Permission acquisition method and apparatus, electronic device, and storage medium

Abstract

The application relates to a permission acquisition method and device, electronic equipment and a storage medium. The method comprises the following steps: in response to a permission acquisition request sent by a second platform, generating page description information based on the permission acquisition request, and sending the page description information to the second platform; in response to acquired first object feature data, performing first authentication processing on the first object feature data; when a first result of the first authentication processing indicates that the authentication is passed, a feedback result of a target object obtaining a use permission of a specified business service is generated. The application improves the efficiency and convenience of the target object acquiring the related use permission, reduces the difficulty and cost of the second platform participating in the permission acquisition, and improves the storage security of the object feature data. The application can be applied to various scenes such as cloud technology, artificial intelligence, intelligent transportation and auxiliary driving.

Description

Technical Field

[0001] This application relates to the field of Internet communication technology, and in particular to a method, apparatus, electronic device and storage medium for obtaining permissions. Background Technology

[0002] With the development of internet communication technology, various internet products have emerged, and the functions provided by these products can bring convenience to users' work and life. The implementation of these functions may require support from at least one platform. When the supporting platforms belong to different maintenance parties (such as different companies), establishing the relationships between these relevant entities becomes crucial.

[0003] Taking a first platform, a second platform, and a user on the second platform as examples, if a user needs to obtain access to business services provided by the first platform, the relevant technologies commonly employ the following two methods: 1) The second platform calls the interface provided by the first platform to obtain the corresponding access permissions for the user; 2) The second platform receives information provided by the user for management purposes, and this information indicates the credentials for directly obtaining the corresponding access permissions on the first platform. However, method 1) is heavily reliant on the second platform, and method 2) is heavily reliant on the user. Both methods suffer from low efficiency and low convenience in obtaining access permissions to business services provided by the first platform. Therefore, an efficient and convenient permission acquisition solution is needed. Summary of the Invention

[0004] To address at least one of the aforementioned technical problems, this application provides a method, apparatus, electronic device, and storage medium for obtaining permissions:

[0005] According to a first aspect of this application, a permission acquisition method is provided, applied to a first platform, the method comprising:

[0006] In response to a permission acquisition request sent by the second platform, page description information is generated based on the permission acquisition request, and the page description information is sent to the second platform. The permission acquisition request instructs the target object to apply for permission to use a specified business service.

[0007] In response to the acquired first object feature data, a first authentication process is performed on the first object feature data, wherein the first object feature data is transmitted by the target object through a specified page, and the specified page is a feature data acquisition page provided by the first platform and presented by the second platform based on the page description information;

[0008] When the first result of the first authentication process indicates that the authentication is successful, a feedback result is generated indicating that the target object has obtained the right to use the specified business service.

[0009] According to a second aspect of this application, an access control device is provided, configured on a first platform, the device comprising:

[0010] First Response Module: Used to respond to permission acquisition requests sent by the second platform, generate page description information based on the permission acquisition request, and send the page description information to the second platform. The permission acquisition request instructs the target object to apply for permission to use a specified business service.

[0011] The second response module is used to respond to the acquired first object feature data and perform a first authentication process on the first object feature data. The first object feature data is transmitted by the target object through a specified page. The specified page is a feature data acquisition page provided by the first platform and presented by the second platform according to the page description information.

[0012] Result generation module: When the first result of the first authentication process indicates that the authentication is successful, it generates a feedback result indicating that the target object has obtained the right to use the specified business service.

[0013] According to a third aspect of this application, an electronic device is provided, the electronic device including at least one processor and a memory communicatively connected to the at least one processor; wherein the memory stores at least one instruction or at least one program, the at least one instruction or at least one program being loaded and executed by the at least one processor to implement the permission acquisition method as described in the first aspect.

[0014] According to a fourth aspect of this application, a computer-readable storage medium is provided, wherein at least one instruction or at least one program is stored therein, the at least one instruction or at least one program being loaded and executed by a processor to implement the permission acquisition method as described in the first aspect.

[0015] According to a fifth aspect of this application, a computer program product is provided, the computer program product comprising at least one instruction or at least one program segment, the at least one instruction or at least one program segment being loaded and executed by a processor to implement the permission acquisition method as described in the first aspect.

[0016] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this application.

[0017] Implementing this application will have the following beneficial effects:

[0018] This application provides a solution for enabling a target object to obtain access to business services provided by the first platform through interaction between a first platform and a second platform. This improves the efficiency and convenience of the target object obtaining relevant access permissions. Compared with related technologies, this solution rationally allocates the functions of the first and second platforms and constructs a secure transmission path for object feature data from the target object to the first platform. This reduces the difficulty and cost of the second platform participating in permission acquisition and improves the storage security of object feature data. Furthermore, the differences in access permissions for different business services provided by the first platform can be maintained by the first platform through a feature data acquisition page, simplifying the integration of the first and second platforms in permission acquisition and improving adaptability to different second platforms.

[0019] Other features and aspects of this application will become clear from the following detailed description of exemplary embodiments with reference to the accompanying drawings. Attached Figure Description

[0020] To more clearly illustrate the technical solutions and advantages in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This diagram illustrates an application environment according to an embodiment of the present application.

[0022] Figure 2 A flowchart illustrating a permission acquisition method according to an embodiment of this application is shown;

[0023] Figure 3 This diagram illustrates a process for generating page description information according to an embodiment of this application.

[0024] Figure 4 A flowchart illustrating the process of generating page description information according to an embodiment of this application is also shown;

[0025] Figure 5 A flowchart illustrating a permission acquisition method according to an embodiment of this application is also shown;

[0026] Figure 6 A flowchart illustrating a permission acquisition method according to an embodiment of this application is also shown;

[0027] Figure 7 This diagram illustrates a device block diagram according to an embodiment of the present application;

[0028] Figure 8 A schematic diagram of an electronic device according to an embodiment of this application is shown. Detailed Implementation

[0029] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0030] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or server that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices.

[0031] Various exemplary embodiments, features, and aspects of this application will now be described in detail with reference to the accompanying drawings. The same reference numerals in the drawings denote elements that have the same or similar functions. Although various aspects of the embodiments are shown in the drawings, they are not necessarily drawn to scale unless specifically indicated otherwise.

[0032] The term “exemplary” as used herein means “serving as an example, embodiment, or illustration.” Any embodiment illustrated herein as “exemplary” is not necessarily to be construed as superior to or better than other embodiments.

[0033] In this document, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent three cases: A alone, A and B simultaneously, and B alone. Furthermore, the term "at least one" in this document means any combination of at least two of any one or more elements. For example, including at least one of A, B, and C can mean including any one or more elements selected from the set consisting of A, B, and C.

[0034] Furthermore, to better illustrate this application, numerous specific details are provided in the following detailed description. Those skilled in the art should understand that this application can be implemented without certain specific details. In some instances, methods, means, components, and circuits well-known to those skilled in the art have not been described in detail in order to highlight the main points of this application.

[0035] Before providing a further detailed description of the embodiments of this application, the nouns and terms involved in the embodiments of this application will be explained, and the nouns and terms involved in the embodiments of this application shall be interpreted as follows.

[0036] Bank-Enterprise Payment: Based on the bank account system, it provides enterprises with management capabilities such as payment and account inquiry, including single payment, batch payment, reimbursement on behalf of others, balance inquiry, account details inquiry, receipts, and reconciliation functions. It helps enterprises solve problems such as asynchronous bank and enterprise information and separation of business and finance within their own systems. It is primarily applicable to various SaaS (Software as a Service) platforms that provide internal services to enterprises, collaboratively improving the efficiency of enterprise financial management.

[0037] Connect: A connection relationship can be established between any two enterprises. In our current scenario, this mainly applies to the relationship between platforms and merchants on those platforms, as well as between ordinary platforms and technology service provider platforms. Based on this relationship and the differences in permissions within it, the platform can control the permissions that allow it to operate on merchants. Connect can be easily established through onboarding or OAuth.

[0038] Please see Figure 1 , Figure 1 This diagram illustrates an application environment according to an embodiment of this application. The application environment may include a first platform, a second platform, and a target object (such as a user, account, or account) on the second platform. The first platform and the second platform can be directly or indirectly connected via wired or wireless communication. For the first platform: 1) In response to a permission acquisition request sent by the second platform, it generates page description information based on the permission acquisition request and sends the page description information to the second platform. The permission acquisition request instructs the target object to apply for permission to use a specified business service; 2) In response to the acquired first object feature data, it performs a first authentication process on the first object feature data. The first object feature data is transmitted by the target object through a specified page, which is a feature data acquisition page provided by the first platform and presented by the second platform based on the page description information; 3) When the first result of the first authentication process indicates successful authentication, it generates a feedback result indicating that the target object has obtained permission to use the specified business service. It should be noted that... Figure 1 This is just one example.

[0039] In this embodiment, the first platform may include a corresponding client and a server. The second platform may include a corresponding client and a server.

[0040] The client can be a physical device such as a smartphone, computer (e.g., desktop computer, tablet, laptop), augmented reality (AR) / virtual reality (VR) device, digital assistant, smart voice interaction device (e.g., smart speaker), smart wearable device, smart home appliance, in-vehicle terminal, etc., or software running on the physical device, such as a computer program. The operating system corresponding to the client can be Android, iOS (a mobile operating system developed by Apple), Linux, Microsoft Windows, etc.

[0041] The server side can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. The server may include network communication units, processors, and memory, etc. The server side can provide backend services to the corresponding clients.

[0042] It should be noted that when object feature data that is related to user information is applied to specific products or technologies in this application embodiment, user permission or consent is required, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0043] Figure 2 , 5 -6 illustrates a flowchart of a permission acquisition method according to an embodiment of this application, as shown below. Figure 2 As shown, the method includes:

[0044] S201: In response to the permission acquisition request sent by the second platform, generate page description information based on the permission acquisition request, and send the page description information to the second platform. The permission acquisition request instructs the target object to apply for permission to use the specified business service.

[0045] In this embodiment, the first platform receives a permission acquisition request from the second platform. The first platform generates page description information based on the permission acquisition request and sends the page description information to the second platform. The permission acquisition request instructs the target object to apply for access to a specified business service. It can be understood that the first platform provides multiple business services, and the target object on the second platform (such as a user, account, or account holder) needs access to the specified business service (which belongs to multiple business services) provided by the first platform. The permission acquisition scheme provided in this embodiment can establish an association between the first platform and the target object, thereby providing the target object with the specified business service to ensure the implementation of related functions. For example, the first platform can be a transaction fund management system, and the business services it provides can be bank-enterprise payment services, gateway payment services, etc. Bank-enterprise payment services can help enterprises complete single and batch order transfers without changing the payment accounts and transfer habits of both parties, while also supporting the viewing of details, receipts, and balances. Gateway payment services can build a complete transaction fund account management system based on the pre-set acquiring account system of a third-party payment platform, combined with the needs of online transaction platforms. This system provides integrated management services such as account opening, fund settlement, order splitting, and fund reconciliation. The pre-set third-party payment platform is a platform with a third-party payment license. The second platform can be an e-commerce platform or a corporate platform (such as a corporate office platform). Correspondingly, the target audience can be merchants on the e-commerce platform or financial entities on the corporate platform. Thus, the first platform can provide the second platform with professional services such as account management, escrow transactions, consolidated payments, installment payments, intelligent splitting, and financial management.

[0046] In practical applications, taking an e-commerce platform as the second platform and merchants as the target objects as an example, if the specified business service is bank-enterprise payment service, the permission acquisition scheme provided in this application aims to establish a relationship between the first platform and the target objects, thereby providing bank-enterprise payment services to the target objects to ensure the realization of related functions. Merchant objects can also be divided into ordinary merchants and channel merchants. Furthermore, they can be further distinguished as buyers and sellers.

[0047] The page description information indicates the specified page (described later), primarily used to help the second platform display the specified page, which in turn guides the target object to provide object feature data. It can be understood that the first platform provides multiple business services, and the object feature data required for the target object to obtain access to different business services may differ. Therefore, different business services can correspond to different feature data retrieval pages. The specified page here corresponds to the specified business object.

[0048] In one exemplary implementation, such as Figure 3 , 5As shown in Figure -6, the permission acquisition request includes a first type of request providing data to be authenticated and a second type of request for an application page. The first type of request is generated by the target object based on the second platform. The first type of request carries the second object feature data of the target object and intent information to request access to the specified business service. The second object feature data indicates historical object feature data collected by the second platform. The step of generating page description information based on the permission acquisition request in response to the permission acquisition request sent by the second platform includes:

[0049] S301: In response to the first type of request sent by the second platform, perform second authentication processing on the second object feature data;

[0050] S302: When the second result of the second authentication process indicates that the authentication has been passed, configure a corresponding request identifier for the first type of request based on the intent information, and send the request identifier to the second platform;

[0051] S303: In response to the second type of request sent by the second platform, generate the page description information, wherein the second type of request carries the request identifier.

[0052] The first type of request focuses on providing data to be authenticated and carries more parameters; the second type of request focuses on the application page and carries fewer parameters. Dividing permission acquisition requests into two types achieves separation of priorities, avoiding the global impact caused by strong correlation. It's understandable that processing the first type of request is time-consuming and resource-intensive, while processing the second type is time-efficient and resource-intensive. Categorized management allows for more granular logical maintenance of permission acquisition requests. Separating the authentication process and the process of obtaining characteristic data from the page involved in processing permission acquisition requests on the first platform, and using request identifiers to connect the two processes, better ensures the accuracy of initial authentication and avoids providing page description information to the second platform when initial authentication fails.

[0053] The first type of request is triggered by the target object on the second platform and sent from the second platform to the first platform. The second type of request is triggered by the second platform itself and sent to the first platform. For example, the second platform includes a corresponding client and server. An offline merchant can trigger request 1, "obtain access to specified business services" (corresponding to intent information), through the client. This request 1, together with the merchant account logged into the second platform, forms request 2, which is sent from the client to the server. The server obtains request 3 (i.e., the first type of request) based on request 2 and the merchant account's second object feature data, and then sends request 3 to the first platform. The merchant account's second object feature data is all or part of the object feature data of the merchant account already collected by the second platform. The merchant account's second object feature data can come from the server's local or remote storage, or from the client's local storage (e.g., incorporated into request 2 and sent to the server, or sent separately to the server so that the server can obtain request 3). It should be noted that the second object feature data of the target object carried in the first type of request is information that the target object allows the second platform to send to the first platform.

[0054] The first platform performs authentication processing on the received target object's second object feature data. Authentication processing may involve at least one of the following: business registration verification, enterprise / person verification, group authority verification, manual review, blacklist scanning, and payment verification. Generally, business registration verification focuses on whether the company name and credit code in the target data are consistent; personnel verification focuses on whether the personnel information in the target data matches the basic information of the enterprise, such as whether the personnel information indicates the legal representative of the company; group authority verification focuses on whether the personnel information in the target data is authentic, such as whether the ID card information is authentic; manual review focuses on whether the company indicated by the basic information of the enterprise in the target data meets the qualifications to use the specified business services, and whether the relevant information is accurate (such as whether the document information is clear in the document photo) and authentic; blacklist scanning focuses on whether the relevant information in the target data hits the risk control blacklist; payment verification focuses on whether the settlement account in the target data is correct (such as whether the money can be received), whether the personnel information matches the settlement account (such as whether the personnel information indicates the account holder of the settlement account), and whether the basic information of the enterprise matches the settlement account (such as whether the settlement account is the corporate account of the company indicated by the enterprise information), etc.

[0055] When the authentication process indicates successful authentication, the first platform configures a corresponding request identifier (such as the application number) for the first type of request based on the intent information (corresponding to "obtaining access to the specified business service"), and sends the request identifier to the second platform. The second type of request can be generated by the second platform based on preset trigger conditions. These preset trigger conditions can instruct the generation of corresponding second type requests sequentially according to the order of the received request identifiers. They can also instruct the generation of corresponding second type requests when the load condition meets preset requirements. The second type of request is generated based on the aforementioned request identifiers. The second type of request is sent from the second platform to the first platform. The first platform generates page description information based on the received second type of request.

[0056] Furthermore, before performing the second authentication processing on the second object feature data in response to the first type of request sent by the second platform, the process includes: receiving the first type of request sent by the second platform calling a preset interface provided by the first platform. That is, the first platform provides a preset interface, which is a dedicated interface for receiving the first type of request. Correspondingly, the second platform calls the preset interface to send the first type of request to the first platform. The first platform can effectively establish a processing logic of receiving the first type of request, authentication processing, and feedback of the request identifier through the preset interface, and can also effectively establish a processing logic of receiving the second type of request, generating page description information, and providing feedback of the page description information based on the request identifier, thus achieving fine-grained logic maintenance for permission acquisition requests. The first type of request carries object feature data indicating multiple parameters, while the second type of request carries a request identifier indicating fewer parameters. By setting these two types of requests, the call pressure on the preset interface can be reduced. In practical applications, the authentication processing flow related to the first type of request is relatively long and may involve calling external interfaces to verify the object feature data. The target object's application for access to a specified business service can be regarded as an application to activate a specified product. The first type of request can be initiated by the second platform calling the object interface (corresponding to the preset interface) to initiate a pre-application. The second platform can then use a second type of request carrying a request identifier to obtain the page description information containing the redirect link. This process can be viewed as account_link.

[0057] The following section will introduce the generation of page description information and the application of specified pages:

[0058] 1) Generation of page description information:

[0059] like Figure 4-6 As shown, generating the page description information in response to the second type of request sent by the second platform includes:

[0060] S401: In response to the second type of request sent by the second platform, determine the specified page that matches the specified business service based on the request identifier, and generate a link indicating the specified page;

[0061] S402: Configure the corresponding target key for the link, and store the target key in a storage object;

[0062] S403: Generate the page description information based on the target key and the link.

[0063] Based on the preceding description of page description information, its composition is now clarified. Page description information includes a link to a specified page and a corresponding target key (e.g., sk). The link enables effective location of the specified page, allowing the platform to provide object feature data to obtain access to the specified business service. The target key grants the second platform the permission to successfully present the specified page. This prevents multiple platforms from presenting the specified page based on links due to data transmission anomalies, thus avoiding the first platform's inability to process multiple object feature data transmitted from multiple specified pages and thus affecting access to the specified business service. In practical applications, the second platform redirects to the specified page provided by the first platform based on the link in the page description information (url=XXXXX / reg?sk=XXXX). Offline merchants can use the specified page to fill in information, upload images, verify via SMS, and complete real-name verification to confirm whether to activate the specified product.

[0064] Furthermore, the storage object stores multiple keys that did not participate in verification or failed verification. After sending the page description information to the second platform, the process may include the following steps: First, receiving a page retrieval request from the second platform, the page retrieval request carrying the page description information; then, determining whether the target key exists in the storage object; furthermore, when the target key exists in the storage object, generating a verification success notification indicating the target key, and removing the target key from the storage object; finally, determining page data indicating the specified page based on the link, and sending the page data to the second platform, so that the second platform displays the specified page based on the page data.

[0065] After receiving the page description information, the second platform presents the specified page based on the page description information. Correspondingly, the target object uploads object feature data based on the instructions of the specified page. The second platform generates a page retrieval request based on the page description information and sends the page retrieval request to the first platform. The first platform extracts the target key from the page retrieval request and checks whether the target key is included among the multiple keys in the storage object. A) If included, a verification success notification indicating the target key is generated; then, the target key is removed from the storage object; next, the link in the page retrieval request is extracted, and the page data indicating the specified page is determined based on the link, and the page data is sent to the second platform so that the second platform can display the specified page based on the page data. B) If not included, a verification failure notification indicating the target key is generated; then, the target key remains in the storage object, and no further processing is performed on other information in the page retrieval request.

[0066] The key stored in the object is a key that has not been verified or has failed verification. This key is used to prevent the spread of links and improve security. In other words, the first platform verifies the validity of the key (whether it has expired). If the key is valid (not expired), verification succeeds, and the link can be used to display the specified page smoothly; if the key is invalid (expired), verification fails, and the link cannot be used to display the specified page smoothly.

[0067] In practical applications, see Figure 6 The page description information may include information about the target SDK (Software Development Kit) and the corresponding target key configured for the target SDK. The target SDK is the front-end SDK provided by the first platform. The second platform can use the target key to initialize the target SDK, thereby presenting the specified page. The initialization of the target SDK using the target key may involve the aforementioned verification of the target password, and the parameters involved in initializing the target SDK may be parameters associated with the target key. The association between the target key and the parameters can be determined by the first platform during the page description information generation stage.

[0068] 2) Application of the specified page:

[0069] In summary, the designated page is the page presented by the second platform based on the page description information, and the page is used to obtain feature data provided by the first platform. Compared to the second object feature data carried in the first type of request, the first object feature data transmitted by the target object through the designated page may originate from multiple uploads by the target object, and the time required for transmitting the first object feature data may also be longer. Introducing a token can ensure the efficiency and convenience of transmitting the first object data to be authenticated. It can be understood that the designated page guides the target object to upload multiple data through multiple page views, and these multiple data together constitute the first object data. Correspondingly, the upload of multiple data involves multiple data transmission requests, and the token can be used to prove that the data transmission request is related to the designated page, thereby ensuring that the first platform processes the data transmission request in a timely manner.

[0070] Specifically, when the target key exists in the storage object, generating a successful verification notification indicating the target key, and removing the target key from the storage object, may include the following steps: generating a token (e.g., a token), which is used to insert into the specified page and prove that the request originated from the specified page. Sending the page data to the second platform may include the following steps: sending the page data and the token to the second platform. The first object feature data includes multiple data items. In response to the obtained first object feature data, before performing the first authentication processing on the first object feature data, the following steps may be included: receiving multiple data transmission requests sent by the target object through the specified page, each data transmission request carrying the data and the token.

[0071] In practical applications, see Figure 6 After the first platform receives a request carrying the target key from the second platform, it can call the "Get Token" interface in the backend. The backend verifies the validity of the target key; if the verification is successful, a new token is generated. The token can be cached in the header of a specified page, so that every subsequent data transmission request will carry the token. The backend access layer of the first platform will verify the validity of the token.

[0072] S202: In response to the acquired first object feature data, perform a first authentication process on the first object feature data, wherein the first object feature data is transmitted by the target object through a specified page, and the specified page is a feature data acquisition page provided by the first platform and presented by the second platform according to the page description information;

[0073] In this embodiment, the first platform obtains the first object feature data through a designated page it provides, and performs authentication processing on the first object feature data. The authentication processing may involve at least one of the following: business registration verification, personal verification, group authority verification, manual review, blacklist scanning, and payment verification. For details, please refer to the relevant description in the aforementioned step S201, which will not be repeated here.

[0074] Based on the description in "2) Application of the specified page" above, multiple data items together constitute the first object data, and the upload of these multiple data items involves multiple data transmission requests. The first platform performs authentication processing on the first object feature data, which can be performed on multiple data items separately. For example, the first object feature data includes data 1-3. The first platform first receives data 1 through data transmission request 1, and then performs authentication processing on data 1; if authentication is successful, the first platform then receives data 2 through data transmission request 2, and then performs authentication processing on data 2; if authentication is successful, the first platform then receives data 3 through data transmission request 3, and then performs authentication processing on data 3. The aforementioned update of the page view can be triggered by the "authentication success" scenario here.

[0075] Both the aforementioned second object feature data and the first object feature data mentioned here are feature data related to the target object. Taking a merchant account as an example, the feature data related to the target object can include basic enterprise information, enterprise personnel information, etc. Basic enterprise information can provide information such as company name, credit code, legal representative, and settlement account. Enterprise personnel information can provide information such as the ID card details of enterprise personnel. In practical applications, the feature data related to the target object can also include biometric data (such as facial data, fingerprint data, and voiceprint data) and communication feature data (such as device data and IP address). Of course, both the first and second object feature data are data that the target object allows the second platform to obtain and send to the first platform. The second object feature data is all or part of the feature data of the target object that the second platform has already collected at that time. The first object feature data is the feature data currently uploaded by the target object guided by the specified page. Generally, the feature data of the target object that the first platform needs to obtain is fixed, such as data af. If the second object feature data includes data ac, then the specified page will guide the target object to upload data df. If the second object's characteristic data includes data 'a', then the specified page will guide the target object to upload data 'bf'.

[0076] In practical applications, the backend of the first platform can asynchronously process object feature data for authentication. The second platform does not need to be aware of the intermediate process; it only notifies the user via SMS or other means when user interaction is required.

[0077] S203: When the first result of the first authentication process indicates that the authentication is successful, a feedback result is generated indicating that the target object has obtained the right to use the specified business service.

[0078] In this embodiment, upon successful authentication, the first platform generates a feedback result confirming that the target object has obtained permission to use the specified business service. This establishes an association between the first platform and the target object regarding the specified business service, enabling the first platform to provide the specified business service to the target object.

[0079] In an exemplary implementation, after generating a feedback result indicating that the target object has obtained the right to use the specified business service when the first result of the first authentication process indicates that the authentication is successful, the following steps may be included: First, sending the feedback result to the second platform so that the second platform updates the target object's right to use information based on the feedback result; then, in response to a file retrieval request sent by the second platform, sending a hosting certificate to the second platform, wherein the hosting certificate instructs the second platform to provide the target object with a request relay service for the specified business service.

[0080] By sending feedback and hosting verification documents to the second platform, the target entity is prepared to use the specified business services provided by the first platform through the second platform. The feedback can be asynchronously sent from the first platform to the second platform via technologies such as webhooks. Based on the feedback, the second platform updates the target entity's usage permission information to update its own status, and simultaneously requests to download the hosting verification documents from the first platform. The hosting verification documents can be considered as a soft certificate instructing the target entity on its enterprise credentials.

[0081] In practical applications, see Figure 6 The generation of feedback results signifies that the target user has successfully activated the designated product. The backend of the first platform will also generate a corresponding account for the target user to establish a link authorization relationship between the target user and the first platform. Subsequently, the second platform can use the backend SDK interface provided by the first platform to help the target user initiate transactions involving the designated product. The permission acquisition scheme provided in this application embodiment can be used for enterprise operations. It can achieve efficient coordination across the entire enterprise operation process, not just limited to business, finance, and approval systems.

[0082] As can be seen from the technical solutions provided in the embodiments of this application above, the embodiments of this application provide a scheme for a target object to obtain access to business services provided by the first platform through interaction between the first platform and the second platform. This improves the efficiency and convenience of the target object obtaining relevant access permissions. Compared with related technologies, the functions of the first platform and the second platform are reasonably allocated, and a secure transmission path for object feature data from the target object to the first platform is constructed. This reduces the difficulty and cost of the second platform participating in access permission acquisition and improves the storage security of object feature data, especially for sensitive information. At the same time, the differences in access permission acquisition for different business services provided by the first platform can be maintained by the first platform through the feature data acquisition page, saving development costs, simplifying the connection between the first platform and the second platform in access permission acquisition, simplifying the relevant processes on the second platform side, and improving adaptability to different second platforms.

[0083] This application also provides a permission acquisition device, such as... Figure 7 As shown, the permission acquisition device 70 is configured on the first platform, and the permission acquisition device 70 includes:

[0084] First response module 701: used to respond to a permission acquisition request sent by the second platform, generate page description information based on the permission acquisition request, and send the page description information to the second platform, wherein the permission acquisition request instructs the target object to apply for permission to use a specified business service;

[0085] The second response module 702 is used to respond to the acquired first object feature data and perform a first authentication process on the first object feature data, wherein the first object feature data is transmitted by the target object through a specified page, and the specified page is a feature data acquisition page provided by the first platform and presented by the second platform according to the page description information.

[0086] Result generation module 703: When the first result of the first authentication process indicates that the authentication is successful, it generates a feedback result indicating that the target object has obtained the right to use the specified business service.

[0087] It should be noted that the apparatus and method embodiments described in the device embodiments are based on the same inventive concept.

[0088] In some embodiments, the functions or modules of the apparatus provided in this application can be used to perform the methods described in the above method embodiments. The specific implementation can be referred to the description of the above method embodiments, and for the sake of brevity, it will not be repeated here.

[0089] This application also provides a computer-readable storage medium storing at least one instruction or at least one program segment, which is loaded and executed by a processor to implement the above-described method. The computer-readable storage medium may be a non-volatile computer-readable storage medium.

[0090] This application also provides an electronic device, which includes at least one processor and a memory communicatively connected to the at least one processor; wherein the memory stores at least one instruction or at least one program, and the at least one instruction or at least one program is loaded and executed by the at least one processor to implement the above method.

[0091] Electronic devices can be provided as terminals, servers, or other forms of devices.

[0092] Figure 8 A block diagram of an electronic device according to an embodiment of this application is shown. For example, electronic device 1900 may be provided as a server. (Refer to...) Figure 8 The electronic device 1900 includes a processing component 1922, which further includes one or more processors, and memory resources represented by memory 1932 for storing instructions, such as application programs, that can be executed by the processing component 1922. The application programs stored in memory 1932 may include one or more modules, each corresponding to a set of instructions. Furthermore, the processing component 1922 is configured to execute instructions to perform the methods described above.

[0093] Electronic device 1900 may also include a power supply component 1926 configured to perform power management of electronic device 1900, a wired or wireless network interface 1950 configured to connect electronic device 1900 to a network, and an input / output (I / O) interface 1958. Electronic device 1900 can operate on an operating system stored in memory 1932, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, or similar.

[0094] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions that can be executed by a processing component 1922 of an electronic device 1900 to perform the above-described method.

[0095] This application may be a system, method, and / or computer program product. A computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for causing a processor to implement various aspects of this application.

[0096] Computer-readable storage media can be tangible devices capable of holding and storing instructions for use by an instruction execution device. Computer-readable storage media can be, for example—but not limited to—electrical storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital multifunction disc (DVD), memory sticks, floppy disks, mechanical encoding devices, such as punch cards or recessed protrusions storing instructions thereon, and any suitable combination thereof. The computer-readable storage media used herein are not to be construed as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses through fiber optic cables), or electrical signals transmitted through wires.

[0097] The computer-readable program instructions described herein can be downloaded from computer-readable storage media to various computing / processing devices, or downloaded via a network, such as the Internet, local area network, wide area network, and / or wireless network, to an external computer or external storage device. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to the computer-readable storage media in the respective computing / processing device.

[0098] The computer program instructions used to perform the operations of this application may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, status setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C+, etc., and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuits, such as programmable logic circuits, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), are personalized by utilizing the status information of the computer-readable program instructions. These electronic circuits can execute the computer-readable program instructions to implement various aspects of this application.

[0099] Various aspects of this application are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0100] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that, when executed by the processor of the computer or other programmable data processing apparatus, they create means for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to operate in a particular manner; thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing aspects of the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0101] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0102] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of an instruction, which includes one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions specified in the blocks may occur in a different order than those specified in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0103] The various embodiments of this application have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical applications, or technological improvements to the embodiments in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A method for obtaining permissions, characterized in that, Applied to a first platform, the method includes: In response to a permission acquisition request sent by the second platform, page description information is generated based on the permission acquisition request, and the page description information is sent to the second platform. The permission acquisition request instructs the target object to apply for permission to use a specified business service. In response to the acquired first object feature data, a first authentication process is performed on the first object feature data, wherein the first object feature data is transmitted by the target object through a specified page, and the specified page is a feature data acquisition page provided by the first platform and presented by the second platform based on the page description information; When the first result of the first authentication process indicates that the authentication is successful, a feedback result is generated in which the target object obtains the right to use the specified business service; The permission acquisition request includes a first type of request providing data to be authenticated and a second type of request for an application page. The first type of request is generated by the target object based on the second platform. The first type of request carries the second object feature data of the target object and intent information to request access to the specified business service. The second object feature data indicates historical object feature data collected by the second platform. The step of generating page description information based on the permission acquisition request in response to the permission acquisition request sent by the second platform includes: In response to the first type of request sent by the second platform, a second authentication process is performed on the second object feature data; When the second result of the second authentication process indicates that the authentication is successful, a corresponding request identifier is configured for the first type of request based on the intent information, and the request identifier is sent to the second platform; In response to the second type of request sent by the second platform, the page description information is generated, wherein the second type of request carries the request identifier.

2. The method according to claim 1, characterized in that, Before performing the second authentication processing on the second object feature data in response to the first type of request sent by the second platform, the process includes: Receive the first type of request sent by the second platform when it calls the preset interface provided by the first platform.

3. The method according to claim 1, characterized in that, The process of generating the page description information in response to the second type of request sent by the second platform includes: In response to the second type of request sent by the second platform, the specified page that matches the specified business service is determined based on the request identifier, and a link indicating the specified page is generated; Configure a corresponding target key for the link, and store the target key in a storage object; The page description information is generated based on the target key and the link.

4. The method according to claim 3, characterized in that, The storage object stores multiple keys that did not participate in verification or failed verification. After sending the page description information to the second platform, it includes: Receive a page retrieval request from the second platform, the page retrieval request carrying the page description information; Determine whether the target key exists in the storage object; When the target key exists in the storage object, a verification success notification indicating the target key is generated, and the target key is removed from the storage object; Based on the link, determine the page data indicating the specified page, and send the page data to the second platform so that the second platform displays the specified page based on the page data.

5. The method according to claim 4, characterized in that: The steps of generating a verification success notification indicating the target key when the target key exists in the storage object, and removing the target key from the storage object, include: Generate a token, which is used to insert into the specified page and to prove that the request originated from the specified page; Sending the page data to the second platform includes: Send the page data and the token to the second platform; The first object feature data includes multiple data items. Before performing the first authentication process on the first object feature data in response to the acquired first object feature data, the process includes: Receive multiple data transmission requests sent by the target object through the specified page, each data transmission request carrying the data and the token.

6. The method according to any one of claims 1-5, characterized in that, When the first result of the first authentication process indicates successful authentication, after generating a feedback result indicating that the target object has obtained the right to use the specified business service, the process includes: The feedback result is sent to the second platform so that the second platform updates the usage permission information of the target object based on the feedback result; In response to a file retrieval request sent by the second platform, a hosting certificate is sent to the second platform, the hosting certificate instructing the second platform to provide a request relay service for the target object regarding the specified business service.

7. A permission acquisition device, characterized in that, Configured on a first platform, the device includes: First Response Module: Used to respond to permission acquisition requests sent by the second platform, generate page description information based on the permission acquisition request, and send the page description information to the second platform. The permission acquisition request instructs the target object to apply for permission to use a specified business service. The second response module is used to respond to the acquired first object feature data and perform a first authentication process on the first object feature data. The first object feature data is transmitted by the target object through a specified page. The specified page is a feature data acquisition page provided by the first platform and presented by the second platform according to the page description information. Result generation module: used to generate a feedback result when the first result of the first authentication process indicates that the authentication is successful, and the target object obtains the right to use the specified business service; The permission acquisition request includes a first type of request providing data to be authenticated and a second type of request for an application page. The first type of request is generated by the target object based on the second platform. The first type of request carries the second object feature data of the target object and the intent information to request access to the specified business service. The second object feature data indicates historical object feature data collected by the second platform. The first response module is further used for: In response to the first type of request sent by the second platform, a second authentication process is performed on the second object feature data; When the second result of the second authentication process indicates that the authentication is successful, a corresponding request identifier is configured for the first type of request based on the intent information, and the request identifier is sent to the second platform; In response to the second type of request sent by the second platform, the page description information is generated, wherein the second type of request carries the request identifier.

8. The apparatus according to claim 7, characterized in that, The device is also used for: Before performing the second authentication process on the second object feature data in response to the first type of request sent by the second platform, the first type of request sent by the second platform calling the preset interface provided by the first platform is received.

9. The apparatus according to claim 7, characterized in that, The process of generating the page description information in response to the second type of request sent by the second platform includes: In response to the second type of request sent by the second platform, the specified page that matches the specified business service is determined based on the request identifier, and a link indicating the specified page is generated; Configure a corresponding target key for the link, and store the target key in a storage object; The page description information is generated based on the target key and the link.

10. The apparatus according to claim 9, characterized in that, The device is also used for: After storing multiple keys that did not participate in verification or failed verification in the storage object, and sending the page description information to the second platform, a page retrieval request is received from the second platform, the page retrieval request carrying the page description information; Determine whether the target key exists in the storage object; When the target key exists in the storage object, a verification success notification indicating the target key is generated, and the target key is removed from the storage object; Based on the link, determine the page data indicating the specified page, and send the page data to the second platform so that the second platform displays the specified page based on the page data.

11. The apparatus according to claim 10, characterized in that: The apparatus is further configured to: generate a verification success notification indicating the target key when the target key exists in the storage object, and generate a token after removing the target key from the storage object, the token being used to insert into the designated page and to prove that the request comes from the designated page; Sending the page data to the second platform includes: sending the page data and the token to the second platform; The apparatus is further configured to: receive multiple data transmission requests sent by the target object through the designated page before the first object feature data is processed in response to the first object feature data, where the first object feature data includes multiple data, and each data transmission request carries the data and the token.

12. The apparatus according to any one of claims 7-11, characterized in that, The device is also used for: After generating a feedback result indicating that the target object has obtained the right to use the specified business service when the first result of the first authentication process indicates that the authentication is successful, the feedback result is sent to the second platform so that the second platform updates the target object's right to use information based on the feedback result; In response to a file retrieval request sent by the second platform, a hosting certificate is sent to the second platform, the hosting certificate instructing the second platform to provide a request relay service for the target object regarding the specified business service.

13. An electronic device, characterized in that, The electronic device includes at least one processor and a memory communicatively connected to the at least one processor; wherein the memory stores at least one instruction or at least one program, the at least one instruction or at least one program being loaded and executed by the at least one processor to implement the permission acquisition method as described in any one of claims 1-6.

14. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores at least one instruction or at least one program, which is loaded and executed by a processor to implement the permission acquisition method as described in any one of claims 1-6.

15. A computer program product, characterized in that, The computer program product includes at least one instruction or at least one program segment, which is loaded and executed by a processor to implement the permission acquisition method as described in any one of claims 1-6.

Images