Method and apparatus for implementing one-key login service

Abstract

The embodiment of the present specification provides an implementation method and device of one-key login service. In the method, before obtaining the token, the application client sends the fingerprint information of the terminal device currently running the application client to the operator server, and the operator server calculates a first calculation value according to the fingerprint information; after obtaining the token, the application client sends the first calculation value and the fingerprint information of the terminal device currently running the application client to the application server; the application server calculates a second calculation value by using the shared symmetric key previously agreed with the operator server and the obtained fingerprint information of the terminal device currently running the application client, and if the first calculation value is the same as the second calculation value, the one-key login verification is successful, otherwise the one-key login verification fails. The embodiment of the present specification can improve the security of the one-key login service, and can avoid the leakage of user privacy data.

Description

Technical Field

[0001] This specification relates to network information technology in one or more embodiments, and more particularly to a method and apparatus for implementing one-click login services. Background Technology

[0002] With the rapid development of the internet, a wide variety of business applications have emerged. Users only need to download the corresponding application client (APP) to their terminal device, register and log in through the application client, and then enjoy the corresponding business applications, such as watching movies or purchasing goods.

[0003] To improve user convenience, a new method for logging into apps has emerged: one-click login. In one-click login, the application client's terminal device, such as a mobile phone, has an authentication SDK pre-embedded. When a user requests login, this SDK communicates with the carrier's server to collect the user's phone number. After obtaining the user's authorization, the application client obtains a token for the API call and passes the token to the application server. The application server then uses the token to retrieve the currently authorized user's phone number and other information from the carrier's server, thus completing the app login process.

[0004] See Figure 1 In the one-click login service, users only need to click the relevant "one-click login" button, without having to enter their mobile phone number, username, password, or SMS verification code. Therefore, it allows users to complete the registration and login process more conveniently and quickly, reducing the process that may have taken about 20 seconds to about 2 seconds, which brings great convenience to users.

[0005] However, the current one-click login service has relatively low security, which can easily lead to the leakage of user privacy data. Therefore, a more secure one-click login service implementation method is needed. Summary of the Invention

[0006] This specification describes one or more embodiments of a one-click login service, which can improve the security of the one-click login service.

[0007] Based on the first aspect, a method for implementing the one-click login service is provided, including:

[0008] Before obtaining the token, send the fingerprint information of the terminal device currently running the application client to the operator's server;

[0009] Receive the first calculated value sent by the operator's server;

[0010] After obtaining the token sent by the operator's server, a one-click login confirmation request is sent to the application server. The one-click login confirmation request carries the token, the first calculation value, and the fingerprint information of the terminal device currently running the application client.

[0011] If the login authorization is received from the application server, one-click login will be successful.

[0012] The step of sending the fingerprint information of the terminal device currently running the application client to the operator server includes: sending the fingerprint information of the terminal device currently running the application client to the operator server in a one-click login request or an authentication request.

[0013] And / or,

[0014] The step of obtaining the first calculated value sent by the operator server includes: receiving an authentication pass message sent by the operator server carrying a token and the first calculated value, and obtaining the first calculated value from the authentication pass message.

[0015] The fingerprint information of the terminal device includes at least one of the following: the intranet IP address of the terminal device, the identifier of the local area network used by the terminal device, and the identification code of the terminal device.

[0016] According to the second aspect, a method for implementing the one-click login service is provided, including:

[0017] Receive a one-click login confirmation request carrying a token from the application client; the one-click login confirmation request also carries a first calculation value and the fingerprint information of the terminal device currently running the application client;

[0018] The second operation value is calculated using the shared symmetric key agreed upon with the operator's server in advance and the fingerprint information of the terminal device currently running the application client obtained from the one-click login confirmation request.

[0019] Determine whether the first operation value carried in the one-click login confirmation request is the same as the calculated second operation value. If they are the same, the one-click login verification is successful; otherwise, the one-click login verification fails.

[0020] The fingerprint information of the terminal device includes at least one of the following: the terminal device's internal network IP address, the identifier of the local area network used by the terminal device, and the terminal device's identification code.

[0021] The calculation includes: performing hash calculations;

[0022] And / or,

[0023] The one-click login confirmation request also carries the IP address of the terminal device currently running the application client and the APP ID of the application client; correspondingly, the calculation using the shared symmetric key pre-agreed with the operator server and the fingerprint information of the terminal device currently running the application client obtained from the one-click login confirmation request includes:

[0024] Using a shared symmetric key pre-agreed with the operator's server, the token obtained from the one-click login confirmation request, the fingerprint information of the terminal device currently running the application client, the IP address of the terminal device, and the APP ID are calculated.

[0025] According to the third aspect, a method for implementing the one-click login service is provided, including:

[0026] Before issuing a token to the application client, obtain the fingerprint information of the terminal device currently running the application client from the application client;

[0027] After generating the token, the first operation value is calculated using the shared symmetric key agreed upon with the application server in advance and the fingerprint information of the terminal device currently running the application client;

[0028] The generated first calculated value is sent to the application client.

[0029] The step of obtaining the fingerprint information of the terminal device currently running the application client, sent by the application client, includes:

[0030] When receiving a one-click login request from the application client, obtain the fingerprint information of the terminal device currently running the application client from the one-click login request;

[0031] or,

[0032] In the authentication request sent by the application client to request a token, the fingerprint information of the terminal device currently running the application client is obtained from the authentication request.

[0033] The calculation includes: performing hash calculation;

[0034] And / or,

[0035] The method further includes: receiving an authentication request from an application client, and obtaining the IP address of the terminal device and the APP ID of the application client from the authentication request; correspondingly, the calculation using a pre-agreed shared symmetric key with the application server, a generated token, and the fingerprint information of the terminal device currently running the application client includes:

[0036] Using a shared symmetric key pre-agreed with the application server, the generated token, the fingerprint information of the terminal device currently running the application client, the IP address of the terminal device, and the APP ID are calculated.

[0037] According to the fourth aspect, a device for implementing the one-click login service is provided, the device comprising:

[0038] The first fingerprint information sending module is configured to send the fingerprint information of the terminal device currently running the application client to the operator server before obtaining the token;

[0039] The calculation value acquisition module is configured to obtain the first calculation value sent by the operator's server.

[0040] After obtaining the token sent by the operator server, the second fingerprint information sending module sends a one-click login confirmation request to the application server. The one-click login confirmation request carries the token, the first calculation value, and the fingerprint information of the terminal device currently running the application client.

[0041] The login execution module is configured to log in successfully with one click if it receives login authorization from the application server.

[0042] According to the fifth aspect, a device for implementing the one-click login service is provided, the device comprising:

[0043] The first calculation value acquisition module is configured to receive a one-click login confirmation request carrying a token sent by the application client; the one-click login confirmation request also carries the first calculation value and the fingerprint information of the terminal device currently running the application client;

[0044] The second calculation value acquisition module is configured to use a shared symmetric key pre-agreed with the operator server and the fingerprint information of the terminal device currently running the application client obtained from the one-click login confirmation request to calculate the second calculation value.

[0045] The verification module is configured to determine whether the first operation value carried in the one-click login confirmation request is the same as the calculated second operation value. If they are the same, the one-click login verification is successful; otherwise, the one-click login verification fails.

[0046] According to the sixth aspect, a device for implementing the one-click login service is provided, the device comprising:

[0047] The first fingerprint information acquisition module is configured to obtain the fingerprint information of the terminal device currently running the application client sent by the application client before sending the token to the application client;

[0048] The first operation value calculation module is configured to calculate the first operation value after generating the token by using the shared symmetric key agreed upon with the application server in advance and the fingerprint information of the terminal device currently running the application client.

[0049] The first operation value sending module sends the generated first operation value to the application client.

[0050] According to a seventh aspect, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method described in any embodiment of this specification.

[0051] The combination of one or more embodiments in this specification has at least the following beneficial effects:

[0052] 1. Based on whether the fingerprint information of the terminal device sent by the application client to the carrier server and the application server is the same at different stages (the different stages refer to the first stage before the carrier server sends the token to the application client, and the second stage after the carrier server sends the token to the application client), and thus whether the calculated first and second operation values ​​are the same, it is determined whether the one-click login confirmation request was sent by the attacker's terminal device X. This avoids the application server providing the application service corresponding to the application client to the attacker's terminal device X, thereby improving security.

[0053] 2. Server-side signature verification can be performed between the application server and the carrier server, thereby further ensuring the legitimacy of the application server and the carrier server and further improving the security of the one-click login service.

[0054] 3. The application server and the carrier server have agreed to share a symmetric key. This means the shared symmetric key used to calculate the operation is stored on the server side, not on the application client or terminal device, thus improving security. Attached Figure Description

[0055] To more clearly illustrate the technical solutions in the embodiments or prior art of this specification, the drawings used in the description of the embodiments or prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0056] Figure 1 This is a diagram illustrating one-click login functionality.

[0057] Figure 2This is a schematic diagram of the system architecture used in one embodiment of this specification.

[0058] Figure 3 This is a flowchart illustrating a method for implementing one-click login functionality in an application client, as described in one embodiment of this specification.

[0059] Figure 4 This is a flowchart illustrating an embodiment of the method for implementing one-click login in an application server, as described in this specification.

[0060] Figure 5 This is a flowchart illustrating a method for implementing one-click login service in a carrier server, as described in one embodiment of this specification.

[0061] Figure 6 This is a flowchart illustrating the information interaction between the operator server, application client, and application server in one embodiment of this specification to implement a one-click login service.

[0062] Figure 7 This is a schematic diagram of the structure of a device for implementing the one-click login service in one embodiment of this specification.

[0063] Figure 8 This is a schematic diagram of the structure of a device for implementing the one-click login service in another embodiment of this specification.

[0064] Figure 9 This is a schematic diagram of the structure of the device for implementing the one-click login service in another embodiment of this specification. Detailed Implementation

[0065] The solution provided in this specification will now be described with reference to the accompanying drawings.

[0066] To facilitate understanding of the methods provided in this manual, the system architecture involved and applicable to this manual is first described. For example... Figure 2 As shown, the system architecture mainly includes three network nodes: application client, application server, and carrier server.

[0067] The application client is installed and runs on the terminal device, which can include, but is not limited to, smart mobile terminals, smart home devices, network devices, wearable devices, smart medical devices, and PCs (personal computers). Smart mobile terminals can include mobile phones, tablets, laptops, PDAs (personal digital assistants), and connected cars. Smart home devices can include smart appliances such as smart TVs, smart air conditioners, smart water heaters, smart refrigerators, and smart air purifiers. Smart home devices can also include smart door locks, smart sockets, smart lights, and smart cameras. Network devices can include switches, wireless access points (APs), and servers. Wearable devices can include smartwatches, smart glasses, smart bracelets, virtual reality devices, augmented reality devices, and mixed reality devices (devices that support both virtual and augmented reality). Smart medical devices can include smart thermometers, smart blood pressure monitors, and smart blood glucose meters.

[0068] Application clients can be various types of applications, including but not limited to payment applications, multimedia playback applications, map applications, text editing applications, financial applications, browser applications, instant messaging applications, and so on.

[0069] A carrier server refers to the server-side equipment provided by a network service provider. It can be a single server or a cluster of servers. Carrier servers are responsible for providing network services to various applications, such as security authentication and providing mobile phone numbers for one-click login.

[0070] An application server is a server specifically designed for a particular application, providing corresponding application services to application clients. For example, for an application client like Alipay, the application server is the server that provides Alipay services.

[0071] It should be understood that Figure 2 The number of application clients, application servers, and carrier servers shown is merely illustrative. Any number can be selected and deployed as needed.

[0072] See Figure 2 Application clients, application servers, and carrier servers interact via a network. This network can include various connection types, such as wired and wireless communication links or fiber optic cables.

[0073] Because the implementation method of the one-click login service provided in this manual involves Figure 2 The three types of network nodes shown below will be explained in different embodiments below, which will illustrate the processing of the operator server, application client, and application server in the one-click login service.

[0074] First, let's explain how the application client handles the one-click login service.

[0075] Figure 3 This is a flowchart illustrating a method for implementing one-click login functionality in an application client, as described in one embodiment of this specification. See also... Figure 3 The method includes:

[0076] Step 301: Before obtaining the token, the application client sends the fingerprint information of the terminal device currently running the application client to the operator server; the fingerprint information of different terminal devices is different.

[0077] Step 303: The application client receives the first calculated value sent by the operator's server.

[0078] Step 305: After obtaining the token sent by the operator's server, the application client sends a one-click login confirmation request to the application server. The one-click login confirmation request carries the token, the first calculation value, and the fingerprint information of the terminal device currently running the application client.

[0079] Step 307: If the application client receives the login authorization from the application server, then one-click login is successful.

[0080] In existing one-click login services, situations like the following can occur: An attacker frequently eavesdrops on and attacks the link from the carrier's server to the application client, thereby stealing the token issued by the carrier's server to the application client using their own terminal device X. The attacker can then impersonate the legitimate terminal device Y where the application client resides, sending the token to the application server. Because the token used is correct, the application server can obtain the phone number of terminal device Y from the carrier's server. This leads the application server to mistakenly believe that the terminal device X sending the token is indeed terminal device Y, thus identifying the attacker as the legitimate user of the application client. Consequently, the server provides the attacker with corresponding application services, such as playing videos that only legitimate users have permission to view or completing money transfers, posing security risks to the user and potentially leading to the leakage of user privacy data.

[0081] According to the above Figure 3 The process shown illustrates that the one-click login service executed in the application client incorporates a calculation using the fingerprint information of the terminal device, which is then used for verification. Because fingerprint information differs between different terminal devices, if the attacker does not impersonate legitimate terminal device Y using terminal device X, then... Figure 3In the process shown, at different stages (the first stage before the operator server sends the token to the application client, and the second stage after the operator server sends the token to the application client), the fingerprint information of the terminal device sent by the application client to both the operator server and the application server is the same. Therefore, the first calculated value generated by the operator server and the second calculated value generated by the application server are the same. Conversely, if the above-mentioned situation occurs where an attacker uses terminal device X to impersonate a legitimate terminal device Y, then... Figure 3 In the process described, at different stages, the fingerprint information sent by the application client to the operator server and the application server for the terminal device are different. Therefore, the first calculated value generated by the operator server and the second calculated value generated by the application server are also different. The method in this embodiment utilizes this characteristic to perform verification, thereby verifying whether the one-click login confirmation request was sent by the attacker's terminal device X. This prevents the application server from providing application services corresponding to the application client to the attacker's terminal device X, thus improving security.

[0082] The following section, using specific implementation examples, discusses the processing by the carrier server and the application server. Figure 3 The processing procedure of the application client shown is explained in detail.

[0083] First, regarding step 301: Before obtaining the token, the application client sends the fingerprint information of the terminal device currently running the application client to the operator server.

[0084] In one embodiment of this specification, before the application client obtains a token from the operator server, the application client sends a one-click login request to the operator server to initiate a one-click login initialization operation with the operator server. Thus, one implementation of step 301 includes: the application client sending the fingerprint information of the terminal device currently running the application client to the operator server in the one-click login request, so that the operator server can obtain the fingerprint information of the terminal device currently running the application client.

[0085] In another embodiment of this specification, before the application client obtains the token from the operator server, the application client sends an authentication request to the operator server to request the token. Thus, another implementation of step 301 includes: the application client sending the fingerprint information of the terminal device currently running the application client in the authentication request to the operator server, so that the operator server can obtain the fingerprint information of the terminal device currently running the application client.

[0086] In yet another embodiment of this specification, another implementation of step 301 includes: before obtaining the token, the application client sends the fingerprint information of the terminal device currently running the application client to the operator server in other messages, such as newly defined messages.

[0087] In the embodiments of this specification, the fingerprint information of the terminal device can be any one type of information or a combination of several types of information that can identify the terminal device, such as the terminal device's internal network IP address, the identifier of the local area network used by the terminal device, the terminal device's identification code (such as IMEI, MEID or UDID), etc.

[0088] After executing step 301, the operator server obtains the fingerprint information of the terminal device running the application client before the first phase, i.e., before issuing the token to the application client. The operator server uses the shared symmetric key agreed upon with the application server in advance and the fingerprint information of the terminal device to perform calculations, such as hash calculations, to calculate the first operation value in the first phase.

[0089] In one embodiment of this specification, the verification of the one-click login service can be based on server-side integrity verification. That is, the operator server and the application server respectively perform integrity calculations, such as hash calculations, based on the terminal device's fingerprint information and various key parameters of this one-click login service, and then compare the two calculated values. Thus, in the operator server, the terminal device's IP address and the application client's APP ID are further obtained from the authentication request sent by the application client; correspondingly, the method for the operator server to calculate the first calculated value includes:

[0090] The operator server uses a shared symmetric key agreed upon with the application server in advance to calculate the first calculated value based on the generated token, the fingerprint information of the terminal device currently running the application client, the IP address of the terminal device, and the APP ID.

[0091] Afterwards, the operator's server sends the generated first calculated value to the application client.

[0092] Next, for step 303: the application client receives the first calculated value sent by the operator's server.

[0093] Here, the carrier server can send the generated first calculated value and the token together in an authentication pass message to the application client. Thus, in step 303, the application client receives the authentication pass message from the carrier server, which carries the token and the first calculated value, and obtains the first calculated value from the message.

[0094] Next, for step 305: After obtaining the token sent by the operator server, the application client sends a one-click login confirmation request to the application server. The one-click login confirmation request carries the token, the first calculation value, and the fingerprint information of the terminal device currently running the application client.

[0095] It should be noted that if no attacker steals the token using their terminal device X, then the terminal device currently running the application client in step 305 is the same terminal device as the terminal device currently running the application client in step 301. Therefore, the fingerprint information of the terminal device currently running the application client sent to the application server in step 305 is the same as the fingerprint information of the terminal device currently running the application client sent to the carrier server in step 301. Conversely, if an attacker steals the token using their terminal device X, then the terminal device currently running the application client in step 305 is a different terminal device from the terminal device currently running the application client in step 301. Therefore, the fingerprint information of the terminal device currently running the application client sent to the application server in step 305 is different from the fingerprint information of the terminal device currently running the application client sent to the carrier server in step 301.

[0096] After receiving the one-click login confirmation request, the application server obtains the token, the first calculated value, and the fingerprint information of the terminal device currently running the application client in the second stage (i.e., after the token is issued to the application client). The application server can use the shared symmetric key agreed upon with the operator server in advance and the obtained fingerprint information of the terminal device to perform calculations, such as hash calculations, to calculate the second calculated value in the second stage.

[0097] In one embodiment of this specification, the verification of the one-click login service can be based on server-side integrity verification. That is, the operator's server and the application server respectively perform integrity calculations, such as hash calculations, based on the terminal device's fingerprint information and various key parameters of this one-click login service, and then compare the two calculated values. Thus, the method for calculating the second calculated value in the application server includes:

[0098] The application server uses a shared symmetric key pre-agreed with the operator's server to calculate the second value based on the token obtained from the one-click login confirmation request, the fingerprint information of the terminal device currently running the application client, the IP address of the terminal device, and the APP ID.

[0099] Next, the application server determines whether the first computed value carried in the one-click login confirmation request is the same as the calculated second computed value.

[0100] If they are the same, it means that the terminal device currently running the application client in step 305 is the same terminal device as the terminal device currently running the application client in step 301. Their fingerprint information is the same, and no attacker has stolen the token. In this case, the one-click login verification is successful. The application server will obtain the mobile phone number of the terminal device from the operator server and then issue login authorization to the application client.

[0101] If they are different, it means that the terminal device running the application client in step 305 is not the same terminal device as the terminal device running the application client in step 301, and their fingerprint information is different. This indicates that an attacker has stolen the token, and the one-click login verification fails.

[0102] Next, for step 307: If the application client receives the login authorization sent by the application server, then one-click login is successful.

[0103] In the embodiments described in this specification, the application server and the carrier server agree to share a symmetric key. Therefore, the shared symmetric key used to calculate the operation value is stored on the server side, rather than in the application client or terminal device, thus improving security.

[0104] The following describes the relevant processing of the application server in the one-click login service in the embodiments of this specification.

[0105] Figure 4 This is a flowchart illustrating a method for implementing one-click login functionality in an application server, as described in one embodiment of this specification. See also... Figure 4 The method includes:

[0106] Step 401: The application server receives a one-click login confirmation request carrying a token from the application client; the one-click login confirmation request also carries the first calculation value and the fingerprint information of the terminal device currently running the application client.

[0107] For an understanding and explanation of step 401, please refer to the explanation of step 305 above.

[0108] The first calculated value is obtained by the operator's server using the fingerprint information of the terminal device running the application client, which was acquired in the first stage. In this step 401, the application server obtains the fingerprint information of the terminal device running the application client in the second stage.

[0109] Step 403: The application server uses the shared symmetric key agreed upon with the operator server in advance and the fingerprint information of the terminal device currently running the application client obtained from the one-click login confirmation request to calculate the second operation value.

[0110] Referring to the relevant description of step 305 above, the process of step 403 may include: the application server using the shared symmetric key agreed upon in advance with the operator server to calculate, for example, the token obtained from the one-click login confirmation request, the fingerprint information of the terminal device currently running the application client, the IP address of the terminal device, and the APP ID, to calculate the second operation value.

[0111] Step 405: The application server determines whether the first operation value carried in the one-click login confirmation request is the same as the calculated second operation value. If they are the same, the one-click login verification is successful; otherwise, the one-click login verification fails.

[0112] For an understanding and explanation of step 405, please refer to the explanation of step 305 above.

[0113] In step 405, if the one-click login verification is successful, server-side signature verification can be performed between the application server and the carrier server to further ensure the legitimacy of the application server and the carrier server, thereby further improving the security of the one-click login service. This can be specifically reflected in the following two aspects:

[0114] On one hand, the carrier server can perform signature verification on the application server to verify its legitimacy. The specific implementation process includes: after successful one-click login verification, the application server sends a number retrieval request to the carrier server. The application server can use a pre-agreed shared symmetric key, designated "apphmac," to sign the number retrieval request. This allows the carrier server to verify the signature's correctness based on its own stored "apphmac," thus verifying the application server's legitimacy. If the signature verification is successful, the carrier server provides the application server with the terminal device's mobile phone number.

[0115] On the other hand, the application server can perform signature verification on the carrier server to verify its legitimacy. The specific implementation process includes: when the carrier server provides the mobile phone number of the terminal device to the application server, it can use a pre-agreed shared symmetric key, denoted as "apphmac," to sign the provided mobile phone number. This allows the application server to verify the signature's correctness based on its stored "apphmac," thus verifying the carrier server's legitimacy. If the signature verification is successful, the application server issues login authorization to the application client.

[0116] The following describes the relevant processing of the operator server in the one-click login service in the embodiments of this specification.

[0117] Figure 5 This is a flowchart illustrating a method for implementing one-click login service on a carrier server, according to one embodiment of this specification. See also... Figure 5 The method includes:

[0118] Step 501: Before issuing a token to the application client, the operator server obtains the fingerprint information of the terminal device currently running the application client from the application client.

[0119] For details regarding step 501, please refer to the details regarding step 301.

[0120] For example, the process in step 501 includes:

[0121] When the operator server receives a one-click login request from the application client, it obtains the fingerprint information of the terminal device currently running the application client from the one-click login request.

[0122] or,

[0123] When the operator's server receives an authentication request from the application client to request a token, it obtains the fingerprint information of the terminal device currently running the application client from the authentication request.

[0124] Step 503: After generating the token, the operator server uses the shared symmetric key agreed upon with the application server in advance and the fingerprint information of the terminal device currently running the application client to calculate the first operation value.

[0125] For details regarding step 503, please refer to the details regarding step 301.

[0126] For example, the operator's server receives an authentication request from the application client and obtains the terminal device's IP address and the application client's APP ID from the authentication request; the process in step 503 includes:

[0127] Using a shared symmetric key pre-agreed with the application server, the generated token, the fingerprint information of the terminal device currently running the application client, the IP address of the terminal device, and the APP ID are calculated.

[0128] Step 505: The operator server sends the generated first calculated value to the application client.

[0129] For details regarding step 505, please refer to the details regarding step 303.

[0130] The following section explains how to implement the one-click login service by considering the collaborative processing of the application client, application server, and carrier server. (See also...) Figure 6 The method includes:

[0131] Step 601: The application client sends a one-click login request carrying the APP ID to the operator server to facilitate the initialization process of one-click login with the operator server.

[0132] Step 603: The operator server sends the generated session key to the application client.

[0133] Step 605: The application client obtains user authorization, i.e., the user clicks the one-click login button on the screen.

[0134] Step 607: The application client sends an authentication request to the operator's server using the session key in order to request a token; the authentication request carries the APP ID, timestamp, IP address, and fingerprint information of the terminal device currently running the application client.

[0135] Here, the IP address carried in the authentication request is the IP address of the terminal device where the application client is located, which can include both IPv4 and IPv6 addresses.

[0136] Step 609: After receiving the authentication request, the operator server generates a token and uses the shared symmetric key agreed upon with the application server in advance to perform hash calculation on the generated token, the fingerprint information of the terminal device currently running the application client carried in the authentication request, the IP address of the terminal device, and the APP ID to obtain the first operation value.

[0137] Step 611: The operator server sends the token and the first calculated value to the application client.

[0138] Step 613: The application client sends a one-click login confirmation request to the application server. The request carries the token, the IP address of the terminal device, the APP ID, the first calculation value, and the fingerprint information of the terminal device currently running the application client.

[0139] Step 615: The application server uses the shared symmetric key agreed upon with the operator server in advance to perform hash calculation on the token obtained from the one-click login confirmation request, the fingerprint information of the terminal device currently running the application client, the IP address of the terminal device, and the APP ID to obtain the second operation value.

[0140] Step 617: The application server determines whether the first operation value in the one-click login confirmation request is the same as the calculated second operation value. If they are the same, the one-click login verification is successful, and step 619 is executed. Otherwise, the one-click login verification fails, and the current process ends.

[0141] Step 619: The application server signs the number retrieval request using the shared symmetric key "apphmac" agreed upon with the operator server in advance, and then sends it to the operator server.

[0142] Step 621: The operator server verifies the signature based on the "apphmac" pre-agreed with the application provider server, i.e., verifies the legitimacy of the application server. If the signature verification is successful, the operator server uses the shared symmetric key "apphmac" pre-agreed with the application server to sign the provided terminal device's mobile phone number and then sends it to the application server.

[0143] Step 623: The application server verifies the signature based on the "apphmac" pre-agreed with the carrier server, i.e., verifies the legitimacy of the carrier server. If the signature verification is successful, the application server issues login authorization to the application client.

[0144] In one embodiment of this specification, an implementation device for a one-click login service is proposed. This device is installed in the application client. See [link to documentation]. Figure 7 The device includes:

[0145] The first fingerprint information sending module 701 is configured to send the fingerprint information of the terminal device currently running the application client to the operator server before obtaining the token;

[0146] The calculation value acquisition module 702 is configured to obtain the first calculation value sent by the operator server;

[0147] After obtaining the token sent by the operator server, the second fingerprint information sending module 703 sends a one-click login confirmation request to the application server. The one-click login confirmation request carries the token, the first calculation value, and the fingerprint information of the terminal device currently running the application client.

[0148] The login execution module 704 is configured to log in successfully with one click if it receives a login authorization from the application server.

[0149] exist Figure 7 In one embodiment of the device shown in this specification, the first fingerprint information sending module 701 is configured to: send the fingerprint information of the terminal device currently running the application client to the operator server in a one-click login request or an authentication request.

[0150] exist Figure 7 In one embodiment of the device shown in this specification, the computation value acquisition module 702 is configured to perform: receiving an authentication pass message carrying a token and a first computation value from an operator server, and obtaining the first computation value from the authentication pass message.

[0151] exist Figure 7 In one embodiment of the device shown in this specification, the fingerprint information of the terminal device includes at least one of the following: the intranet IP address of the terminal device, the identifier of the local area network used by the terminal device, and the identification code of the terminal device.

[0152] In one embodiment of this specification, an implementation device for a one-click login service is proposed. This device is located in an application server. See [link to documentation]. Figure 8 The device includes:

[0153] The first calculation value acquisition module 801 is configured to receive a one-click login confirmation request carrying a token sent by the application client; the one-click login confirmation request also carries the first calculation value and the fingerprint information of the terminal device currently running the application client;

[0154] The second operation value acquisition module 802 is configured to calculate the second operation value by using the shared symmetric key agreed in advance with the operator server and the fingerprint information of the terminal device currently running the application client obtained from the one-click login confirmation request.

[0155] The verification module 803 is configured to determine whether the first operation value carried in the one-click login confirmation request is the same as the calculated second operation value. If they are the same, the one-click login verification is successful; otherwise, the one-click login verification fails.

[0156] exist Figure 8In one embodiment of the device shown in this specification, the fingerprint information of the terminal device includes at least one of the following: the intranet IP address of the terminal device, the identifier of the local area network used by the terminal device, and the identification code of the terminal device.

[0157] exist Figure 8 In one embodiment of the device shown in this specification, the second operation value acquisition module 802 performs hash calculation.

[0158] exist Figure 8 In one embodiment of the device shown in this specification, the one-click login confirmation request also carries the IP address of the terminal device currently running the application client and the APP ID of the application client; correspondingly, the second calculation value acquisition module 802 is configured to perform the following:

[0159] Using a shared symmetric key pre-agreed with the operator's server, the token obtained from the one-click login confirmation request, the fingerprint information of the terminal device currently running the application client, the IP address of the terminal device, and the APP ID are calculated.

[0160] In one embodiment of this specification, an implementation device for a one-click login service is proposed. This device is located in an operator's server. See [link to relevant documentation]. Figure 9 The device includes:

[0161] The first fingerprint information acquisition module 901 is configured to obtain the fingerprint information of the terminal device currently running the application client sent by the application client before sending the token to the application client;

[0162] The first operation value calculation module 902 is configured to calculate the first operation value after generating the token by using the shared symmetric key agreed upon with the application server in advance and the fingerprint information of the terminal device currently running the application client.

[0163] The first operation value sending module 903 sends the generated first operation value to the application client.

[0164] exist Figure 9 In one embodiment of the device shown in this specification, the first fingerprint information acquisition module 901 is configured to perform:

[0165] When receiving a one-click login request from the application client, the fingerprint information of the terminal device currently running the application client is obtained from the one-click login request.

[0166] exist Figure 9In one embodiment of the device shown in this specification, the first fingerprint information acquisition module 901 is configured to: receive an authentication request from an application client for requesting a token, and obtain fingerprint information of the terminal device currently running the application client from the authentication request.

[0167] exist Figure 9 In one embodiment of the device shown in this specification, the first operation value calculation module 902 performs hash calculation.

[0168] exist Figure 9 In one embodiment of the device shown in this specification, the first arithmetic value calculation module 902 is configured to perform:

[0169] Receive the authentication request sent by the application client, and obtain the IP address of the terminal device and the APP ID of the application client from the authentication request;

[0170] Using a shared symmetric key pre-agreed with the application server, the generated token, the fingerprint information of the terminal device currently running the application client, the IP address of the terminal device, and the APP ID are calculated.

[0171] This specification provides, in one embodiment, a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the methods of any of the embodiments in this specification. This specification also provides, in one embodiment, a computing device including a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the methods of any of the embodiments in this specification.

[0172] It is understood that the structures illustrated in the embodiments of this specification do not constitute a specific limitation on the apparatus of the embodiments of this specification. In other embodiments of the specification, the above-described apparatus may include more or fewer components than illustrated, or combine some components, or split some components, or have different component arrangements. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0173] The information interaction and execution process between the modules in the above-mentioned device and system are based on the same concept as the method embodiments in this specification, and the specific details can be found in the descriptions in the method embodiments in this specification, so they will not be repeated here.

[0174] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the apparatus embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0175] Those skilled in the art will recognize that, in one or more of the examples above, the functions described in this invention can be implemented using hardware, software, widgets, or any combination thereof. When implemented in software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or code on a computer-readable medium.

[0176] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made on the basis of the technical solution of the present invention should be included within the scope of protection of the present invention.

Claims

1. The implementation method of one-click login service, applied to the application client; These include: Before obtaining the token, the application client sends the fingerprint information of the terminal device currently running the application client to the operator server. This allows the operator server to use the shared symmetric key agreed upon with the application server in advance to calculate the first operation value based on the generated token, the fingerprint information of the terminal device currently running the application client, the IP address of the terminal device, and the APP ID of the application client. The application client receives the first calculated value sent by the operator's server; After obtaining the token from the carrier server, the application client sends a one-click login confirmation request to the application server. This one-click login confirmation request carries the IP address of the terminal device currently running the application client, the application client's APP ID, the token, the first calculation value, and the fingerprint information of the terminal device currently running the application client. This causes the application server to perform the following: The application server uses the shared symmetric key agreed upon with the carrier server in advance, as well as the token, terminal device IP address, APP ID, and fingerprint information of the terminal device currently running the application client obtained from the one-click login confirmation request, to calculate a second calculation value. The application server then determines whether the first calculation value and the second calculation value are the same. If they are the same, the one-click login verification is successful, and the application server issues login authorization to the application client. If the application client receives the login authorization from the application server, then one-click login is successful; The fingerprint information of the terminal device includes at least one of the following: the intranet IP address of the terminal device, the identifier of the local area network used by the terminal device, and the identification code of the terminal device.

2. The method according to claim 1, wherein, Sending the fingerprint information of the terminal device currently running the application client to the operator server includes: sending the fingerprint information of the terminal device currently running the application client to the operator server in a one-click login request or an authentication request; And / or, The step of obtaining the first calculated value sent by the operator server includes: receiving an authentication pass message sent by the operator server carrying a token and the first calculated value, and obtaining the first calculated value from the authentication pass message.

3. The implementation method of one-click login service, applied to the application server; These include: The application server receives a one-click login confirmation request carrying a token from the application client; The one-click login confirmation request also carries the IP address of the terminal device currently running the application client, the APP ID of the application client, the first calculation value, and the fingerprint information of the terminal device currently running the application client. The process of the application client obtaining the first calculation value includes: before obtaining the token, the application client sends the fingerprint information of the terminal device currently running the application client to the operator server, so that the operator server uses the shared symmetric key agreed upon with the application server in advance to calculate the first calculation value based on the generated token, the fingerprint information of the terminal device currently running the application client, the IP address of the terminal device, and the APP ID of the application client. The application client then receives the first calculation value sent by the operator server. The application server obtains the first computational value, token, IP address of the terminal device, APP ID of the application client, and fingerprint information of the terminal device currently running the application client from the one-click login confirmation request; The application server uses a shared symmetric key pre-agreed with the operator's server to calculate the second operation value based on the obtained token, the fingerprint information of the terminal device currently running the application client, the IP address of the terminal device, and the APP ID. The application server determines whether the first operation value and the second operation value are the same. If they are, the one-click login verification is successful and login authorization is sent to the application client. Otherwise, the one-click login verification fails. The fingerprint information of the terminal device includes at least one of the following: the intranet IP address of the terminal device, the identifier of the local area network used by the terminal device, and the identification code of the terminal device.

4. The method according to claim 3, wherein, The calculation includes performing a hash calculation.

5. The implementation method of one-click login service, applied to operator servers; These include: Before issuing a token to the application client, the operator server obtains the fingerprint information of the terminal device currently running the application client from the application client. After generating the token, the operator server uses the shared symmetric key agreed upon with the application server in advance to calculate the first operation value based on the generated token, the fingerprint information of the terminal device currently running the application client, the IP address of the terminal device, and the APP ID of the application client. The carrier server sends the generated first calculated value to the application client, enabling both the application client and the application server to execute the following: After obtaining the token from the carrier server, the application client sends a one-click login confirmation request to the application server. This request carries the IP address of the terminal device currently running the application client, the application client's APP ID, the token, the first calculated value, and the fingerprint information of the terminal device. The application server uses a pre-agreed shared symmetric key with the carrier server, along with the token, terminal device IP address, APP ID, and fingerprint information obtained from the one-click login confirmation request, to calculate a second calculated value. The application server then checks if the first and second calculated values ​​are the same. If they are, the one-click login verification is successful, and the application server issues login authorization to the application client. If the application client receives the login authorization from the application server, the one-click login is successful. The fingerprint information of the terminal device includes at least one of the following: the intranet IP address of the terminal device, the identifier of the local area network used by the terminal device, and the identification code of the terminal device.

6. The method according to claim 5, wherein, The fingerprint information of the terminal device currently running the application client, obtained from the application client, includes: When receiving a one-click login request from the application client, obtain the fingerprint information of the terminal device currently running the application client from the one-click login request; or, In the authentication request sent by the application client to request a token, the fingerprint information of the terminal device currently running the application client is obtained from the authentication request.

7. The method according to claim 5, wherein, The calculation includes: performing hash calculations; And / or, The method further includes: receiving an authentication request from an application client, and obtaining the IP address of the terminal device and the APP ID of the application client from the authentication request.

8. A device for implementing the one-click login service, which is installed in the application client, and includes: The first fingerprint information sending module is configured to send the fingerprint information of the terminal device currently running the application client to the operator server before obtaining the token, so that the operator server can use the shared symmetric key agreed with the application server in advance to calculate the first calculation value based on the generated token, the fingerprint information of the terminal device currently running the application client, the IP address of the terminal device, and the APP ID of the application client. The calculation value acquisition module is configured to obtain the first calculation value sent by the operator's server. The second fingerprint information sending module, after obtaining the token sent by the operator server, sends a one-click login confirmation request to the application server. This one-click login confirmation request carries the IP address of the terminal device currently running the application client, the APP ID of the application client, the token, the first calculation value, and the fingerprint information of the terminal device currently running the application client. This causes the application server to perform the following: The application server uses the shared symmetric key agreed upon with the operator server in advance, as well as the token, the IP address of the terminal device, the APP ID, and the fingerprint information of the terminal device currently running the application client obtained from the one-click login confirmation request, to calculate the second calculation value. The application server then determines whether the first calculation value and the second calculation value are the same. If they are the same, the one-click login verification is successful, and the application server issues login authorization to the application client. The login execution module is configured to log in successfully with one click if it receives login authorization from the application server. The fingerprint information of the terminal device includes at least one of the following: the intranet IP address of the terminal device, the identifier of the local area network used by the terminal device, and the identification code of the terminal device.

9. A device for implementing one-click login service, which is located in the application server, and includes: The first calculation value acquisition module is configured to receive a one-click login confirmation request carrying a token sent by the application client; The one-click login confirmation request also includes the IP address of the terminal device currently running the application client, the APP ID of the application client, the first calculation value, and the fingerprint information of the terminal device currently running the application client; The application client obtains the first calculated value and the fingerprint information of the terminal device currently running the application client from the one-click login confirmation request. The process of the application client obtaining the first calculated value includes: before obtaining the token, the application client sends the fingerprint information of the terminal device currently running the application client to the operator server, so that the operator server uses the shared symmetric key agreed with the application server in advance to calculate the first calculated value based on the generated token, the fingerprint information of the terminal device currently running the application client, the IP address of the terminal device, and the APP ID of the application client. The application client then receives the first calculated value sent by the operator server. The second operation value acquisition module is configured to use a shared symmetric key pre-agreed with the operator server to calculate the second operation value based on the acquired token, the fingerprint information of the terminal device currently running the application client, the IP address of the terminal device, and the APP ID. The verification module is configured to determine whether the first operation value and the second operation value are the same. If they are the same, the one-click login verification is successful and login authorization is sent to the application client. Otherwise, the one-click login verification fails. The fingerprint information of the terminal device includes at least one of the following: the intranet IP address of the terminal device, the identifier of the local area network used by the terminal device, and the identification code of the terminal device.

10. A device for implementing one-click login service, the device being installed in the operator's server, the device comprising: The first fingerprint information acquisition module is configured to obtain the fingerprint information of the terminal device currently running the application client sent by the application client before sending the token to the application client; The first operation value calculation module is configured to, after generating the token, use a shared symmetric key agreed upon with the application server in advance to calculate the first operation value based on the generated token, the fingerprint information of the terminal device currently running the application client, the IP address of the terminal device, and the APP ID of the application client. The first calculation value sending module sends the generated first calculation value to the application client, so that the application client and the application server can execute: After obtaining the token sent by the operator server, the application client sends a one-click login confirmation request to the application server. The one-click login confirmation request carries the IP address of the terminal device currently running the application client, the APP ID of the application client, the token, the first calculation value, and the fingerprint information of the terminal device currently running the application client. The application server uses a shared symmetric key pre-agreed with the operator's server, along with the token obtained from the one-click login confirmation request, the terminal device's IP address, APP ID, and the fingerprint information of the terminal device currently running the application client, to calculate a second operation value. The application server then determines whether the first and second operation values ​​are the same. If they are, the one-click login verification is successful, and the application server issues login authorization to the application client. If the application client receives the login authorization from the application server, the one-click login is successful. The fingerprint information of the terminal device includes at least one of the following: the intranet IP address of the terminal device, the identifier of the local area network used by the terminal device, and the identification code of the terminal device.

11. A computing device comprising a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method of any one of claims 1-7.

Images