Identity authentication method, device, equipment, readable storage medium and product

Abstract

Embodiments of the present application provide an identity authentication method, device, equipment, readable storage medium and product, sending application information for applying to access a second application system to an authentication and authorization center, the application information comprising identity information of a first user and identification information of the second application system, the first user being a user who has not registered an account in the second application system; receiving an authorization token for accessing the second application system fed back by the authentication and authorization center; and sending the authorization token to the second application system, the second application system being configured to grant the first user the permission to access the second application system through a first application system in the case that the authorization token is verified successfully. Embodiments of the present application do not require the user to register and log in repeatedly, and can realize identity authentication of the same user between different systems.

Description

Technical Field

[0001] This application belongs to the field of information security technology, and in particular relates to an identity authentication method, apparatus, device, readable storage medium and product. Background Technology

[0002] User login authentication is the entry point for accessing the host operating system and business application systems. It is the first line of defense for network information security, and reliable identity recognition is crucial to ensuring the security and confidentiality of systems and data.

[0003] Currently, the same user needs to configure multiple accounts and perform repeated login authentications to access multiple different application systems, resulting in inconsistent resource access permissions, failure to achieve single sign-on, and impact on the efficiency of resource sharing and access. Furthermore, the authentication methods of various business applications are diverse and significantly different, which is not conducive to unified management. Summary of the Invention

[0004] This application provides an identity authentication method, apparatus, device, readable storage medium, and product that eliminates the need for users to repeatedly register and log in, enabling the same user to authenticate their identity across different systems.

[0005] In a first aspect, embodiments of this application provide an identity authentication method applied to a first application system, comprising: sending application information to an authentication and authorization center to request access to a second application system, the application information including the identity information of a first user and the identification information of the second application system, wherein the first user is a user who has not registered an account in the second application system; receiving an authorization token for accessing the second application system from the authentication and authorization center; and sending the authorization token to the second application system, wherein the second application system grants the first user permission to access the second application system through the first application system if the authorization token is successfully verified.

[0006] According to the first aspect of this application, before sending the application information for accessing the second application system to the certification and authorization center, the method further includes: receiving a first input from a user requesting access to the second application system; in response to the first input, retrieving the identification information of the second application system from the identification information stored in the first application system; encrypting the application information based on the first encryption key of the first application system to obtain encrypted application information; and sending the application information for accessing the second application system to the certification and authorization center, including: sending the encrypted application information to the certification and authorization center.

[0007] According to any of the foregoing embodiments of the first aspect of this application, the authorization token is generated by encrypting the application information and the ID of the authorization token based on the second encryption key of the second application system; the second application system is used to decrypt the authorization token based on the second decryption key corresponding to the second encryption key to obtain the ID of the authorization token, and send the ID of the authorization token to the certification and authorization center for verification.

[0008] According to any of the foregoing embodiments of the first aspect of this application, the ID of the authorization token is associated with the identification information of the second application system; the authentication and authorization center is used to query the ID of the target authorization token that has the same identification information of the second application system as the ID of the authorization token sent by the second application system, and match the ID of the authorization token sent by the second application system with the ID of the target authorization token. When the ID of the authorization token sent by the second application system matches the ID of the target authorization token successfully, it is determined that the authorization token verification is successful.

[0009] According to any of the foregoing embodiments of the first aspect of this application, the authorization token has a target level permission among a variety of preset different levels of permissions; the second application system is used to grant the first user permissions corresponding to the target level permission in the second application system according to the target level permission granted by the authorization token.

[0010] Secondly, this application provides an identity authentication method applied to an authentication and authorization center, comprising: receiving application information from a first application system requesting access to a second application system, the application information including the identity information of a first user and the identification information of the second application system, wherein the first user is a user who has not registered an account in the second application system; generating an authorization token based on the application information and the ID of the authorization token; sending the authorization token to the first application system, wherein the first application system is used to send the authorization token to the second application system, and the second application system is used to grant the first user permission to access the second application system through the first application system if the authorization token is successfully verified.

[0011] According to any of the foregoing embodiments of the second aspect of this application, the application information includes application information encrypted based on a first encryption key of a first application system; before generating an authorization token based on the application information and the ID of the authorization token, the method further includes: decrypting the encrypted application information based on a first decryption key corresponding to the first encryption key to obtain decrypted application information; generating an authorization token based on the application information and the ID of the authorization token includes: encrypting the application information and the ID of the authorization token based on a second encryption key of a second application system to obtain an authorization token.

[0012] According to any of the foregoing embodiments of the second aspect of this application, the method further includes: receiving the ID of an authorization token sent by a second application system; querying the ID of a target authorization token that has the same identification information of the second application system as the ID of the authorization token sent by the second application system; matching the ID of the authorization token sent by the second application system with the ID of the target authorization token; when the ID of the authorization token sent by the second application system matches the ID of the target authorization token successfully, determining that the authorization token verification is successful; and sending the result of successful authorization token verification to the second application system.

[0013] According to any of the foregoing embodiments of the second aspect of this application, before sending the authorization token to the first application system, the method further includes: selecting a target level permission from a preset set of different levels of permissions and granting it an authorization token; the second application system is used to grant the first user permissions corresponding to the target level permission in the second application system according to the target level permission granted by the authorization token.

[0014] Thirdly, this application provides an identity authentication method applied to a second application system, comprising: receiving an authorization token sent by a first application system, wherein the authorization token is generated by an authentication and authorization center after receiving application information from the first application system requesting access to the second application system, the application information including the identity information of a first user and the identification information of the second application system, wherein the first user is a user who has not registered an account in the second application system; requesting the authentication and authorization center to verify the authorization token; and granting the first user permission to access the second application system through the first application system if the authorization token is successfully verified.

[0015] According to any of the foregoing embodiments of the third aspect of this application, the authorization token is generated by encrypting the application information and the ID of the authorization token based on the second encryption key of the second application system; before requesting the authentication and authorization center to verify the authorization token, the method further includes: decrypting the authorization token based on the second decryption key corresponding to the second encryption key to obtain the ID of the authorization token; requesting the authentication and authorization center to verify the authorization token includes: sending the ID of the authorization token to the authentication and authorization center for verification.

[0016] According to any of the foregoing embodiments of the third aspect of this application, the ID of the authorization token is associated with the identification information of the second application system; the authentication and authorization center is used to query the ID of the target authorization token that has the same identification information of the second application system as the ID of the authorization token sent by the second application system, and match the ID of the authorization token sent by the second application system with the ID of the target authorization token. When the ID of the authorization token sent by the second application system matches the ID of the target authorization token successfully, it is determined that the authorization token verification is successful; in the case of successful authorization token verification, the first user is granted the right to access the second application system through the first application system, including: when the authentication and authorization center receives the result of successful authorization token verification, the first user is granted the right to access the second application system through the first application system.

[0017] According to any of the foregoing embodiments of the third aspect of this application, the authorization token has a target level permission among a variety of preset different levels of permissions; when the authorization token is successfully verified, the first user is granted permission to access the second application system through the first application system, including: granting the first user permission corresponding to the target level permission in the second application system according to the target level permission granted by the authorization token.

[0018] Fourthly, this application provides an identity authentication device applied to a first application system, comprising: a first sending module, configured to send application information for accessing a second application system to an authentication and authorization center, the application information including the identity information of a first user and the identification information of the second application system, wherein the first user is a user who has not registered an account in the second application system; a first receiving module, configured to receive an authorization token for accessing the second application system from the authentication and authorization center; and a second sending module, configured to send the authorization token to the second application system, wherein the second application system, upon successful verification of the authorization token, grants the first user permission to access the second application system through the first application system.

[0019] Fifthly, this application provides an identity authentication device applied to an authentication and authorization center, comprising: a third sending module for receiving application information from a first application system requesting access to a second application system, the application information including the identity information of a first user and the identification information of the second application system, wherein the first user is a user who has not registered an account in the second application system; a generation module for generating an authorization token based on the application information and the ID of the authorization token; and a fourth sending module for sending the authorization token to the first application system, wherein the first application system sends the authorization token to the second application system, and the second application system, upon successful verification of the authorization token, grants the first user permission to access the second application system through the first application system.

[0020] Sixthly, embodiments of this application provide an identity authentication device applied to a second application system, comprising: a second receiving module, configured to receive an authorization token sent by a first application system, the authorization token being generated by an authentication and authorization center after receiving application information from the first application system requesting access to the second application system, the application information including the identity information of a first user and the identification information of the second application system, the first user being a user who has not registered an account in the second application system; a request verification module, configured to request the authentication and authorization center to verify the authorization token; and an authorization module, configured to grant the first user permission to access the second application system through the first application system if the authorization token is successfully verified.

[0021] In a seventh aspect, embodiments of this application provide an electronic device, which includes: a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, it implements the steps of the authentication method provided in the first, second, or third aspects.

[0022] Eighthly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the authentication method provided in the first, second, or third aspects.

[0023] Ninthly, embodiments of this application provide a computer program product stored in a non-volatile storage medium, which is executed by at least one processor to implement the steps of the authentication method provided in the first, second, or third aspects.

[0024] The authentication method, apparatus, device, readable storage medium, and product of this application embodiment send application information to an authentication and authorization center to access a second application system. The application information includes the identity information of a first user and the identification information of the second application system. The first user is a user who has not registered an account in the second application system. The method receives an authorization token from the authentication and authorization center for accessing the second application system. The method then sends the authorization token to the second application system, which, upon successful verification of the authorization token, grants the first user permission to access the second application system through the first application system. In this application embodiment, when the first application system accesses the second application system, the authentication and authorization center and the information exchange between the first and second application systems enable authentication of the same user across different application systems, eliminating the need for repeated user registration and login, thus improving resource sharing efficiency and user experience. Attached Figure Description

[0025] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0026] Figure 1 A schematic diagram of a system architecture used in the identity authentication method provided in the embodiments of this application;

[0027] Figure 2 This is a schematic flowchart of an identity authentication method provided in an embodiment of this application;

[0028] Figure 3 Another flowchart illustrating the identity authentication method provided in this application embodiment;

[0029] Figure 4 This is another flowchart illustrating the identity authentication method provided in the embodiments of this application;

[0030] Figure 5 This is another flowchart illustrating the identity authentication method provided in the embodiments of this application;

[0031] Figure 6 This is another flowchart illustrating the identity authentication method provided in the embodiments of this application;

[0032] Figure 7 This is another flowchart illustrating the identity authentication method provided in the embodiments of this application;

[0033] Figure 8 This is another flowchart illustrating the identity authentication method provided in the embodiments of this application;

[0034] Figure 9 This is another flowchart illustrating the identity authentication method provided in the embodiments of this application;

[0035] Figure 10 A schematic diagram of the hardware structure of the electronic device provided in an embodiment of this application is shown. Detailed Implementation

[0036] The features and exemplary embodiments of various aspects of this application will be described in detail below. To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain this application and not to limit it. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples.

[0037] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes said element.

[0038] It should be understood that the term "and / or" used in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0039] Various modifications and variations can be made to this application without departing from its spirit or scope, which will be apparent to those skilled in the art. Therefore, this application is intended to cover modifications and variations falling within the scope of the corresponding claims (the claimed technical solutions) and their equivalents. It should be noted that the embodiments provided in this application can be combined with each other without contradiction.

[0040] It should be noted that the acquisition, storage, use, and processing of data in this application embodiment all comply with the relevant provisions of national laws and regulations.

[0041] Before describing the technical solutions provided in the embodiments of this application, in order to facilitate understanding of the embodiments of this application, this application first specifically explains the problems existing in the related technologies:

[0042] User login authentication is the entry point for accessing the host operating system and business application systems. It is the first line of defense for network information security, and reliable identity recognition is crucial to ensuring the security and confidentiality of systems and data.

[0043] Currently, the same user needs to configure multiple accounts and perform repeated login authentications to access multiple different application systems, resulting in inconsistent resource access permissions, failure to achieve single sign-on, and impact on the efficiency of resource sharing and access. Furthermore, the authentication methods of various business applications are diverse and significantly different, which is not conducive to unified management.

[0044] In view of the inventors’ above-mentioned research findings, the embodiments of this application provide an identity authentication method, apparatus, device, readable storage medium and product, which can solve the above-mentioned technical problems existing in the related art.

[0045] The technical concept of this application embodiment is that when the first application system accesses the second application system, the same user can be authenticated between different application systems through the authentication and authorization center and the information interaction between the first application system and the second application system, without the need for the user to register and log in repeatedly, thereby improving the efficiency of resource sharing and access and the user experience.

[0046] Figure 1 This is a schematic diagram of a system architecture used in the identity authentication method provided in the embodiments of this application. Figure 1 As shown in the embodiments of this application, the identity authentication method can be applied to an identity authentication system 10, which may include a first application system 101, an authentication and authorization center 102, and a second application system 103. Both the first application system 101 and the second application system 103 can interact with the authentication and authorization center 102. Data interaction can also occur between the first application system 101 and the second application system 103. The first application system 101 and the second application system 103 can be different application software (APPs). The authentication and authorization center 102 can be a server, used to uniformly provide identity authentication and authorization for various application systems, enabling interoperability of user access between systems with different user systems.

[0047] In a first aspect, embodiments of this application provide an identity authentication method. The identity authentication method provided in the first aspect can be applied to a first application system 101.

[0048] Figure 2 This is a schematic flowchart illustrating an identity authentication method provided in an embodiment of this application. Figure 2 As shown, the identity authentication method may include the following steps S201 to S203.

[0049] S201. Send the application information for accessing the second application system to the authentication and authorization center. The application information includes the identity information of the first user and the identification information of the second application system. The first user is a user who has not registered an account in the second application system.

[0050] In this context, the first user can be a user who has not registered an account in the second application system, i.e., a user who has not undergone identity authentication. The first user's identity information can be any information that can identify the first user, such as the first user's name, account ID, etc. The second application system's identification information can be any information that can distinguish the second application system. For example, in some examples, the second application system's identification information may include the second application system's Security Identifier (SID). The SID can serve a two-way labeling function; besides distinguishing the second application system, it can also indicate which application system accessed the second application system from, i.e., determine the identity of the first application system.

[0051] It should be noted that the acquisition, storage, use, and processing of data in this application embodiment all comply with the relevant provisions of national laws and regulations.

[0052] S202. Receive the authorization token for accessing the second application system from the authentication and authorization center.

[0053] After receiving the application information from the first application system requesting access to the second application system, the authentication and authorization center will send an authorization token to the first application system to enable it to access the second application system.

[0054] S203. Send an authorization token to the second application system.

[0055] Next, the first application system sends the obtained authorization token to the second application system. The second application system, upon successful verification of the authorization token, grants the first user permission to access the second application system through the first application system.

[0056] The authentication method in this embodiment sends an application to an authentication and authorization center for access to a second application system. The application information includes the identity information of a first user and the identification information of the second application system. The first user is a user who has not registered an account on the second application system. The method receives an authorization token from the authentication and authorization center for accessing the second application system. The authorization token is then sent to the second application system, which, upon successful verification of the authorization token, grants the first user permission to access the second application system through the first application system. In this embodiment, when the first application system accesses the second application system, the authentication and authorization center and the information exchange between the first and second application systems enable authentication of the same user across different application systems, eliminating the need for repeated registration and login, thus improving resource sharing efficiency and user experience.

[0057] In some embodiments, a communication mechanism can be established between the first application system and the second application system. The first application system can pre-store the identification information of the second application system, such as the SID of the second application system. When accessing the second application system, the identification information of the second application system can be retrieved.

[0058] To ensure the security of data transmission, in some embodiments, the first application system may also encrypt the application information based on the first encryption key of the first application system, and then send the encrypted application information to the certification and authorization center.

[0059] Figure 3 This is another schematic diagram of the identity authentication method provided in an embodiment of this application. Figure 3 As shown, according to some embodiments of this application, optionally, before sending the application information for accessing the second application system to the authentication and authorization center in S201, the identity authentication method may further include the following steps S301 to S303.

[0060] S301, Receive the first input from the user who expects to access the second application system.

[0061] S302. In response to the first input, retrieve the identification information of the second application system from the identification information stored in the first application system.

[0062] S303. The application information is encrypted using the first encryption key of the first application system to obtain the encrypted application information.

[0063] Accordingly, S201, send the application information for accessing the second application system to the certification and authorization center, which may specifically include the following steps:

[0064] Send the encrypted application information to the certification and authorization center.

[0065] Thus, by encrypting the application information with the first encryption key of the first application system, the security of the application information transmission can be improved.

[0066] To ensure data transmission security, in some embodiments, the authorization token can be generated by encrypting the application information and the authorization token ID (i.e., tokenID) using a second encryption key based on the second application system. Specifically, after receiving the encrypted application information, the authentication and authorization center can decrypt the encrypted application information using a first decryption key corresponding to the first encryption key to obtain the decrypted application information. Then, it encrypts the application information and the authorization token ID using the second encryption key of the second application system to obtain the authorization token. For example, the authorization token (token) can be generated by encrypting the first user's identity information, the second application system's identification information, and the authorization token ID using the second encryption key of the second application system.

[0067] The second application system can be used to decrypt the authorization token based on the second decryption key corresponding to the second encryption key, obtain the authorization token ID, and send the authorization token ID to the authentication and authorization center for verification.

[0068] Thus, by generating an authorization token by encrypting the application information and the ID (i.e., tokenID) of the authorization token using the second encryption key based on the second application system, the security of data transmission of the authorization token can be improved.

[0069] According to some embodiments of this application, optionally, the ID of the authorization token can be associated with the identification information of the second application system. That is, there is an association between the tokenID and the SID of the second application system. For example, one tokenID can correspond to one SID of the second application system.

[0070] The authentication and authorization center can query the ID of the target authorization token (i.e., the stored tokenID) that has the same identification information as the authorization token sent by the second application system. It then matches the ID of the authorization token sent by the second application system with the ID of the target authorization token. When the ID of the authorization token sent by the second application system matches the ID of the target authorization token, the authorization token is confirmed to have been successfully verified.

[0071] According to some embodiments of this application, optionally, different users can have different levels of permissions. The authentication and authorization center can select a target level of permission from a variety of preset permission levels and assign it an authorization token. The second application system can then grant the first user permissions corresponding to the target level of permission in the second application system based on the target level of permission granted by the authorization token.

[0072] For example, when the authorization token is granted level A permissions, the first user is granted the permissions corresponding to level A permissions in the second application system; when the authorization token is granted level B permissions, the first user is granted the permissions corresponding to level B permissions in the second application system; when the authorization token is granted level C permissions, the first user is granted the permissions corresponding to level C permissions in the second application system.

[0073] This allows for flexible configuration of different levels of permissions, meeting the needs of different application scenarios.

[0074] Secondly, embodiments of this application provide an identity authentication method. The identity authentication method provided in this second aspect can be applied to the authentication and authorization center 102.

[0075] Figure 4 This is another schematic diagram of the authentication method provided in the embodiments of this application. Figure 4 As shown, the identity authentication method may include the following steps S401 to S403.

[0076] S401. Receive the application information sent by the first application system to access the second application system. The application information includes the identity information of the first user and the identification information of the second application system. The first user is a user who has not registered an account in the second application system.

[0077] In this context, the first user can be a user who has not registered an account in the second application system, i.e., a user who has not undergone identity authentication. The first user's identity information can be any information that can identify the first user, such as the first user's name, account ID, etc. The second application system's identification information can be any information that can distinguish the second application system. For example, in some examples, the second application system's identification information may include the second application system's Security Identifier (SID). The SID can serve a two-way labeling function; besides distinguishing the second application system, it can also indicate which application system accessed the second application system from, i.e., determine the identity of the first application system.

[0078] S402. Generate an authorization token based on the application information and the ID of the authorization token.

[0079] S403, Send an authorization token to the first application system.

[0080] The authentication and authorization center can send an authorization token to the first application system. The first application system then sends the authorization token to the second application system, which, upon successful verification of the authorization token, grants the first user permission to access the second application system through the first application system.

[0081] The authentication method in this application embodiment enables the same user to authenticate their identity across different application systems when the first application system accesses the second application system. This is achieved through the authentication and authorization center and the information exchange between the first and second application systems, eliminating the need for repeated user registration and login, thus improving resource sharing access efficiency and user experience.

[0082] To ensure the security of data transmission, in some embodiments, the application information may be encrypted based on the first encryption key of the first application system.

[0083] Before generating the authorization token based on the application information and the authorization token ID in S402, the authentication method may also include the following steps:

[0084] The encrypted application information is decrypted using the first decryption key corresponding to the first encryption key to obtain the decrypted application information.

[0085] Accordingly, S402, based on the application information and the ID of the authorization token, generates an authorization token, which may specifically include the following steps:

[0086] The application information and the ID of the authorization token are encrypted using the second encryption key of the second application system to obtain the authorization token.

[0087] Thus, encrypting the application information with the first encryption key in the first application system improves the security of data transmission of the application information. Generating an authorization token by encrypting the application information and the authorization token's ID (i.e., tokenID) with the second encryption key in the second application system improves the security of data transmission of the authorization token.

[0088] Figure 5 This is another schematic diagram of the authentication method provided in the embodiments of this application. Figure 5 As shown, the identity authentication method may further include the following steps S501 to S505.

[0089] S501, Receive the ID of the authorization token sent by the second application system.

[0090] S502. Query the ID of the target authorization token that has the same identification information as the ID of the authorization token sent by the second application system.

[0091] S503. Match the ID of the authorization token sent by the second application system with the ID of the target authorization token.

[0092] S504. When the ID of the authorization token sent by the second application system matches the ID of the target authorization token, the authorization token verification is successful.

[0093] S505: Send the successful authorization token verification result to the second application system.

[0094] Thus, by verifying the ID of the authorization token (i.e., tokenID), the authorization token can be verified. By associating the ID of the authorization token with the identification information of the second application system, the rationality and accuracy of the verification can be further improved.

[0095] Figure 6 This is another schematic diagram of the authentication method provided in the embodiments of this application. Figure 6 As shown, according to some embodiments of this application, optionally, before sending the authorization token to the first application system in S403, the identity authentication method may further include the following steps:

[0096] S601. Select the target level permission from a variety of preset permission levels and grant an authorization token.

[0097] The second application system is used to grant the first user permissions corresponding to the target level permissions in the second application system based on the target level permissions granted by the authorization token.

[0098] Different users can have different levels of permissions. The authentication and authorization center can select a target level of permission from a variety of preset permission levels and assign an authorization token. The second application system can then use this authorization token to grant the first user permissions corresponding to the target level of permission within the second application system.

[0099] For example, when the authorization token is granted level A permissions, the first user is granted the permissions corresponding to level A permissions in the second application system; when the authorization token is granted level B permissions, the first user is granted the permissions corresponding to level B permissions in the second application system; when the authorization token is granted level C permissions, the first user is granted the permissions corresponding to level C permissions in the second application system.

[0100] This allows for flexible configuration of different levels of permissions, meeting the needs of different application scenarios.

[0101] Thirdly, embodiments of this application provide an identity authentication method. The identity authentication method provided in this third aspect can be applied to the second application system 103.

[0102] Figure 7 This is another schematic diagram of the authentication method provided in the embodiments of this application. Figure 7 As shown, the identity authentication method may include the following steps S701 to S703.

[0103] S701. Receive the authorization token sent by the first application system. The authorization token is generated by the authentication and authorization center after receiving the application information sent by the first application system to access the second application system. The application information includes the identity information of the first user and the identification information of the second application system. The first user is a user who has not registered an account in the second application system.

[0104] S702. Request the authentication and authorization center to verify the authorization token.

[0105] After receiving the authorization token sent by the first application system, the second application system can request the authentication and authorization center to verify the authorization token.

[0106] S703. If the authorization token is successfully verified, grant the first user permission to access the second application system through the first application system.

[0107] The authentication method in this application embodiment enables the same user to authenticate their identity across different application systems when the first application system accesses the second application system. This is achieved through the authentication and authorization center and the information exchange between the first and second application systems, eliminating the need for repeated user registration and login, thus improving resource sharing access efficiency and user experience.

[0108] To ensure data transmission security, in some embodiments, the authorization token can be generated by encrypting the application information and the authorization token ID (i.e., tokenID) using a second encryption key based on the second application system. Specifically, after receiving the encrypted application information, the authentication and authorization center can decrypt the encrypted application information using a first decryption key corresponding to the first encryption key to obtain the decrypted application information. Then, it encrypts the application information and the authorization token ID using the second encryption key of the second application system to obtain the authorization token. For example, the authorization token (token) can be generated by encrypting the first user's identity information, the second application system's identification information, and the authorization token ID using the second encryption key of the second application system.

[0109] Figure 8 This is another schematic diagram of the authentication method provided in the embodiments of this application. Figure 8 As shown, according to some embodiments of this application, optionally, before requesting verification of the authorization token from the authentication and authorization center in S702, the identity authentication method may further include the following steps:

[0110] S801. Decrypt the authorization token based on the second decryption key corresponding to the second encryption key to obtain the ID of the authorization token.

[0111] S702. Request the authentication and authorization center to verify the authorization token. Specifically, this may include the following steps: send the ID of the authorization token to the authentication and authorization center for verification.

[0112] According to some embodiments of this application, optionally, the ID of the authorization token is associated with the identification information of the second application system. The authentication and authorization center is used to query the ID of the target authorization token that has the same identification information of the second application system as the ID of the authorization token sent by the second application system, and to match the ID of the authorization token sent by the second application system with the ID of the target authorization token. When the ID of the authorization token sent by the second application system matches the ID of the target authorization token successfully, it is determined that the authorization token verification is successful.

[0113] Accordingly, S703, if the authorization token is successfully verified, the first user is granted permission to access the second application system through the first application system, including:

[0114] When the authorization token sent by the authentication and authorization center is successfully verified, the first user is granted permission to access the second application system through the first application system.

[0115] According to some embodiments of this application, optionally, the authorization token has a target level of permission among a preset set of different levels of permissions.

[0116] Accordingly, S703, if the authorization token is successfully verified, the first user is granted permission to access the second application system through the first application system, including:

[0117] Based on the target level permissions granted by the authorization token, grant the first user the permissions corresponding to the target level permissions in the second application system.

[0118] Different users can have different levels of permissions. The authentication and authorization center can select a target level of permission from a variety of preset permission levels and assign an authorization token. The second application system can then use this authorization token to grant the first user permissions corresponding to the target level of permission within the second application system.

[0119] For example, when the authorization token is granted level A permissions, the first user is granted the permissions corresponding to level A permissions in the second application system; when the authorization token is granted level B permissions, the first user is granted the permissions corresponding to level B permissions in the second application system; when the authorization token is granted level C permissions, the first user is granted the permissions corresponding to level C permissions in the second application system.

[0120] This allows for flexible configuration of different levels of permissions, meeting the needs of different application scenarios.

[0121] Fourthly, embodiments of this application provide an identity authentication method. The identity authentication method provided in this fourth aspect can be applied to the identity authentication system 10.

[0122] Figure 9 This is another schematic diagram of the authentication method provided in the embodiments of this application. Figure 9 As shown, according to some embodiments of this application, optionally, the identity authentication method may include the following steps S901 to S906.

[0123] S901, The first application system encrypts the application information based on the first encryption key of the first application system and sends the encrypted application information to the certification and authorization center.

[0124] S902, the authentication and authorization center decrypts and verifies the encrypted application information based on the first decryption key corresponding to the first encryption key, and encrypts the application information and the ID of the authorization token based on the second encryption key of the second application system to obtain the authorization token, and returns it to the first application system.

[0125] S903, The first application system accesses the second application system and sends the authorization token to the second application system.

[0126] S904. The second application system decrypts the authorization token based on the second decryption key corresponding to the second encryption key to obtain the authorization token ID, and sends the authorization token ID to the authentication and authorization center for verification.

[0127] S905. The authentication and authorization center verifies the ID of the authorization token and sends the verification result to the second application system.

[0128] S906. After the ID verification of the authorization token is successful, the second application system grants the first user permission to access the second application system through the first application system.

[0129] The authentication method in this application embodiment enables the same user to authenticate their identity across different application systems when the first application system accesses the second application system. This is achieved through the authentication and authorization center and the information exchange between the first and second application systems, eliminating the need for repeated user registration and login, thus improving resource sharing access efficiency and user experience.

[0130] Fifthly, embodiments of this application provide an identity authentication device applied to a first application system. The identity authentication device includes the following modules:

[0131] The first sending module is used to send application information for accessing the second application system to the authentication and authorization center. The application information includes the identity information of the first user and the identification information of the second application system. The first user is a user who has not registered an account in the second application system.

[0132] The first receiving module is used to receive the authorization token for accessing the second application system fed back by the authentication and authorization center;

[0133] The second sending module is used to send the authorization token to the second application system. The second application system is used to grant the first user permission to access the second application system through the first application system if the authorization token is successfully verified.

[0134] The identity authentication device in this application embodiment enables the same user to authenticate their identity across different application systems when the first application system accesses the second application system. This is achieved through the authentication and authorization center and the information exchange between the first and second application systems, eliminating the need for repeated user registration and login, thus improving resource sharing access efficiency and user experience.

[0135] In some embodiments, the identity authentication device may further include a first encryption module, configured to receive a first input from a user requesting access to a second application system; in response to the first input, retrieve the identification information of the second application system from the identification information stored in the first application system; and encrypt the application information based on a first encryption key of the first application system to obtain the encrypted application information. The first sending module is specifically configured to send the encrypted application information to an authentication and authorization center.

[0136] In some embodiments, the authorization token is generated by encrypting the application information and the ID of the authorization token based on the second encryption key of the second application system; the second application system is used to decrypt the authorization token based on the second decryption key corresponding to the second encryption key to obtain the ID of the authorization token, and send the ID of the authorization token to the authentication and authorization center for verification.

[0137] In some embodiments, the ID of the authorization token is associated with the identification information of the second application system; the authentication and authorization center is used to query the ID of a target authorization token that has the same identification information of the second application system as the ID of the authorization token sent by the second application system, and match the ID of the authorization token sent by the second application system with the ID of the target authorization token. When the ID of the authorization token sent by the second application system matches the ID of the target authorization token successfully, it is determined that the authorization token has been successfully verified.

[0138] In some embodiments, the authorization token has a target level permission among a variety of preset different levels of permissions; the second application system is used to grant the first user permissions in the second application system corresponding to the target level permission according to the target level permission granted by the authorization token.

[0139] Sixthly, embodiments of this application provide an identity authentication device applied in an authentication and authorization center. The identity authentication device includes the following modules:

[0140] The third sending module is used to receive the application information for accessing the second application system sent by the first application system. The application information includes the identity information of the first user and the identification information of the second application system. The first user is a user who has not registered an account in the second application system.

[0141] The generation module is used to generate an authorization token based on the application information and the ID of the authorization token;

[0142] The fourth sending module is used to send the authorization token to the first application system. The first application system is used to send the authorization token to the second application system. The second application system is used to grant the first user permission to access the second application system through the first application system if the authorization token is successfully verified.

[0143] The identity authentication device in this application embodiment enables the same user to authenticate their identity across different application systems when the first application system accesses the second application system. This is achieved through the authentication and authorization center and the information exchange between the first and second application systems, eliminating the need for repeated user registration and login, thus improving resource sharing access efficiency and user experience.

[0144] In some embodiments, the application information includes application information encrypted using a first encryption key of the first application system. The authentication device may further include a first decryption module, configured to decrypt the encrypted application information using a first decryption key corresponding to the first encryption key, to obtain the decrypted application information. The generation module is specifically configured to encrypt the application information and the ID of the authorization token using a second encryption key of the second application system, to obtain the authorization token.

[0145] In some embodiments, the identity authentication device may further include a verification module, configured to receive the ID of the authorization token sent by the second application system; query the ID of a target authorization token that has the same identification information of the second application system as the ID of the authorization token sent by the second application system; match the ID of the authorization token sent by the second application system with the ID of the target authorization token; when the ID of the authorization token sent by the second application system matches the ID of the target authorization token successfully, determine that the authorization token has been successfully verified; and send the result of the successful verification of the authorization token to the second application system.

[0146] In some embodiments, the identity authentication device may further include a permission allocation module, which is used to select a target level permission from a variety of preset different levels of permissions and assign it to the authorization token; the second application system is used to grant the first user permissions in the second application system corresponding to the target level permission according to the target level permission assigned by the authorization token.

[0147] Seventhly, embodiments of this application provide an identity authentication device applied to a second application system. The identity authentication device includes the following modules:

[0148] The second receiving module is used to receive the authorization token sent by the first application system. The authorization token is generated by the authentication and authorization center after receiving the application information sent by the first application system to access the second application system. The application information includes the identity information of the first user and the identification information of the second application system. The first user is a user who has not registered an account in the second application system.

[0149] The request verification module is used to request the authentication and authorization center to verify the authorization token;

[0150] The authorization module is used to grant the first user permission to access the second application system through the first application system if the authorization token is successfully verified.

[0151] The identity authentication device in this application embodiment enables the same user to authenticate their identity across different application systems when the first application system accesses the second application system. This is achieved through the authentication and authorization center and the information exchange between the first and second application systems, eliminating the need for repeated user registration and login, thus improving resource sharing access efficiency and user experience.

[0152] In some embodiments, the authorization token is generated by encrypting the application information and the ID of the authorization token using a second encryption key of the second application system. The identity authentication device may further include a second decryption module, used to decrypt the authorization token using a second decryption key corresponding to the second encryption key to obtain the ID of the authorization token. The request verification module is specifically used to send the ID of the authorization token to the authentication and authorization center for verification.

[0153] In some embodiments, the ID of the authorization token is associated with the identification information of the second application system. The authentication and authorization center is used to query the ID of a target authorization token that has the same identification information of the second application system as the ID of the authorization token sent by the second application system, and to match the ID of the authorization token sent by the second application system with the ID of the target authorization token. When the ID of the authorization token sent by the second application system matches the ID of the target authorization token successfully, it is determined that the authorization token has been successfully verified. Specifically, the authorization module is used to grant the first user permission to access the second application system through the first application system when it receives the result of successful authorization token verification from the authentication and authorization center.

[0154] In some embodiments, the authorization token has a target level permission among a set of preset permission levels. Specifically, the authorization module is used to grant the first user permissions corresponding to the target level permission in the second application system, based on the target level permission granted by the authorization token.

[0155] Based on the identity authentication method provided in the above embodiments, this application also provides specific implementation methods for electronic devices. Please refer to the following embodiments.

[0156] Figure 10 A schematic diagram of the hardware structure of the electronic device provided in an embodiment of this application is shown.

[0157] The electronic device may include a processor 1001 and a memory 1002 storing computer program instructions.

[0158] Specifically, the processor 1001 may include a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0159] Memory 1002 may include mass storage for data or instructions. For example, and not limitingly, memory 1002 may include a hard disk drive (HDD), floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or Universal Serial Bus (USB) drive, or a combination of two or more of these. In one example, memory 1002 may include removable or non-removable (or fixed) media, or memory 1002 may be a non-volatile solid-state memory. Memory 1002 may be internal or external to an electronic device.

[0160] In one example, memory 1002 may be read-only memory (ROM). In one example, the ROM may be a mask-programmed ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (EEPROM), an electrically rewritable ROM (EAROM), or flash memory, or a combination of two or more of these.

[0161] Memory 1002 may include read-only memory (ROM), random access memory (RAM), disk storage media device, optical storage media device, flash memory device, electrical, optical, or other physical / tangible memory storage device. Therefore, typically, memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to one aspect of this application.

[0162] The processor 1001 reads and executes the computer program instructions stored in the memory 1002 to implement the methods / steps in the above method embodiments and achieve the corresponding technical effects achieved by the method embodiments in executing their methods / steps. For the sake of brevity, these details will not be repeated here.

[0163] In one example, the electronic device may also include a communication interface 1003 and a bus 1010. For example, Figure 10 As shown, the processor 1001, memory 1002, and communication interface 1003 are connected through bus 1010 and complete communication with each other.

[0164] The communication interface 1003 is mainly used to realize communication between various modules, devices, units and / or equipment in the embodiments of this application.

[0165] Bus 1010 includes hardware, software, or both, that couples components of an electronic device together. For example, and not limitingly, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Extended Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Microchannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local (VLB) bus, or other suitable buses, or combinations of two or more of these. Where appropriate, bus 1010 may include one or more buses. Although specific buses are described and illustrated in embodiments of this application, this application contemplates any suitable bus or interconnect.

[0166] Furthermore, in conjunction with the authentication methods in the above embodiments, this application embodiment can provide a computer-readable storage medium for implementation. This computer-readable storage medium stores computer program instructions; when these computer program instructions are executed by a processor, they implement any of the authentication methods in the above embodiments. Examples of computer-readable storage media include non-transitory computer-readable storage media, such as electronic circuits, semiconductor memory devices, ROM, random access memory, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, and hard disks.

[0167] In conjunction with the authentication methods in the above embodiments, this application embodiment can provide a computer program product, which is stored in a non-volatile storage medium and executed by at least one processor to implement the steps of the authentication methods provided in the above embodiments.

[0168] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0169] The functional blocks shown in the above-described block diagram can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. Programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, etc. Code segments can be downloaded via computer networks such as the Internet, intranets, etc.

[0170] It should also be noted that the exemplary embodiments mentioned in this application describe methods or systems based on a series of steps or apparatus. However, this application is not limited to the order of the above steps; that is, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0171] The aspects of this application have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by dedicated hardware performing the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions.

[0172] The above description is merely a specific implementation of this application. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the protection scope of this application.

Claims

1. An identity authentication method, characterized in that, Applied to the first application system, including: Send an application to the authentication and authorization center to access the second application system. The application information includes the identity information of the first user and the identification information of the second application system. The first user is a user who has not registered an account in the second application system. Receive the authorization token for accessing the second application system from the authentication and authorization center; The authorization token is sent to the second application system, which, if the authorization token is successfully verified, grants the first user permission to access the second application system through the first application system. The authorization token is generated by encrypting the application information and the ID of the authorization token based on the second encryption key of the second application system; The second application system is used to decrypt the authorization token based on the second decryption key corresponding to the second encryption key, obtain the ID of the authorization token, and send the ID of the authorization token to the authentication and authorization center for verification; The ID of the authorization token is associated with the identification information of the second application system; the authentication and authorization center is used to query the ID of the target authorization token that has the same identification information of the second application system as the ID of the authorization token sent by the second application system, and match the ID of the authorization token sent by the second application system with the ID of the target authorization token. When the ID of the authorization token sent by the second application system matches the ID of the target authorization token successfully, it is determined that the authorization token has been successfully verified.

2. The identity authentication method according to claim 1, characterized in that, Before sending the application information for access to the second application system to the certification and authorization center, the method further includes: Receive the user's first input requesting access to the second application system; In response to the first input, the identification information of the second application system is retrieved from the identification information stored in the first application system; The application information is encrypted using the first encryption key of the first application system to obtain the encrypted application information; The step of sending the application information to the authentication and authorization center to access the second application system includes: Send the encrypted application information to the certification and authorization center.

3. The identity authentication method according to claim 1, characterized in that, The authorization token has a target level of permission among a variety of preset different levels of permissions; The second application system is used to grant the first user permissions in the second application system corresponding to the target level permissions based on the target level permissions granted by the authorization token.

4. An identity authentication method, characterized in that, Applied to certification and authorization centers, including: The system receives an application from the first application system to access the second application system. The application information includes the identity information of the first user and the identification information of the second application system. The first user is a user who has not registered an account in the second application system. An authorization token is generated based on the application information and the ID of the authorization token; the authorization token is generated by encrypting the application information and the ID of the authorization token using the second encryption key of the second application system. The authorization token is sent to the first application system. The first application system sends the authorization token to the second application system. The second application system grants the first user permission to access the second application system through the first application system if the authorization token is successfully verified. The system receives the ID of the authorization token sent by the second application system; the ID of the authorization token is obtained by the second application system decrypting the authorization token based on the second decryption key corresponding to the second encryption key; the ID of the authorization token is associated with the identification information of the second application system. Query the ID of the target authorization token that has the same identification information as the authorization token sent by the second application system; Match the ID of the authorization token sent by the second application system with the ID of the target authorization token; When the ID of the authorization token sent by the second application system matches the ID of the target authorization token, the authorization token is determined to have been successfully verified. The result of successful verification of the authorization token is sent to the second application system.

5. The identity authentication method according to claim 4, characterized in that, The application information includes application information encrypted using the first encryption key of the first application system; Before generating the authorization token based on the application information and the ID of the authorization token, the method further includes: The encrypted application information is decrypted using the first decryption key corresponding to the first encryption key to obtain the decrypted application information.

6. The identity authentication method according to claim 4, characterized in that, Before sending the authorization token to the first application system, the method further includes: From a variety of preset permission levels, select the target permission level and assign it to the authorization token; The second application system is used to grant the first user permissions in the second application system corresponding to the target level permissions based on the target level permissions granted by the authorization token.

7. An identity authentication method, characterized in that, Applied to the second application system, including: The system receives an authorization token sent by the first application system. The authorization token is generated by the authentication and authorization center after receiving the application information sent by the first application system requesting access to the second application system. The application information includes the identity information of the first user and the identification information of the second application system. The first user is a user who has not registered an account in the second application system. Request the authentication and authorization center to verify the authorization token; If the authorization token is successfully verified, the first user is granted permission to access the second application system through the first application system. The authorization token is generated by encrypting the application information and the ID of the authorization token based on the second encryption key of the second application system; Before requesting verification of the authorization token from the authentication and authorization center, the method further includes: The authorization token is decrypted based on the second decryption key corresponding to the second encryption key to obtain the ID of the authorization token; The step of requesting the authentication and authorization center to verify the authorization token includes: Send the ID of the authorization token to the authentication and authorization center for verification; The ID of the authorization token is associated with the identification information of the second application system; the authentication and authorization center is used to query the ID of the target authorization token that has the same identification information of the second application system as the ID of the authorization token sent by the second application system, and match the ID of the authorization token sent by the second application system with the ID of the target authorization token. When the ID of the authorization token sent by the second application system matches the ID of the target authorization token successfully, it is determined that the authorization token has been successfully verified. If the authorization token is successfully verified, granting the first user permission to access the second application system through the first application system includes: When the authentication and authorization center receives a successful verification result for the authorization token, the first user is granted permission to access the second application system through the first application system.

8. The identity authentication method according to claim 7, characterized in that, The authorization token has a target level of permission among a variety of preset different levels of permissions; If the authorization token is successfully verified, granting the first user permission to access the second application system through the first application system includes: Based on the target level permissions granted by the authorization token, the first user is granted permissions in the second application system corresponding to the target level permissions.

9. An identity authentication device, characterized in that, Applied to the first application system, including: The first sending module is used to send application information for accessing the second application system to the authentication and authorization center. The application information includes the identity information of the first user and the identification information of the second application system. The first user is a user who has not registered an account in the second application system. The first receiving module is used to receive the authorization token for accessing the second application system fed back by the authentication and authorization center; The second sending module is used to send the authorization token to the second application system. The second application system is used to grant the first user permission to access the second application system through the first application system if the authorization token is successfully verified. The authorization token is generated by encrypting the application information and the ID of the authorization token based on the second encryption key of the second application system; The second application system is used to decrypt the authorization token based on the second decryption key corresponding to the second encryption key, obtain the ID of the authorization token, and send the ID of the authorization token to the authentication and authorization center for verification; The ID of the authorization token is associated with the identification information of the second application system; the authentication and authorization center is used to query the ID of the target authorization token that has the same identification information of the second application system as the ID of the authorization token sent by the second application system, and match the ID of the authorization token sent by the second application system with the ID of the target authorization token. When the ID of the authorization token sent by the second application system matches the ID of the target authorization token successfully, it is determined that the authorization token has been successfully verified.

10. An identity authentication device, characterized in that, Applied to certification and authorization centers, including: The third sending module is used to receive the application information for accessing the second application system sent by the first application system. The application information includes the identity information of the first user and the identification information of the second application system. The first user is a user who has not registered an account in the second application system. A generation module is used to generate an authorization token based on the application information and the ID of the authorization token; the authorization token is generated by encrypting the application information and the ID of the authorization token based on the second encryption key of the second application system; a fourth sending module is used to send the authorization token to the first application system, the first application system is used to send the authorization token to the second application system, and the second application system is used to grant the first user permission to access the second application system through the first application system if the authorization token is successfully verified. The verification module is configured to receive the ID of the authorization token sent by the second application system; the ID of the authorization token is obtained by the second application system decrypting the authorization token based on a second decryption key corresponding to the second encryption key; the ID of the authorization token is associated with the identification information of the second application system; query the ID of a target authorization token that has the same identification information as the ID of the authorization token sent by the second application system; match the ID of the authorization token sent by the second application system with the ID of the target authorization token; when the ID of the authorization token sent by the second application system matches the ID of the target authorization token successfully, determine that the authorization token has been successfully verified; and send the result of the successful verification of the authorization token to the second application system.

11. An identity authentication device, characterized in that, Applied to the second application system, including: The second receiving module is used to receive the authorization token sent by the first application system. The authorization token is generated by the authentication and authorization center after receiving the application information sent by the first application system to access the second application system. The application information includes the identity information of the first user and the identification information of the second application system. The first user is a user who has not registered an account in the second application system. The request verification module is used to request the authentication and authorization center to verify the authorization token; The authorization module is used to grant the first user permission to access the second application system through the first application system if the authorization token is successfully verified. The authorization token is generated by encrypting the application information and the ID of the authorization token based on the second encryption key of the second application system; The second decryption module is used to decrypt the authorization token based on the second decryption key corresponding to the second encryption key to obtain the ID of the authorization token; The request verification module is used to send the ID of the authorization token to the authentication and authorization center for verification; The ID of the authorization token is associated with the identification information of the second application system; the authentication and authorization center is used to query the ID of the target authorization token that has the same identification information of the second application system as the ID of the authorization token sent by the second application system, and match the ID of the authorization token sent by the second application system with the ID of the target authorization token. When the ID of the authorization token sent by the second application system matches the ID of the target authorization token successfully, it is determined that the authorization token has been successfully verified. The authorization module is used to grant the first user permission to access the second application system through the first application system when it receives a successful verification result of the authorization token sent by the authentication and authorization center.

12. An electronic device, characterized in that, The electronic device includes: a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the authentication method as described in any one of claims 1 to 8.

13. A computer-readable storage medium, characterized in that, A computer program is stored on the computer-readable storage medium, which, when executed by a processor, implements the steps of the authentication method as described in any one of claims 1 to 8.

14. A computer program product, characterized in that, The computer program product is stored in a non-volatile storage medium, and the computer program product is executed by at least one processor to implement the steps of the authentication method as described in any one of claims 1 to 8.

Images