization request; The receiving module is used to receive the account identifier and authorization token sent by the third server, wherein the authorization token is generated by the second server according to the authorization request sent by the second client and sent to the third server; The second sending module is used to send the account identifier and the authorization token to the first client, so that the first client, in response to the login request input by the user, forwards the account identifier and the authorization token to the first server; wherein, the first server determines whether the first client can log in without a password based on the first verification result of the authorization token sent by the third server.

15. A passwordless login device, applied to a third-party server, the device comprising: The first receiving module is used to receive passwordless login requests sent by a third client; The sending module is used to determine the account identifier of the user corresponding to the third client on the second client, and carry the account identifier in the passwordless login request, and forward it to the second client through the second server, so that the second client responds to the user's authorization operation, generates an authorization request and sends it to the second server; The second receiving module is used to receive the account identifier and authorization token sent by the second server, store the correspondence between the account identifier and the authorization token, and forward it to the first client through the third client, so that the first client sends it to the first server. The authorization token is generated by the second server according to the authorization request. The verification module is used to receive a first verification request sent by the first server, which carries the account identifier and the authorization token, perform verification based on the stored account identifier, the authorization token and the first verification request, and return a first verification result of the authorization token to the first server; wherein, the first server determines whether the first client can log in without a password based on the first verification result of the authorization token.

16. A computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described in any one of claims 4 to 9.

17. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described in any one of claims 4 to 9.

Images