Method and apparatus for implementing one-key login service

Abstract

Embodiments of the present specification provide an implementation method and device of a one-key login service. In the method, before a number-taking login process between an application client and an operator server is started, an application server generates a first device code according to association information of a terminal device currently running the application client; after the number-taking login process is started, the application server generates a second device code according to association information of the terminal device currently running the application client carried in a one-key login confirmation request; and the first device code and the second device code are used to perform verification processing of the one-key login service. The embodiments of the present specification can improve the security of the one-key login service, and can avoid leakage of user privacy data.

Description

TECHNICAL FIELD

[0001] One or more embodiments of the present specification relate to network information technology, and in particular, to an implementation method and device of one-key login service. BACKGROUND

[0002] With the rapid development of network, various service applications based on network are generated. A user only needs to download an application client, i.e. an application program (APP), of a corresponding service application in a terminal device, and then registers and logs in through the application client, so as to enjoy the corresponding service application, such as watching a movie or purchasing goods, etc.

[0003] In order to facilitate the use of the user, a new method of logging in the APP, i.e. one-key login method, has appeared. In the one-key login method, a terminal device, such as a mobile phone, where the application client is located, will be pre-embedded with an authentication SDK. When the user requests to log in, the SDK is used to communicate with the operator server to collect the user's mobile phone number. After obtaining the user's consent authorization, the application client obtains a token of interface calling, and passes the token to the application server. The application server uses the token to obtain the mobile phone number and other information of the current authorized user from the operator server, so as to complete the login of the APP.

[0004] Reference Figure 1 In the one-key login service, the user only needs to click the related "one-key login" button, and does not need to input the mobile phone number, username, password, and short message verification code, etc. Therefore, the user can more conveniently and quickly complete the registration and login process, and the process which originally takes about 20 seconds is shortened to about 2 seconds, thereby greatly facilitating the use of the user.

[0005] However, the security of the current one-key login service is relatively low, which is easy to cause the leakage of user privacy data. Therefore, an implementation method of a more secure one-key login service is needed. SUMMARY

[0006] One or more embodiments of the present specification describe an implementation method and device of one-key login service, which can improve the security of the one-key login service.

[0007] According to a first aspect, an implementation method of one-key login service is provided, which comprises:

[0008] Before starting a number-taking login process between the application client and the operator server, receiving the association information of the terminal device currently running the application client sent by the application client;

[0009] Generating a first device code according to the currently received association information of the terminal device;

[0010] receive a one-key login confirmation request from the application client, the one-key login confirmation request carrying a token and association information of a terminal device currently running the application client;

[0011] generate a second device code according to the association information of the terminal device carried in the one-key login confirmation request;

[0012] perform one-key login service verification processing using the first device code and the second device code.

[0013] According to a second aspect, a one-key login service implementation method is provided, which includes:

[0014] send, before a number obtaining login process between the application client and the operator server is started, association information of a terminal device currently running the application client to the application server;

[0015] after obtaining a token sent by the operator server, send a one-key login confirmation request to the application server, the one-key login confirmation request carrying the token and the association information of the terminal device currently running the application client;

[0016] if a login authorization sent by the application server is received, the one-key login is successful.

[0017] According to a third aspect, a one-key login service implementation method is provided, which includes:

[0018] receive a first device code sent by the application client before generating a token corresponding to the one-key login service;

[0019] after receiving an identity verification request sent by the application client, generate the token;

[0020] send the generated token to the application client;

[0021] receive a number obtaining request carrying a token and a second device code sent by the application server;

[0022] perform one-key login service verification processing using the first device code and the second device code in the number obtaining request.

[0023] According to a fourth aspect, a one-key login service implementation device is provided, which includes:

[0024] a first information obtaining module configured to receive, before a number obtaining login process between an application client and an operator server is started, association information of a terminal device currently running the application client sent by the application client;

[0025] The first device code generation module is configured to generate a first device code according to the association information of the terminal device currently received;

[0026] The second information acquisition module receives a one-key login confirmation request sent by the application client, and the one-key login confirmation request carries a token and the association information of the terminal device currently running the application client;

[0027] The second device code generation module generates a second device code according to the association information of the terminal device carried in the one-key login confirmation request;

[0028] The verification execution module is configured to perform one-key login service verification processing by using the first device code and the second device code.

[0029] According to a fifth aspect, an implementation device of a one-key login service is provided, comprising:

[0030] The first information sending module is configured to send the association information of the terminal device currently running the application client to the application server before starting a number taking login process between the application client and the operator server;

[0031] The second information sending module is configured to send a one-key login confirmation request to the application server after obtaining the token sent by the operator server, and the one-key login confirmation request carries a token and the association information of the terminal device currently running the application client;

[0032] The login execution module is configured to perform one-key login successfully if a login authorization sent by the application server is received.

[0033] According to a sixth aspect, an implementation device of a one-key login service is provided, comprising:

[0034] The first device code receiving module is configured to receive a first device code sent by the application client before generating a token corresponding to the one-key login service;

[0035] The token processing module is configured to generate a token after receiving an identity authentication request sent by the application client, and send the generated token to the application client;

[0036] The second device code receiving module is configured to receive a number taking request sent by the application server, and the number taking request carries a token and a second device code;

[0037] The verification processing module is configured to perform one-key login service verification processing by using the first device code and the second device code in the number taking request.

[0038] According to a seventh aspect, there is provided a computing device comprising a memory having executable code stored therein and a processor that, when executing the executable code, implements the method of any embodiment of the present specification.

[0039] The implementation method and device of the one-key login service provided by any embodiment or combination of multiple embodiments of the present specification have at least the following beneficial effects:

[0040] 1. In the embodiments of the present specification, the association information of the terminal device is obtained in different stages (the stage before the number taking login process between the application client and the operator server is started, and the stage after the number taking login process between the application client and the operator server is started), and the first device code and the second device code are generated respectively, and the first device code and the second device code are used for verification, so that it is verified whether the one-key login confirmation request from the terminal device X of the attacker, thereby avoiding that the application server provides the application service corresponding to the application client for the terminal device X of the attacker, and improving the security.

[0041] 2. In actual business implementation, because the sdk permission of the operator is limited, and there is no front end, it is difficult to do the work of identifying the identity of the application client, therefore, before the application client initiates the number taking login to the operator server, the identity of the application client is identified by the application server end, and the dynamic device code (hcode) is issued, even if the hcode is lost, it will not cause the leakage of user information. This is because the number taking of the operator server is based on the gateway number taking, after the attacker steals the hcode, the number taken by the operator server is also the number of the attacker, finally, at most, the inconsistency between the hcode and the token is caused, the number taking fails, and the information leakage of the legal user will not be caused. And in step 7, the client does not directly upload the hcode, but obtains the hcode through the secondary calculation or table lookup of the server, in this way, the consistency of the hcode is achieved, and the security of the number taking process is finally ensured.

[0042] 3. The attack of the number taking login initiated by the terminal device of the victim with the Trojan horse pretending to be the identity of the application client to the operator can be resisted.

[0043] 4. The operator server can verify according to the two device codes, so that the verification error caused by the attack and holding of the application server can be further prevented. For example, after the application server is attacked and held by the attacker, the application server directly sends the first device code generated in the first stage to the operator server, instead of sending the second device code generated in the second stage to the operator server, thereby causing the error in the verification process of the operator server. The embodiments of the present specification can further avoid such error, and further improve the security of the one-key login service. BRIEF DESCRIPTION OF DRAWINGS

[0044] In order to more clearly illustrate the technical solutions in the embodiments of the present specification or the prior art, the drawings needed to be used in the embodiments or prior art description will be briefly introduced. Obviously, the drawings in the following description are some embodiments of the present specification, and other drawings can be obtained by those skilled in the art without creative effort on the basis of these drawings.

[0045] Figure 1 is an operation schematic diagram of a one-key login service.

[0046] Figure 2 is a schematic diagram of a system architecture to which an embodiment of the present specification is applied.

[0047] Figure 3 is a flowchart of a method for implementing a one-key login service in an application server according to an embodiment of the present specification.

[0048] Figure 4 is a flowchart of a method for implementing a one-key login service in an application client according to an embodiment of the present specification.

[0049] Figure 5 is a flowchart of a method for implementing a one-key login service in an operator server according to an embodiment of the present specification.

[0050] Figure 6 is a flowchart of information interaction for implementing a one-key login service in cooperation of an operator server, an application client and an application server according to an embodiment of the present specification.

[0051] Figure 7 is a structural schematic diagram of an implementation device of a one-key login service according to an embodiment of the present specification.

[0052] Figure 8 is a structural schematic diagram of an implementation device of a one-key login service according to another embodiment of the present specification.

[0053] Figure 9 is a structural schematic diagram of an implementation device of a one-key login service according to still another embodiment of the present specification. DETAILED DESCRIPTION

[0054] The schemes provided by the present specification will be described below with reference to the drawings.

[0055] In order to facilitate the understanding of the method provided by the present specification, the system architecture to which the present specification is related and applied will be described first. As shown in Figure 2 The system architecture mainly includes three network nodes: an application client, an application server and an operator server.

[0056] The application client is installed and run in the terminal device, and the terminal device can include but is not limited to, such as: smart mobile terminal, smart home device, network device, wearable device, smart medical device, PC (personal computer) and the like. The smart mobile terminal can include, such as mobile phone, tablet computer, notebook computer, PDA (personal digital assistant), Internet car and the like. The smart home device can include smart home appliance, such as smart TV, smart air conditioner, smart water heater, smart refrigerator, smart air purifier and the like, and the smart home device can also include smart door lock, smart socket, smart lamp, smart camera and the like. The network device can include, such as switch, wireless AP, server and the like. The wearable device can include, such as smart watch, smart glasses, smart bracelet, virtual reality device, augmented reality device, mixed reality device (i.e. a device that can support virtual reality and augmented reality) and the like. The smart medical device can include, such as smart thermometer, smart sphygmomanometer, smart blood glucose meter and the like.

[0057] The application client can be various types of applications, including but not limited to, such as payment application, multimedia playing application, map application, text editing application, financial application, browser application, instant messaging application and the like.

[0058] The operator server refers to the server device of the provider of network service, which can be a single server or a server group composed of multiple servers. The operator server is responsible for providing network service for various applications, such as security authentication, providing one-key login mobile phone number and the like.

[0059] The application server is a server of a specific application, which is specially used to provide corresponding application service for the application client. For example, for the Alipay application client, the application server is the server that provides Alipay service.

[0060] It should be understood that Figure 2 The number of application clients, application servers and operator servers in

[0061] Referring to Figure 2 , the application client, the application server and the operator server interact through the network. The network can include various connection types, such as wired, wireless communication link or optical cable and the like.

[0062] Because the implementation method of one-key login service provided in the present specification involves the three types of network nodes shown in Figure 2 , the processing of the operator server, the application client and the application server in the one-key login service will be described respectively through different embodiments.

[0063] First, the application server in the one-key login service processing is explained.

[0064] Figure 3 is a flow chart of the method for implementing the one-key login service in the application server according to an embodiment of the present specification. Referring to Figure 3 , the method comprises:

[0065] Step 301: Before the taking-number login process between the application client and the operator server is started, the application server receives the association information of the terminal device currently running the application client sent by the application client, wherein the association information of different terminal devices is not the same.

[0066] Step 303: The application server generates a first device code according to the association information of the terminal device currently received.

[0067] Step 305: The application server receives a one-key login confirmation request sent by the application client; the one-key login confirmation request carries a token and the association information of the terminal device currently running the application client.

[0068] Step 307: The application server generates a second device code according to the association information of the terminal device carried in the one-key login confirmation request.

[0069] Step 309: The application server performs one-key login service verification processing by using the first device code and the second device code.

[0070] In the existing one-key login service, situations such as the following may occur: an attacker often monitors and attacks the link from the operator server to the application client, thereby stealing the token issued by the operator server to the application client by using his own terminal device X. Then, the attacker can send the token to the application server by imitating the legitimate terminal device Y where the application client is located through the terminal device X, because the token used is correct, the application server can get the mobile phone number of the terminal device Y where the application client is located from the operator server, thereby causing the application server to mistakenly believe that the terminal device X sending the token is the terminal device Y where the application client is located, that is, the attacker is the legitimate user of the application client, thereby providing the corresponding application service to the attacker, such as playing video materials that the legitimate user has the right to watch or completing a transfer, etc., thereby causing a security problem to the user and possibly causing the user's private data to be leaked.

[0071] According to the above Figure 3The shown process can be seen that in the flow of the one-key login service executed in the application server, the process of generating a device code by using the association information of the terminal device is added, so as to use the device code for verification. Because the association information of different terminal devices is not the same, therefore, if the above-mentioned situation of the attacker using the terminal device X to imitate the legitimate terminal device Y does not occur, the application server will generate the same first device code and second device code according to the association information of the terminal device X and the terminal device Y respectively acquired in the different stages of the shown process. Figure 3 The shown process in the different stages (the different stages refer to the stage before the number taking login process between the application client and the operator server is started, and the stage after the number taking login process between the application client and the operator server is started) respectively acquires the association information of the terminal device, so that the first device code and the second device code generated are the same. On the contrary, if the above-mentioned situation of the attacker using the terminal device X to imitate the legitimate terminal device Y occurs, the application server will generate different first device code and second device code according to the association information of the terminal device X and the terminal device Y respectively acquired in the different stages of the shown process. Figure 3 The shown process in the different stages respectively acquires the association information of the terminal device, so that the first device code and the second device code generated are the same. On the contrary, if the above-mentioned situation of the attacker using the terminal device X to imitate the legitimate terminal device Y occurs, the application server will generate different first device code and second device code according to the association information of the terminal device X and the terminal device Y respectively acquired in the different stages of the shown process. Figure 3 The shown flow uses this feature to verify whether it is the one-key login confirmation request sent by the terminal device X of the attacker, thereby avoiding the application server providing the application service corresponding to the application client for the terminal device X of the attacker, and improving the security.

[0072] The application server's processing process shown in the shown process will be described in detail below in combination with specific embodiments, the processing of the operator server and the processing of the application client. Figure 3 The application server's processing process shown in the shown process will be described in detail below in combination with specific embodiments, the processing of the operator server and the processing of the application client.

[0073] Firstly, for step 301: before the number taking login process between the application client and the operator server is started, the application server receives the association information of the terminal device currently running the application client sent by the application client.

[0074] Before the number taking login process between the application client and the operator server is started, for example, before the application client requests the token from the operator server, the application client will send a one-key login initialization request to the application server to perform the initialization operation of the one-key login with the application server. In this way, the application client can carry the association information of the terminal device currently running the application client in the one-key login initialization request and send it to the application server. Correspondingly, in this step 301, the application server can acquire the association information of the terminal device currently running the application client from the one-key login initialization request.

[0075] Optionally, in the embodiment of the present specification, before the taking-number login process between the application client and the operator server is started, the application client can also carry the association information of the terminal device currently running the application client in other messages, such as newly defined messages, to the application server, and in step 301, the application server obtains the association information of the terminal device currently running the application client from the newly defined message.

[0076] In the embodiment of the present specification, the association information of the terminal device can be any kind of information or combination of several kinds of information that can identify the terminal device, such as including at least one of the following: public IP address of the terminal device, internal IP address of the terminal device, identification of the local area network used by the terminal device, identification code of the terminal device. The identification code of the terminal device can be, for example, International Mobile Equipment Identity (IMEI), International Mobile Subscriber Identity (IMSI), etc.

[0077] Next, for step 303: the application server generates a first device code according to the currently received association information of the terminal device.

[0078] Here, the application server can use a pre-set algorithm, such as a hash algorithm, to calculate the currently received association information of the terminal device, thereby calculating the first device code.

[0079] The application server will save the first device code, i.e. save the relevant information of the terminal device that communicates with the application server before the taking-number login process between the application client and the operator server is started (i.e. the first stage) in this one-key login service process.

[0080] In the embodiment of the present specification, the verification method using the device code includes the following two methods:

[0081] Method one: the application server completes verification according to the device codes generated in the two stages.

[0082] In this method one, the application server then compares whether the two device codes are the same to verify in advance at the application server side, so as to reduce the workload of the operator server. When this method one is adopted, the application server does not need to send the first device code to the application client.

[0083] Method two: the operator server completes verification according to the device codes generated in the two stages.

[0084] In the second mode, the subsequent verification is performed by the operator server according to the two device codes, which can further prevent the verification error caused by the application server being attacked and held hostage. For example, after the application server is attacked and held hostage by an attacker, the application server directly sends the first device code generated in the first stage to the operator server instead of sending the second device code generated in the second stage to the operator server, thereby causing the verification process of the operator server to fail. The second mode further improves the security of the one-key login service.

[0085] When the second mode is adopted, after the first device code is generated, the application server sends the first device code to the application client in step 303.

[0086] If the second mode is adopted by the embodiments of the present specification, the application client receives the first device code sent by the application server. Thus, after the number-taking login process between the application client and the operator server is started and before the application client obtains the token sent by the operator server, the application client further sends the first device code to the operator server.

[0087] In the one-key login service, after step 303, the application client sends a one-key login request to the operator server to obtain a session key from the operator server. Then, the application client sends an identity verification request carrying the session key to the operator server to trigger the operator server to generate a token corresponding to the one-key login service. When the second mode is adopted, the application client can send the first device code in the one-key login request to the operator server or send the first device code in the identity verification request to the operator server.

[0088] After receiving the first device code, the operator server saves the first device code. After the operator server generates the token according to the received identity verification request, the operator server can save the corresponding relationship between the first device code and the token generated by itself, which is recorded as corresponding relationship 1.

[0089] Then, the operator server sends the generated token to the application client. At this time, the attacker may steal the token through link monitoring or other methods.

[0090] After obtaining the token sent by the operator server, the application client sends a one-key login confirmation request to the application server, and the one-key login confirmation request carries the token and the association information of the terminal device currently running the application client (the association information of the terminal device currently running the application client in the second stage). If the token is stolen by an attacker, the association information of the terminal device carried in the one-key login confirmation request sent to the application server is the association information of the terminal device X used by the attacker (different from the association information of the terminal device Y in the first stage). If the token is not stolen by an attacker, the association information of the terminal device carried in the one-key login confirmation request sent to the application server is the association information of the legitimate terminal device Y (the same as the association information of the terminal device Y in the first stage).

[0091] Next, for step 305: the application server receives the one-key login confirmation request sent by the application client; the one-key login confirmation request carries the token and the association information of the terminal device currently running the application client.

[0092] Next, for step 307: the application server generates a second device code according to the association information of the terminal device carried in the one-key login confirmation request.

[0093] Referring to the description of step 303, the association information of the terminal device can be: the public network IP address of the terminal device, the intranet IP address of the terminal device, and / or the identifier of the local area network used by the terminal device.

[0094] Referring to the description of step 303, the second device code is generated according to the association information of the terminal device, including: performing hash calculation on the association information of the terminal device to obtain the second device code.

[0095] Next, for step 309: the application server performs one-key login verification processing by using the first device code and the second device code.

[0096] In the embodiment of the present specification, if the above-mentioned method one is adopted, the implementation process of the present step 309 includes:

[0097] The application server judges whether the calculated first device code and the second device code are the same,

[0098] If yes, the one-key login service verification succeeds, the application server sends a number acquisition request carrying the token to the operator server, and after obtaining the telephone number of the terminal device from the operator server, sends a login authorization to the application client;

[0099] If no, the one-key login service verification fails, and the process ends.

[0100] In the embodiment of the present specification, if the second mode described above is adopted, the implementation process of the present step 309 includes that the application server sends the token and the second device code to the operator server in the number acquisition request, so as to be verified by the operator server (for details, see the related description of the flow shown in Figure 5 Subsequently, if the verification of the operator server is passed, the application server acquires the phone number of the terminal device from the operator server, and sends the login authorization to the application client. If the verification of the operator server is not passed, the application server cannot acquire the phone number of the terminal device from the operator server.

[0101] The following describes the related processing of the application client in the one-key login service in the embodiment of the present specification.

[0102] Figure 4 is a flowchart of a method for implementing the one-key login service in the application client according to an embodiment of the present specification. Referring to Figure 4 , the method includes the following steps.

[0103] Step 401: Before the number-taking login process between the application client and the operator server is started, the application client sends the associated information of the terminal device currently running the application client to the application server.

[0104] Referring to the related description of step 301 described above, in the present step 401, the application client can send the associated information of the terminal device currently running the application client to the application server in the one-key login initialization request, or the application client can send the associated information of the terminal device currently running the application client to the application server in the newly defined request.

[0105] Referring to the related description of each step in Figure 3 , if the second mode is adopted in the embodiment of the present specification, the following step will be further included between step 401 and step 403.

[0106] Step 4021: The application client receives the first device code sent by the application server.

[0107] Step 4023: After the number-taking login process between the application client and the operator server is started, and before the token sent by the operator server is acquired, the application client sends the first device code to the operator server.

[0108] Referring to the above description of step 303, in this step 4023, the application client can send the first device code to the operator server in a one-key login request, or send the first device code to the operator server in an identity verification request.

[0109] Step 403: After obtaining the token sent by the operator server, the application client sends a one-key login confirmation request to the application server, and the one-key login confirmation request carries the token and the association information of the terminal device currently running the application client.

[0110] Step 405: If the application client receives the login authorization sent by the application server, the one-key login is successful.

[0111] The implementation process of steps 403 and 405 can be referred to the above description of the related steps in the method. Figure 3

[0112] The following describes the related processing of the operator server in the one-key login service in the embodiment of the present application.

[0113] Figure 5 is a flowchart of a method for implementing a one-key login service in the operator server according to an embodiment of the present application. Referring to Figure 5 , the method comprises:

[0114] Step 501: Before generating the token corresponding to the one-key login service, the operator server receives the first device code sent by the application client and saves it.

[0115] Step 503: After receiving the identity verification request sent by the application client, the operator server generates a token.

[0116] Step 505: The operator server sends the generated token to the application client.

[0117] Step 507: The operator server receives the number acquisition request sent by the application server, which carries the token and the second device code.

[0118] Step 509: The operator server verifies the one-key login service by using the first device code and the second device code.

[0119] The above Figure 5 indicates the processing of the operator server, which actually corresponds to the second method in the embodiment of the present application, that is, the verification is completed by the operator server according to the device code.

[0120] The following describes each step in Figure 5 . ​

[0121] Firstly, for step 501: the operator server receives the first device code sent by the application client before generating the token corresponding to the one-key login service, and saves it.

[0122] According to the above description, in the embodiment of the present application, the application client can send the first device code to the operator server in the one-key login request, or send the first device code to the operator server in the identity authentication request. Accordingly, in step 501, the operator server can obtain the first device code sent by the application client from the received one-key login request, or the operator server can obtain the first device code sent by the application client from the received identity authentication request for requesting the token.

[0123] Next, for step 503 and step 505: the operator generates the token after receiving the identity authentication request sent by the application client, and sends the generated token to the application client.

[0124] According to the above description Figure 4 After obtaining the token sent by the operator server, the application client sends a one-key login confirmation request to the application server, and the one-key login confirmation request carries the token and the association information of the terminal device currently running the application client.

[0125] According to the above description of step 309, the application server sends the token and the second device code to the operator server in the number acquisition request.

[0126] Next, for step 507: the operator server receives the number acquisition request sent by the application server, which carries the token and the second device code.

[0127] Step 509: the operator server verifies the one-key login service by using the first device code and the second device code.

[0128] In one embodiment of the present application, the implementation of step 509 includes: the operator server judges whether the first device code and the second device code are the same, if they are the same, the verification of the one-key login service is successful, otherwise, the verification of the one-key login service fails.

[0129] In another embodiment of the present specification, in step 503, the operator server further establishes a correspondence between the first device code and the generated token after generating the token, denoted as correspondence 1. Accordingly, the implementation of step 509 includes: establishing a correspondence between the token obtained from the number acquisition request and the second device code, denoted as correspondence 2; judging whether the correspondence 1 and the correspondence 2 are consistent, if yes, the verification of the one-key login service is successful, otherwise, the verification of the one-key login service fails.

[0130] The implementation method of the one-key login service will be described below in combination with the cooperation processing of the application client, the application server and the operator server. In this method, the above-mentioned mode two (i.e. the verification is completed by the operator server) is taken as an example, and the implementation of the one-key login service is described with reference to Figure 6 , including:

[0131] Step 601: The application client sends a one-key login initialization request to the application server to which it belongs through a special link, and the request carries the association information of the terminal device currently running the application client.

[0132] Step 603: The application server obtains the association information of the terminal device from the one-key login initialization request, and performs hash calculation on the association information to calculate a first device code.

[0133] Step 605: The application server sends the first device code to the application client.

[0134] Step 607: The application client sends a one-key login request to the operator server, and the one-key login request carries the APP ID and the first device code.

[0135] Step 609: The operator server obtains the first device code from the one-key login request, and then sends the generated session key to the application client.

[0136] Step 611: The application client obtains user authorization, i.e. the user clicks the one-key login button on the screen.

[0137] Step 613: The application client sends an identity verification request carrying the APP ID, the timestamp and the IP address to the operator server by using the session key, so as to request a token.

[0138] Here, the IP address carried in the identity verification request is the IP address of the terminal device where the application client is located, which can include an IPv4 address and an IPv6 address.

[0139] Step 615: After receiving the identity verification request, the operator server generates a token, and establishes and saves a correspondence 1 between the first device code and the generated token.

[0140] Step 617: The operator server issues the token to the application client.

[0141] Step 619: The application client sends a one-key login confirmation request to the application server, and the request carries the token and the association information of the terminal device currently running the application client.

[0142] Step 621: The application server performs hash calculation on the association information of the terminal device obtained from the one-key login confirmation request, and calculates a second device code.

[0143] Step 623: The application server sends a number obtaining request to the operator server, and the number obtaining request carries the APP ID, the token, and the second device code.

[0144] Step 625: The operator server establishes a correspondence 2 between the token and the second device code obtained from the number obtaining request, judges whether the correspondence 1 and the correspondence 2 are consistent, if not, the one-key login verification fails, and the mobile phone number of the terminal device is not sent to the application server, if yes, the one-key login verification succeeds, and the mobile phone number of the terminal device is sent to the application server.

[0145] Step 627: If the application server receives the mobile phone number of the terminal device sent by the operator server, the application server performs login authorization to the application client, otherwise, the one-key login fails.

[0146] In an embodiment of the present specification, an implementation device of one-key login service is provided, which is arranged in an application server, and the device is shown in Figure 7 The device comprises:

[0147] A first information obtaining module 701 is configured to receive the association information of the terminal device currently running the application client sent by the application client before the number obtaining login process between the application client and the operator server is started.

[0148] A first device code generating module 702 is configured to generate a first device code according to the currently received association information of the terminal device.

[0149] A second information obtaining module 703 receives a one-key login confirmation request sent by the application client; the one-key login confirmation request carries the token and the association information of the terminal device currently running the application client.

[0150] A second device code generating module 704 generates a second device code according to the association information of the terminal device carried in the one-key login confirmation request.

[0151] The verification execution module 705 is configured to perform a one-key login service verification process by using the first device code and the second device code.

[0152] In Figure 7 In one embodiment of the apparatus of the present specification shown in the figure, the first information acquisition module 701 is configured to perform:

[0153] receive a one-key login initialization request sent by an application client;

[0154] acquire, from the one-key login initialization request, association information of a terminal device currently running the application client.

[0155] In Figure 7 In one embodiment of the apparatus of the present specification shown in the figure, the verification execution module 705 is configured to perform: judging whether the calculated first device code and the second device code are the same, if yes, the one-key login service verification is successful, and a number acquisition request carrying the token is sent to an operator server; if not, the one-key login service verification fails, and the process ends.

[0156] In Figure 7 In one embodiment of the apparatus of the present specification shown in the figure, the verification execution module 705 is configured to perform:

[0157] sending the generated first device code to the application client before a one-key login process between the application client and the operator server is started;

[0158] sending the token and the second device code in the number acquisition request to the operator server for verification of the one-key login service by the operator server.

[0159] The association information of the terminal device includes at least one of the following: the public IP address of the terminal device, the internal IP address of the terminal device, the identifier of the local area network used by the terminal device, and the identification code of the terminal device. The identification code of the terminal device may be, for example, an International Mobile Equipment Identity (IMEI) or an International Mobile Subscriber Identity (IMSI).

[0160] In Figure 7 In one embodiment of the apparatus of the present specification shown in the figure, the first device generation module 702 is configured to perform: performing a hash calculation on the association information of the terminal device to obtain the first device code.

[0161] In Figure 7 In one embodiment of the apparatus of the present specification shown in the figure, the second device generation module 704 is configured to perform: performing a hash calculation on the association information of the terminal device to obtain the second device code.

[0162] In an embodiment of the present disclosure, an implementation device of one-key login service is provided. Referring to Figure 8 The device is applied to an application client and comprises:

[0163] The first information sending module 801 is configured to send, before starting a number taking login process between the application client and the operator server, the association information of a terminal device currently running the application client to the application server.

[0164] The second information sending module 802 is configured to send, after obtaining the token sent by the operator server, a one-key login confirmation request to the application server, wherein the one-key login confirmation request carries the token and the association information of the terminal device currently running the application client.

[0165] The login executing module 803 is configured to, if receiving the login authorization sent by the application server, successfully perform one-key login.

[0166] In an embodiment of the device of the present disclosure shown in Figure 8 The first information sending module 801 is configured to send, to the application server, the association information of the terminal device currently running the application client in a one-key login initialization request.

[0167] In an embodiment of the device of the present disclosure shown in Figure 8 The device further comprises a first device code sending module configured to receive the first device code sent by the application server and send the first device code to the operator server before obtaining the token sent by the operator server.

[0168] In an embodiment of the present disclosure, an implementation device of one-key login service is provided. Referring to Figure 9 The device is applied to an operator server and comprises:

[0169] The first device code receiving module 901 is configured to receive the first device code sent by the application client before generating a token corresponding to the one-key login service.

[0170] The token processing module 902 is configured to generate the token after receiving the identity authentication request sent by the application client and send the generated token to the application client.

[0171] The second device code receiving module 903 is configured to receive a number obtaining request carrying the token and a second device code sent by the application server.

[0172] The verification processing module 904 is configured to perform verification processing of the one-key login service by using the first device code and the second device code in the number obtaining request.

[0173] In Figure 9 In an embodiment of the apparatus of the specification as shown, the verification processing module 904 is configured to perform: judging whether the first device code and the second device code are the same, if yes, the one-key login service verification is successful, otherwise, the one-key login service verification fails.

[0174] In Figure 9 In an embodiment of the apparatus of the specification as shown, the verification processing module 904 is configured to perform: after generating the token, establishing a first correspondence relationship between the first device code and the generated token; establishing a second correspondence relationship between the token obtained from the number obtaining request and the second device code; judging whether the first correspondence relationship and the second correspondence relationship are consistent, if yes, the one-key login service verification is successful, otherwise, the one-key login service verification fails.

[0175] An embodiment of the specification provides a computer readable storage medium, which stores a computer program, when the computer program is executed in a computer, the computer program causes the computer to execute the method in any one of the embodiments of the specification. An embodiment of the specification provides a computing device, which includes a memory and a processor, the memory stores executable code, and the processor executes the executable code to implement the method in any one of the embodiments of the specification.

[0176] It can be understood that the structure shown in the embodiments of the specification does not constitute a specific limitation on the apparatus of the embodiments of the specification. In other embodiments of the specification, the above apparatus can include more or fewer components than the illustration, or combine certain components, or split certain components, or different arrangement of components. The components shown can be implemented in hardware, software or a combination of software and hardware.

[0177] The information interaction, execution process and the like between the modules in the above apparatus and system are based on the same concept as the method embodiments of the specification, and the specific content can be referred to the description in the method embodiments of the specification, which will not be described here.

[0178] Each of the embodiments in the specification describes in a progressive manner, and the same and similar parts between the embodiments can be referred to each other. Each embodiment mainly describes the difference from other embodiments. Especially for the device embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the part of the method embodiments.

[0179] Those skilled in the art should understand that, in one or more examples described above, the functions described in the present application can be implemented by hardware, software, a plug-in or any combination thereof. When implemented by software, the functions can be stored in a computer readable medium or transmitted as one or more instructions or codes on a computer readable medium.

[0180] The above detailed description sets forth the purpose, technical solutions and beneficial effects of the present application. It should be understood that the above detailed description is only a specific embodiment of the present application and is not used to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made on the basis of the technical solutions of the present application shall be included in the protection scope of the present application.

Claims

1. A method for implementing a one-key login service, comprising: before a number taking login process between an application client and an operator server is started, an application server receives association information of a terminal device currently running the application client sent by the application client; the application server generates a first device code according to the currently received association information of the terminal device; the application client sends an identity authentication request to the operator server, the operator server generates a token after receiving the identity authentication request, and sends the generated token to the application client, the application client sends a one-key login confirmation request to the application server after obtaining the token sent by the operator server, the one-key login confirmation request carrying the token and the association information of the terminal device currently running the application client; the application server receives the one-key login confirmation request sent by the application client; the application server generates a second device code according to the association information of the terminal device carried in the one-key login confirmation request; the application server performs one-key login service verification processing by using the first device code and the second device code.

2. The method of claim 1, wherein the application server receives the association information of the terminal device currently running the application client sent by the application client before the number taking login process between the application client and the operator server is started, comprising: receiving a one-key login initialization request sent by the application client; obtaining the association information of the terminal device currently running the application client from the one-key login initialization request.

3. The method of claim 1, The application server performs a one-key login service verification process using the first device code and the second device code, including: judging whether the calculated first device code and the second device code are the same, if yes, the one-key login service verification is successful, and a number obtaining request carrying the token is sent to the operator server; if not, the one-key login service verification fails, and the process ends; or, the application server performs one-key login service verification processing by using the first device code and the second device code, comprising: before the number taking login process between the application client and the operator server is started, the application server sends the generated first device code to the application client; the token and the second device code are carried in the number obtaining request and sent to the operator server for one-key login service verification by the operator server.

4. The method of claim 1, wherein the association information of the terminal device comprises at least one of the following: a public network IP address of the terminal device, an intranet IP address of the terminal device, an identifier of a local area network used by the terminal device, and an identification code of the terminal device; and / or, Generating a device code according to association information of a terminal device, comprising: hash calculation is performed on the association information of the terminal device to obtain a device code.

5. A method for implementing a one-key login service, comprising: before a number taking login process between an application client and an operator server is started, the application client sends association information of a terminal device currently running the application client to an application server; The application client sends an identity authentication request to the operator server, so that the operator server generates a token after receiving the identity authentication request and sends the generated token to the application client; After obtaining the token sent by the operator server, the application client sends a one-key login confirmation request to the application server, and the one-key login confirmation request carries the token and the association information of the terminal device currently running the application client; If the application client receives the login authorization sent by the application server, the one-key login is successful.

6. The method of claim 5, wherein, Before the one-key login process between the application client and the operator server is started, the application client sends the association information of the terminal device currently running the application client to the application server, including carrying the association information of the terminal device currently running the application client in a one-key login initialization request and sending the one-key login initialization request to the application server.

7. The method of claim 5, wherein, Before the one-key login process between the application client and the operator server is started, the application client further receives the first device code sent by the application server. Before obtaining the token sent by the operator server, the application client further sends the first device code to the operator server.

8. An implementation method of a one-key login service, comprising: Before the one-key login process between the application client and the operator server is started, the application server receives the association information of the terminal device currently running the application client sent by the application client, generates a first device code according to the currently received association information of the terminal device, and sends the first device code to the application client; After the one-key login process between the application client and the operator server is started, before obtaining the token of the one-key login service, the application client sends the first device code to the operator server; Before generating the token corresponding to the one-key login service, the operator server receives the first device code sent by the application client; The application client sends an identity authentication request to the operator server; The operator server generates a token after receiving the identity authentication request sent by the application client; The operator server sends the generated token to the application client; After obtaining the token sent by the operator server, the application client sends a one-key login confirmation request to the application server, and the one-key login confirmation request carries the token and the association information of the terminal device currently running the application client; the application server generates a second device code according to the association information of the terminal device carried in the one-key login confirmation request, and the application server sends the token and the second device code to the operator server in a number acquisition request; The operator server receives the number acquisition request carrying the token and the second device code sent by the application server; The operator server performs one-key login service verification processing by using the first device code and the second device code in the number acquisition request.

9. The method of claim 8, wherein, The operator server performs a verification process of the one-key login service by using the first device code and the second device code in the number obtaining request, including: determining whether the first device code is same as the second device code, if yes, the verification of the one-key login service is successful, otherwise, the verification of the one-key login service is failed; Or, After the token is generated, further including: establishing a first corresponding relationship between the first device code and the generated token; correspondingly, the operator server performs a verification process of the one-key login service by using the first device code and the second device code in the number obtaining request, including: establishing a second corresponding relationship between the token obtained from the number obtaining request and the second device code; determining whether the first corresponding relationship is consistent with the second corresponding relationship, if yes, the verification of the one-key login service is successful, otherwise, the verification of the one-key login service is failed.

10. An apparatus for implementing a single sign-on service, applied to an application server. The apparatus includes: a first information obtaining module configured to receive, before a number obtaining login process between an application client and an operator server is started, association information of a terminal device currently running the application client sent by the application client; a first device code generating module configured to generate a first device code according to the currently received association information of the terminal device; wherein the application client sends an identity verification request to the operator server, the operator server generates a token after receiving the identity verification request and sends the generated token to the application client, and the application client sends a one-key login confirmation request to the application server after obtaining the token sent by the operator server, the one-key login confirmation request carrying the token and the association information of the terminal device currently running the application client; a second information obtaining module configured to receive the one-key login confirmation request sent by the application client; a second device code generating module configured to generate a second device code according to the association information of the terminal device carried in the one-key login confirmation request; a verification executing module configured to perform a verification process of the one-key login service by using the first device code and the second device code. 11.An apparatus for implementing a one-key login service, applied to an application client, including: a first information sending module configured to send, before a number obtaining login process between the application client and an operator server is started, association information of a terminal device currently running the application client to the application server; wherein the application client sends an identity verification request to the operator server, so that the operator server generates a token after receiving the identity verification request and sends the generated token to the application client; a second information sending module configured to send, after obtaining the token sent by the operator server, a one-key login confirmation request to the application server, the one-key login confirmation request carrying the token and the association information of the terminal device currently running the application client; a login executing module configured to perform a one-key login if a login authorization sent by the application server is received.

12. An apparatus for implementing a one-key login service, applied to an operator server; before starting a number-taking login process between an application client and the operator server, the application server receives association information of a terminal device currently running the application client sent by the application client, generates a first device code according to the currently received association information of the terminal device, and sends the first device code to the application client; after starting the number-taking login process between the application client and the operator server, before obtaining a token of the one-key login service, the application client sends the first device code to the operator server, and then the application client sends an identity authentication request to the operator server. The apparatus includes: The first device code receiving module is configured to receive a first device code sent by an application client before generating a token corresponding to a one-key login service; The token processing module is configured to generate the token after receiving an identity authentication request sent by the application client, and send the generated token to the application client; the application client sends a one-key login confirmation request to an application server after obtaining the token sent by the operator server, the one-key login confirmation request carrying the token and association information of a terminal device currently running the application client; the application server generates a second device code according to the association information of the terminal device carried in the one-key login confirmation request, and sends the token and the second device code to the operator server in a number obtaining request; The second device code receiving module is configured to receive a number obtaining request sent by the application server, the number obtaining request carrying the token and the second device code; The verification processing module is configured to perform verification processing of the one-key login service by using the first device code and the second device code in the number obtaining request.

13. A computing device comprising a memory and a processor, the memory storing executable code, and the processor implementing the method of any one of claims 1-9 when executing the executable code.

Images