Application authorization method, apparatus and system

Abstract

The application relates to an application authorization method, device and system. The method comprises the following steps: receiving an authorization request transmitted by a service provider for a terminal, and performing identity authentication on the service provider based on the authorization request; in the case that the service provider identity authentication is successful, transmitting the authorization request to the terminal; in response to receiving a first authorization result fed back by the terminal based on the authorization request, determining a request type to which the authorization request belongs in the case that the first authorization result is authorization passing; and transmitting sensitive information to the service provider when it is determined that the request type to which the authorization request belongs is a normal authorization request. The method can realize that the terminal only needs to confirm authorization once in the process of obtaining application authorization, and does not need to introduce an additional role, and at the same time, realizes secondary verification on the service provider to avoid pseudo services and replay attacks, and improves the convenience and security of the application authorization process.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to an application authorization method, device and system. BACKGROUND

[0002] In the interaction process between a user and a chatbot, a message is sent to a service provider (Chatbot Platform Provider) through an operator's capability platform, the service provider processes and responds to the information through a set process, and completes a passive interaction; the service provider can also actively send a message to the user through the capability platform to complete an active interaction. The operator plays a role of transfer and business operation management in the message.

[0003] However, the current traditional user authorization acquisition scheme has the problem of complicated process involving multiple times of circulation of terminal, operator and brand service provider. SUMMARY

[0004] Therefore, it is necessary to provide an application authorization method, device and system capable of acquiring user authorization conveniently in view of the above technical problems.

[0005] In a first aspect, the present application provides an application authorization method. The method comprises:

[0006] receiving an authorization request for a terminal transmitted by a service provider; the authorization request is used to request to acquire sensitive information of the terminal;

[0007] performing identity authentication on the service provider based on the authorization request, and transmitting the authorization request to the terminal in the case that the identity authentication on the service provider is successful;

[0008] in response to receiving a first authorization result fed back by the terminal based on the authorization request, determining a request type to which the authorization request belongs in the case that the first authorization result is authorization passed;

[0009] when the request type to which the authorization request belongs is determined to be a normal authorization request, transmitting the sensitive information to the service provider.

[0010] In one of the embodiments, the method further comprises:

[0011] when the request type to which the authorization request belongs is determined to be an abnormal authorization request, transmitting the authorization request to the terminal;

[0012] in response to receiving a second authorization result fed back by the terminal based on the authorization request, transmitting the sensitive information to the service provider in the case that the second authorization result is authorization passed.

[0013] In one of the embodiments, the identity of the service provider is authenticated based on the authorization request, comprising:

[0014] The identity information corresponding to the service provider is obtained, and the region to which the service provider belongs is obtained.

[0015] In the case where the identity information and the region to which the service provider belongs are matched successfully, it is determined that the identity authentication of the service provider is successful.

[0016] In one of the embodiments, the type of the authorization request is determined, comprising:

[0017] The corresponding historical authorization information is obtained; the historical authorization information comprises historical feedback information and historical behavior proportion; the historical feedback information comprises the authorization rate of the terminal feedback to the same type of authorization request, and the historical behavior proportion is the ratio of the number of the service provider outputting any type of authorization request to the sum of the total number of authorization requests;

[0018] According to the historical feedback information, the historical behavior proportion and the type of the sensitive information, the necessity of the sensitive information is confirmed to determine the type of the authorization request.

[0019] In one of the embodiments, the necessity of the sensitive information is confirmed according to the historical feedback information, the historical behavior proportion and the type of the sensitive information, comprising:

[0020] According to the type of the sensitive information, the necessity of the historical feedback information and the historical behavior proportion is analyzed by using an analysis model; the analysis model comprises at least one of a random forest model, a clustering model and a decision tree model.

[0021] In one of the embodiments, the service provider is a Chatbot.

[0022] In a second aspect, the application further provides an application authorization device. The device comprises:

[0023] The request receiving module is configured to receive the authorization request transmitted by the service provider for the terminal; the authorization request is used to request to obtain the sensitive information of the terminal.

[0024] The identity authentication module is configured to authenticate the identity of the service provider based on the authorization request, and transmit the authorization request to the terminal in the case where the identity authentication of the service provider is successful.

[0025] The type determination module is configured to determine the type of the authorization request in response to receiving the first authorization result feedback by the terminal based on the authorization request, and determine the type of the authorization request in the case where the first authorization result is authorization.

[0026] The information output module is configured to transmit the sensitive information to the service provider when it is determined that the request type to which the authorization request belongs is a normal authorization request.

[0027] In a third aspect, the present application provides a computer device. The computer device comprises a memory and a processor. The memory stores a computer program. The processor implements the application authorization method when executing the computer program.

[0028] In a fourth aspect, the present application provides an application authorization system. The application authorization system comprises the computer device, a terminal and a service provider. The terminal communicates with the service provider through the computer device.

[0029] In a fifth aspect, the present application provides a computer readable storage medium. The computer readable storage medium stores a computer program. The computer program is executed by a processor to implement the application authorization method.

[0030] The application authorization method, device and system are configured to receive an authorization request transmitted by a service provider for a terminal, perform identity verification on the service provider based on the authorization request, and transmit the authorization request to the terminal when the identity verification on the service provider is successful. In response to receiving a first authorization result fed back by the terminal based on the authorization request, the request type to which the authorization request belongs is determined when the first authorization result is an authorization pass. The sensitive information is transmitted to the service provider when it is determined that the request type to which the authorization request belongs is a normal authorization request. The present application only needs to confirm the authorization once by the terminal in the process of obtaining the application authorization by performing the identity verification on the service provider and the first authorization result fed back by the terminal based on the authorization request. No additional role is introduced. At the same time, the secondary verification on the service provider is implemented to avoid the pseudo service and the replay attack, thereby improving the convenience and security of the application authorization process. BRIEF DESCRIPTION OF DRAWINGS

[0031] Figure 1 A total flowchart of a conventional application authorization method in an embodiment;

[0032] Figure 2 An application environment diagram of the application authorization method in an embodiment;

[0033] Figure 3 A flowchart of the application authorization method in an embodiment;

[0034] Figure 4 A flowchart of determining the request type to which the authorization request belongs in an embodiment;

[0035] Figure 5 A total flowchart of the application authorization method in an embodiment;

[0036] Figure 6 a structure block diagram of an application authorization device in one embodiment;

[0037] Figure 7 an internal structure diagram of a computer device in one embodiment. DETAILED DESCRIPTION

[0038] For the purpose of making the purpose, technical scheme and advantages of the present application more clear, the present application is further described in detail below in combination with the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application, and are not intended to limit the present application.

[0039] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used in the specification herein is for describing the embodiments of the present application only and is not intended to limit the present application.

[0040] It can be understood that the terms such as "first", "second" and the like in the present application are only used to distinguish similar objects, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the technical features indicated. The "connection" appearing in the embodiments of the present application refers to various connection modes such as direct connection or indirect connection, so as to realize the communication between devices, and the embodiments of the present application do not make any limitation on this.

[0041] It can be understood that "at least one" means one or more, and "multiple" means two or more than two.

[0042] As used herein, the singular forms "a", "an" and "the" can also include the plural forms unless the context clearly indicates otherwise. It should also be understood that the terms "comprise / contain" or "have" and the like specify the presence of stated features, integers, steps, operations, components, parts or combinations thereof, but do not exclude the presence or addition of one or more other features, integers, steps, operations, components, parts or combinations thereof. At the same time, the term "and / or" used in the specification includes any and all combinations of the related listed items.

[0043] RCS (Rich Communication Service) message is a message service defined by GSMA (Global System for Mobile Communications assembly), and is considered an important component of 5G (5th Generation Mobile Communication Technology) message. RCS message itself introduces brand chat robots as an important message transmission channel between enterprises and individuals, and prevents scenarios where junk messages cannot be ignored.

[0044] In the existing 5G message transmission mechanism, there is a lack of a process for verifying the authorization reliability, which may cause user sensitive information to be leaked. For example, in enterprise marketing short or community flow survey, the user receiving the message is usually reminded through 5G message to click the link of the service for browsing or submit information through the link. The application authorization in the interaction process needs further detection and control.

[0045] However, the current method for service providers to apply for authorization of user (5G terminal user) sensitive information, as shown in Figure 1 , needs the operator (CSP platform) to increase additional authorization roles (authorization services) to construct multiple scheme combinations (such as issuing a one-time authorization code Code and generating Token), and the process covers multiple flows of terminal, operator, and brand service provider, which is complicated.

[0046] Further, in the current industry, authentication cards and one-key authentication are used in combination with 5G message supporting hidden back-end functions such as Postback_data (current back-end value) to hide the back-end of the operator from the application system, and the operator is only a message relay, and has less control over the authorization strategy. In addition, the traditional method also has the problems of being unable to guarantee the legality of the service provider Chatbot, and introducing authorization services on the basis of the standardized message architecture, which leads to message bottlenecks and increases the attack exposure surface.

[0047] The application authorization method provided by the embodiments of the present application can be applied to, for example, Figure 2The application environment shown. Among them, the terminal 102 communicates with the server 104 through the network, and the server 104 communicates with the service provider 106 through the network. The server 104 authenticates the service provider 106 based on the authorization request transmitted by the service provider 106 for the terminal 102, and transmits the authorization request to the terminal 102 in the case of successful authentication. The terminal 102 feeds back the first authorization result to the server 104, and the server 104 determines the request type to which the authorization request belongs when the first authorization result is authorized. When the request type to which the authorization request belongs is determined to be a normal authorization request, the server 104 transmits sensitive information to the service provider 106.

[0048] Among them, the terminal 102 can be, but not limited to, various personal computers, notebook computers, smart phones, tablet computers, Internet of Things devices and portable wearable devices. The Internet of Things device can be a smart speaker, a smart television, a smart air conditioner, a smart vehicle device, etc. The portable wearable device can be a smart watch, a smart bracelet, a head-mounted device, etc.

[0049] Exemplarily, the server 104 can be used to run the operator's MaaP (Messaging as a Platform, Messaging as a Platform) platform (capability platform) or CSP (Certified Service Partner, Certified Service Partner) platform. In the embodiment of the application, the server 104 is taken as an example of the CSP platform for description; further, the server 104 can be realized by an independent server or a server cluster composed of multiple servers.

[0050] Optionally, the service provider 106 can refer to service providers of various brands, and the category of the brand service provider is not limited in the embodiment of the application. Exemplarily, the service provider can be a Chatbot.

[0051] In one embodiment, as Figure 3 shown, an application authorization method is provided, and the method is taken as an example of the server in Figure 1 for description, including the following steps:

[0052] S302, receiving an authorization request transmitted by a service provider for a terminal; the authorization request is used to request to obtain sensitive information of the terminal.

[0053] Among them, the authorization request can refer to a request issued by the service provider for applying to obtain user sensitive information; optionally, the authorization request can also refer to a request issued by the service provider for obtaining other types of information of the terminal, and the embodiment of the application is not limited thereto.

[0054] Specifically, taking the server as the CSP platform as an example, in the process that the user uses the terminal to obtain the service provided by the service provider, when the service provider needs to obtain the authorization of the user to obtain the sensitive information of the corresponding user, the service provider can output the authorization request for the terminal to the CSP platform.

[0055] In S304, the service provider is authenticated based on the authorization request, and in a case where the service provider is authenticated successfully, the authorization request is transmitted to the terminal.

[0056] Specifically, the server can authenticate the service provider in a case where the authorization request is received, thereby reducing the authorization service role of the application authorization of the service provider and reducing the risk of bottleneck occurrence, so as to solve the problem that the traditional scheme cannot guarantee the legality of the brand service provider.

[0057] Further, in a case where the service provider is authenticated successfully, the server can transmit the authorization request to the terminal to instruct the terminal to perform the authorization operation.

[0058] Exemplarily, taking the server as the CSP platform as an example, the CSP platform can authenticate the service provider based on the authorization request, and in a case where the CSP platform determines that the service provider is authenticated successfully, the authorization request is transmitted to the terminal. The terminal can display an authorization page for the user to select in response to the received authorization request.

[0059] In one of the embodiments, authenticating the service provider based on the authorization request comprises:

[0060] Obtaining identity identification information corresponding to the service provider and a large area to which the service provider belongs;

[0061] In a case where the identity identification information and the large area to which the service provider belongs are matched successfully based on the identity identification information and the large area to which the service provider belongs, it is determined that the service provider is authenticated successfully.

[0062] The identity identification information can refer to the merchant ID (Identity Document) corresponding to the service provider, and the large area to which the service provider belongs can refer to the message area in which the service provider is located.

[0063] Specifically, the server can store identity information (legal identity information) and a corresponding region (legal region) of a legal service provider. After obtaining the identity information and the corresponding region of the service provider, the server matches the identity information and the corresponding region of the service provider with the legal identity information and the legal region. If the identity information matches the legal identity information and the corresponding region matches the legal region, the server determines that the service provider is authenticated successfully.

[0064] For example, the server is a CSP platform. The CSP platform can match the identity information and the corresponding region of the service provider with the legal identity information and the legal region, and determine the authentication result of the service provider.

[0065] Optionally, the server can also authenticate the service provider according to other registration information of the service provider. In this embodiment of the application, the identity information and the corresponding region of the service provider are taken as examples, and the other registration information of the service provider is not limited in this embodiment of the application.

[0066] For example, the identity information and the corresponding region of the service provider can be carried in the authorization request. The CSP platform can match the identity information and the corresponding region in the authorization request with the legal identity information and the legal region. If the matching is successful, it is determined that the authentication is successful.

[0067] In this embodiment of the application, the identity authentication of the service provider is added, the legality of the service provider is effectively ensured, and the security of the application authorization process is improved.

[0068] S306, in response to receiving the first authorization result fed back by the terminal based on the authorization request, if the first authorization result is authorization passed, a request type to which the authorization request belongs is determined.

[0069] Specifically, the server transmits the authorization request to the terminal. If the terminal receives the authorization request, the authorization page is displayed. Then, the user can confirm whether the authorization is passed on the authorization page displayed by the terminal. Further, when the user completes the authorization operation, the terminal feeds back the first authorization result to the server. If the first authorization result is authorization passed, the server determines the request type to which the authorization request belongs.

[0070] The server determines the request type to which the authorization request belongs, which can refer to authorization necessity verification of the authorization request, and according to the result of the necessity verification, confirms whether the authorization request is a normal authorization request or an abnormal authorization request. For example, taking the server as a CSP platform, the CSP platform can perform authorization necessity analysis on the authorization request in the case of a first authorization result of authorization pass, complete high-reliability application authorization under the premise of meeting the data subject rights in GDPR, and avoid authorization abuse.

[0071] In one of the embodiments, determining the request type to which the authorization request belongs includes:

[0072] Obtaining corresponding historical authorization information; the historical authorization information includes historical feedback information and a historical behavior proportion; the historical feedback information includes an authorization rate of the terminal feedback to the authorization request of the same type, and the historical behavior proportion is a ratio of a number of authorization requests of any type output by the service provider to a sum of the total number of authorization requests;

[0073] According to the historical feedback information, the historical behavior proportion and the type to which the sensitive information belongs, the necessity of the sensitive information is confirmed to determine the request type to which the authorization request belongs.

[0074] Specifically, the server can store corresponding historical authorization information, and the server can determine the authorization rate of the terminal corresponding to the authorization request of this type based on the historical feedback information in the historical authorization information and the type to which the sensitive information belongs; the server can also determine the ratio of the type of authorization request output by the service provider to the sum of the total number of authorization requests output by the service provider based on the historical behavior proportion in the historical authorization information and the type to which the sensitive information belongs, so as to confirm the necessity of the sensitive information according to the corresponding authorization rate and the ratio, and then determine the request type to which the authorization request belongs.

[0075] For example, taking the server as a CSP platform, the CSP platform can determine the ratio of the type of authorization request output by the service provider to the sum of the total number of authorization requests output by the service provider based on the historical behavior proportion in the historical authorization information and the type to which the sensitive information belongs, and the CSP platform can confirm the necessity of the sensitive information according to the corresponding authorization rate and the ratio, and then determine the request type to which the authorization request belongs.

[0076] Optionally, the data source capable of confirming the necessity of the sensitive information can also include but is not limited to the industry messages such as the service provider belonging to the region, the request and the rich media card, the content template chatbot data, the conversation data structure data and the base personality data.

[0077] In the embodiments of the present application, based on the GSMA standardized message architecture, without introducing additional roles, the necessity of the historical authorization information corresponding to the service provider is confirmed, under the premise of meeting the data subject rights in GDPR, the high-reliable application authorization is completed, the authorization abuse is avoided, and the security of the application authorization process is improved.

[0078] In one of the embodiments, the necessity of the sensitive information is confirmed according to the historical feedback information, the historical behavior proportion and the type to which the sensitive information belongs, including:

[0079] According to the type to which the sensitive information belongs, the analysis model is used to analyze the necessity of the historical feedback information and the historical behavior proportion; the analysis model includes at least one of a random forest model, a clustering model and a decision tree model.

[0080] Among them, the analysis model can refer to a model that can be used for necessity analysis, and in the embodiments of the present application, the random forest model, the clustering model and the decision tree model are taken as examples for illustration.

[0081] Specifically, the server can perform necessity analysis on the corresponding authorization rate and ratio according to the analysis model to confirm the necessity of the sensitive information.

[0082] Exemplarily, taking the server as the CSP platform as an example, the CSP platform can perform necessity analysis on the historical feedback information and the historical behavior proportion according to the type to which the sensitive information belongs, using the analysis model, obtain the authorization necessity value, and compare the authorization necessity value with the preset value, confirm the necessity of the sensitive information based on the comparison result, that is, confirm the request type to which the authorization request belongs is a normal authorization request or an abnormal authorization request.

[0083] In the embodiments of the present application, by inheriting the existing message system architecture and its verification process convenience, using the global perspective of the CSP platform, performing necessity analysis on the historical feedback information and the historical behavior proportion according to the type to which the sensitive information belongs, using the analysis model, the hidden verification is invisible to the terminal and the service provider, and the reliability of the application authorization is improved.

[0084] S308, when it is determined that the request type to which the authorization request belongs is a normal authorization request, the sensitive information is transmitted to the service provider.

[0085] Specifically, the server can store the sensitive information of the user, and when it is determined that the request type to which the authorization request belongs is a normal authorization request, the server transmits the sensitive information to the service provider.

[0086] In the application authorization method, the service provider is authenticated, and the terminal performs secondary authentication based on the first authorization result fed back by the authorization request to avoid pseudo services and replay attacks. Meanwhile, based on the standard message architecture, no additional roles are introduced, and the convenience and security of the application authorization process are improved.

[0087] In one embodiment, as shown in Figure 4 the method further includes:

[0088] S402, when determining that the request type to which the authorization request belongs is an abnormal authorization request, transmitting the authorization request to the terminal;

[0089] S404, in response to receiving the second authorization result fed back by the terminal based on the authorization request, transmitting the sensitive information to the service provider if the second authorization result is authorization pass.

[0090] Specifically, the CSP platform can determine the request type to which the authorization request belongs by performing necessity analysis on the authorization request. When the CSP platform determines that the request type to which the authorization request belongs is an abnormal authorization request, the terminal needs to authorize the authorization request again. In the case where the second authorization result is authorization pass, the CSP platform transmits the sensitive information to the service provider.

[0091] In the embodiments of the present application, when it is determined that the request type to which the authorization request belongs is an abnormal authorization request, the authorization request is transmitted to the terminal to authorize the authorization request again, thereby improving the security of the application authorization process.

[0092] In one embodiment, the service provider is a Chatbot.

[0093] Specifically, different brands of service providers can be different Chatbots.

[0094] By way of example, the service provider can refer to a Chatbot Platform Provider.

[0095] For the convenience of those skilled in the art, the application authorization method will be described below in conjunction with a specific example, as shown in Figure 5 wherein the 5G terminal user can refer to the terminal, the service provider can refer to the Chatbot Platform Provider, and the application authorization process of the Chatbot in the message service can include:

[0096] Step 1: The user accesses the service of the service provider through the terminal in the short message, and the access request (request service message) is sent to the CSP platform;

[0097] Step two: After receiving the access request, the CSP platform forwards the user's ID and the user's request content to the service provider together;

[0098] Step three: During the service process, if the Chatbot (service provider) needs user authorization (for example, the service provider needs to obtain the user's sensitive information), it sends a request (request for sensitive information) to the CSP platform, which conducts identity review of the Chatbot (Chatbot ID);

[0099] Step four: After completing the identity review of the Chatbot, the CSP platform forwards the request to the user end, and the user receives the authorization page;

[0100] Step five: After the user confirms authorization, access the authorization service;

[0101] Step six: After the CSP platform receives the user's confirmation of authorization, it conducts authorization necessity analysis, for example, based on the user's historical feedback (historical feedback information) and the Chatbot's historical behavior (historical behavior proportion), it analyzes the necessity of information (confirms the necessity of sensitive information);

[0102] Step seven: When the CSP platform determines that it is normal behavior (normal authorization request), it authorizes (for example, returns sensitive information) the Chatbot;

[0103] Step eight: When the CSP platform determines that it is an abnormal authorization request, it forwards it back to the client (5G terminal user) again, requesting authorization;

[0104] Step nine: After the CSP platform receives the user's response to the re-confirmation of authorization, it authorizes (for example, returns sensitive information) the Chatbot;

[0105] Step ten: After the Chatbot receives the authorization (for example, receives sensitive information), it initiates a message request to the CSP platform;

[0106] Step eleven: The CSP platform sends a message to the user (5G terminal user).

[0107] Based on the above, by omitting the repeated authorization and the construction of the authorization code, the user only needs to confirm the authorization once, the convenience of obtaining the user authorization is improved, and the user does not need to repeatedly operate; at the same time, the service provider is verified twice to avoid pseudo services and replay attacks; further, based on the standard message architecture, the authorization service role participating in the application authorization is reduced, the necessity analysis is performed by using the operator, and the authorization is completed by calling the 5G message matching hidden backhaul function, the security of the authorization is improved, and the analysis process data source meets the compliance requirements of GDPR (General Data Protection Regulation) and other foreign long-arm jurisdiction or domestic personal information privacy protection and the like.

[0108] It should be understood that, although each step in the flowchart involved in each embodiment as described above is displayed in sequence according to the arrow, these steps are not necessarily executed in sequence according to the arrow. Unless otherwise specified herein, the execution of these steps is not strictly limited in sequence, and these steps can be executed in other sequences. Moreover, at least part of the steps in the flowchart involved in each embodiment as described above can include multiple steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution sequence of these steps or stages is not necessarily sequential, but can be executed in rotation or alternation with at least part of other steps or steps or stages in other steps.

[0109] Based on the same inventive concept, the present application also provides an application authorization device for implementing the above-mentioned application authorization method. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme described in the above method, so the specific limitations in one or more application authorization device embodiments provided below can refer to the limitations of the application authorization method in the above text, which will not be repeated here.

[0110] In one embodiment, as shown in Figure 6 An application authorization device 600 is provided, and the device includes:

[0111] The request receiving module 601 is configured to receive an authorization request transmitted by a service provider for a terminal, and the authorization request is used to request to obtain sensitive information of the terminal.

[0112] The identity verification module 602 is configured to perform identity verification on the service provider based on the authorization request, and transmit the authorization request to the terminal in a case where the identity verification on the service provider is successful.

[0113] The type determination module 603 is configured to, in response to receiving the first authorization result fed back by the terminal based on the authorization request, determine the request type to which the authorization request belongs in a case where the first authorization result is authorization pass.

[0114] The information output module 604 is configured to, when determining that the request type to which the authorization request belongs is a normal authorization request, transmit the sensitive information to the service provider.

[0115] In one of the embodiments, the information output module 604 is further configured to, when determining that the request type to which the authorization request belongs is an abnormal authorization request, transmit the authorization request to the terminal.

[0116] In response to receiving the second authorization result fed back by the terminal based on the authorization request, the sensitive information is transmitted to the service provider in a case where the second authorization result is authorization pass.

[0117] In one of the embodiments, the identity verification module 602 is further configured to acquire identity recognition information corresponding to the service provider and a region to which the service provider belongs.

[0118] In a case where the information is confirmed to be matched successfully based on the identity recognition information and the region to which the service provider belongs, it is determined that the identity verification of the service provider is successful.

[0119] In one of the embodiments, the type determination module 603 is further configured to acquire corresponding historical authorization information; the historical authorization information includes historical feedback information and a historical behavior proportion; the historical feedback information includes an authorization rate of the terminal fed back for the same type of authorization request, and the historical behavior proportion is a ratio of a number of authorization requests of any type output by the service provider to a sum of the total number of authorization requests.

[0120] According to the historical feedback information, the historical behavior proportion and the type to which the sensitive information belongs, the necessity of the sensitive information is confirmed to determine the request type to which the authorization request belongs.

[0121] In one of the embodiments, the type determination module 603 is further configured to, according to the type to which the sensitive information belongs, perform necessity analysis on the historical feedback information and the historical behavior proportion by using an analysis model; the analysis model includes at least one of a random forest model, a clustering model and a decision tree model.

[0122] In one of the embodiments, the service provider is a Chatbot.

[0123] The above various modules in the application authorization device can be realized by software, hardware and a combination thereof in whole or in part. The above various modules can be embedded in or independent of a processor in a computer device in a hardware form, or can be stored in a memory in a computer device in a software form, so as to be called and executed by a processor to perform the operations corresponding to the above various modules.

[0124] In one embodiment, a computer device is provided, which can be a server, and an internal structure diagram thereof can be as shown in Figure 7 The computer device includes a processor, a memory, an input / output interface (I / O) and a communication interface. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operating system and the computer program in the non-volatile storage medium to run. The database of the computer device can be used to store the identity information and sensitive information of a legitimate service provider. The input / output interface of the computer device is configured to exchange information between the processor and external devices. The communication interface of the computer device is configured to communicate with terminals outside through a network connection. The computer program is executed by the processor to implement an application authorization method.

[0125] Those skilled in the art can understand that Figure 7 the structure shown in the above embodiment is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0126] In one embodiment, the present application also provides an application authorization system, which includes the above computer device, and further includes a terminal and a service provider; wherein the terminal communicates with the service provider through the computer device.

[0127] Exemplarily, the system adopts the application authorization method of any one of the above embodiments to implement the functions of the system through the application authorization method, and other corresponding applications adopting the application authorization method. It should be noted that the embodiments of the present application are designed based on the authorization and authentication of user sensitive information in Chatbot (service provider) in the 5G message environment.

[0128] In one embodiment, a computer readable storage medium is provided, which stores a computer program. The computer program is executed by the processor to implement the above application authorization method.

[0129] In one embodiment, a computer program product is provided, which includes a computer program. The computer program is executed by the processor to implement the above application authorization method.

[0130] It should be noted that the sensitive information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of related data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0131] It can be understood by those skilled in the art that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing related hardware through a computer program, and the computer program can be stored in a non-volatile computer readable storage medium. When the computer program is executed, it can include the processes of the above-mentioned embodiments of each method. In the embodiments provided in the present application, any reference to memory, database or other medium can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (Read-Only Memory, ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive memory (ReRAM), magnetic variable memory (Magnetoresistive Random Access Memory, MRAM), ferroelectric memory (Ferroelectric Random Access Memory, FRAM), phase change memory (Phase Change Memory, PCM), graphene memory, etc. Volatile memory can include random access memory (Random Access Memory, RAM) or external cache memory, etc. As an illustration but not limitation, RAM can be in various forms, such as static random access memory (Static Random Access Memory, SRAM) or dynamic random access memory (Dynamic Random Access Memory, DRAM), etc. The database involved in the embodiments provided in the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided in the present application can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., without being limited thereto.

[0132] The technical features of the above embodiments can be combined in any way. In order to make the description simple, not all possible combinations of the technical features in the above embodiments are described, but as long as the combination of the technical features does not exist contradictory, it should be considered as the scope of the present application.

[0133] The above-described embodiments are merely illustrative of several embodiments of the present application, and the description is relatively specific and detailed, but should not be understood as a limitation on the scope of the patent. It should be noted that for those skilled in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are all within the scope of the present application. Therefore, the scope of protection of the present application should be subject to the appended claims.

Claims

1. An application authorization method, characterized by, The method comprises: receiving an authorization request transmitted by a service provider for a terminal; the authorization request is used to request to obtain sensitive information of the terminal; authenticating the service provider based on the authorization request, and transmitting the authorization request to the terminal if the service provider authentication is successful; determining a request type to which the authorization request belongs in response to receiving a first authorization result fed back by the terminal based on the authorization request, and in the case that the first authorization result is authorization pass; transmitting sensitive information to the service provider when it is determined that the request type to which the authorization request belongs is a normal authorization request; The step of determining the request type to which the authorization request belongs comprises: obtaining corresponding historical authorization information; the historical authorization information comprises historical feedback information and a historical behavior proportion; the historical feedback information comprises an authorization rate fed back by the terminal for the same type of authorization request, and the historical behavior proportion is a ratio of a sum of the number of authorization requests of any type output by the service provider to the total number of authorization requests; determining the necessity of the sensitive information according to the historical feedback information, the historical behavior proportion and the type to which the sensitive information belongs, to determine the request type to which the authorization request belongs.

2. The method of claim 1, wherein, The method further comprises: transmitting the authorization request to the terminal when it is determined that the request type to which the authorization request belongs is an abnormal authorization request; transmitting the sensitive information to the service provider in response to receiving a second authorization result fed back by the terminal based on the authorization request, in the case that the second authorization result is authorization pass.

3. The method of claim 1, wherein, The step of authenticating the service provider based on the authorization request comprises: obtaining identity information corresponding to the service provider and a large area to which the service provider belongs; determining that the service provider authentication is successful in the case that information matching is successful based on the identity information and the large area to which the service provider belongs.

4. The method of claim 1, wherein, The step of determining the necessity of the sensitive information according to the historical feedback information, the historical behavior proportion and the type to which the sensitive information belongs comprises: adopting an analysis model to analyze the necessity of the historical feedback information and the historical behavior proportion according to the type to which the sensitive information belongs; the analysis model comprises at least one of a random forest model, a clustering model and a decision tree model.

5. The method according to any one of claims 1 to 4, characterized in that, The service provider is a Chatbot.

6. An application authorization apparatus characterized by comprising: The device comprises: a request receiving module configured to receive an authorization request transmitted by a service provider for a terminal; the authorization request is used to request to obtain sensitive information of the terminal; an authentication module configured to authenticate the service provider based on the authorization request, and transmit the authorization request to the terminal if the service provider authentication is successful; a type determining module configured to determine a request type to which the authorization request belongs in response to receiving a first authorization result fed back by the terminal based on the authorization request, and in the case that the first authorization result is authorization pass; an information output module, configured to transmit the sensitive information to the service provider when it is determined that the request type to which the authorization request belongs is a normal authorization request; The type determination module is further configured to acquire corresponding historical authorization information; the historical authorization information includes historical feedback information and a historical behavior proportion; the historical feedback information includes an authorization rate fed back by the terminal for the authorization request of the same type, and the historical behavior proportion is a ratio of a sum of a number of the authorization request of any type output by the service provider to a total number of the authorization request; necessity of the sensitive information is confirmed according to the historical feedback information, the historical behavior proportion and the type to which the sensitive information belongs, so as to determine the request type to which the authorization request belongs. 7.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is configured to perform the method according to any one of claims 1-6 when the computer program is executed by the processor. The processor executes the computer program to implement the steps of the method in any one of claims 1 to 5.

8. An application authorization system, characterized by The computer device of claim 7 further comprises a terminal and a service provider; wherein the terminal communicates with the service provider through the computer device.

9. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method in any one of claims 1 to 5.

10. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method in any one of claims 1 to 5.

Images