User login methods, devices, equipment, media and products

Abstract

This disclosure provides a user login method applicable to the field of information security technology. The user login method is applied to a user terminal and includes: when an identity authentication client completes login, a user terminal of a first information system requests an authorization token from a server's identity authentication platform through the identity authentication client; the user terminal of the first information system includes a first browser or a first client; upon obtaining the authorization token, the user terminal of the first information system sends the authorization token to the server's identity authentication platform; and upon successful verification of the authorization token, receiving a digital signature or receiving a session credential. This disclosure also provides a user login device, apparatus, medium, and product.

Description

Technical Field

[0001] This disclosure relates to the field of information security technology, and specifically to a user login method, apparatus, device, medium, and product. Background Technology

[0002] Within enterprises, especially large financial institutions, employee users typically need to access multiple information systems via their work computers due to business operations, internal office management, and other related needs, based on different business areas. Typically, enterprises implement single sign-on (SSO) solutions for these internal information systems. For B / S architecture business systems, this allows users to achieve SSO within the same browser session, reducing the frequency of password authentication and improving user efficiency and experience.

[0003] As the types and usage scenarios of internal enterprise information systems increase, especially in the use of C / S architecture business systems, the original single sign-on cannot be used on the business system client, and users need to perform password authentication operations frequently when using various clients / browsers. Summary of the Invention

[0004] In view of the above problems, this disclosure provides user login methods, apparatus, devices, media and products that improve the convenience and efficiency of user login.

[0005] According to a first aspect of this disclosure, a user login method is provided, the method being applied in a user terminal, the method comprising: upon successful login by an authentication client, a user terminal of a first information system requesting an authorization token from an authentication platform of a server through the authentication client, the user terminal of the first information system including a first browser or a first client; upon obtaining the authorization token by the user terminal of the first information system, the user terminal of the first information system sending the authorization token to the authentication platform of the server; and upon successful verification of the authorization token, receiving a digital signature or receiving a session credential.

[0006] According to embodiments of this disclosure, when the identity authentication client completes login, the step of the user terminal of the first information system requesting an authorization token from the server's identity authentication platform through the identity authentication client includes: the user terminal of the first information system generating a login request data packet; the user terminal of the first information system transmitting the login request data packet to the identity authentication client, the login request data packet including a system identifier; the identity authentication client generating an authorization request based on a pre-stored authentication token and the login request data packet from the user terminal of the first information system; the identity authentication client sending the authorization request to the identity authentication platform; if the identity authentication platform successfully authenticates, the identity authentication client receiving an authorization token from the identity authentication platform; and the identity authentication client sending the authorization token to the user terminal of the first information system.

[0007] According to an embodiment of this disclosure, the step of transmitting the login request data packet from the user terminal of the first information system to the identity authentication client includes: the user terminal of the first information system transmitting the login request data packet based on a digital envelope.

[0008] According to embodiments of this disclosure, the step of sending the authorization token from the user terminal of the first information system to the identity authentication platform of the server after obtaining the authorization token includes: if the user terminal of the first information system is a first browser, the user terminal of the first information system directly sends the authorization token to the identity authentication platform; or if the user terminal of the first information system is a first client, the user terminal of the first information system indirectly sends the authorization token to the identity authentication platform via a first server.

[0009] According to embodiments of this disclosure, receiving a digital signature issued by an identity authentication platform or receiving a session credential formed based on the digital signature when the authorization token is successfully verified includes: when the user terminal of the first information system is a first browser, the user terminal of the first information system directly receives the digital signature issued by the identity authentication platform; or when the user terminal of the first information system is a first client, the user terminal of the first information system receives a session credential from a first server, wherein the session credential is formed based on the digital signature.

[0010] A second aspect of this disclosure provides a user login method applied in a server, the method comprising: when an identity authentication client completes login, an identity authentication platform issues an authorization token to a user terminal of a first information system through the identity authentication client, the user terminal of the first information system including a first client or a first browser; the identity authentication platform verifies the authorization token from the user terminal of the first information system; if the identity authentication platform successfully verifies the authorization token, a digital signature is generated; and the identity authentication platform sends the digital signature.

[0011] According to embodiments of this disclosure, when the identity authentication client completes login, the step of the identity authentication platform issuing an authorization token to the user terminal of the first information system through the identity authentication client includes: the identity authentication platform receiving an authorization request from the identity authentication client; the identity authentication platform parsing the authorization request to obtain first authentication information and a system identifier, wherein the first authentication information includes a first timestamp; the identity authentication platform executing a first verification rule and a second verification rule on the first authentication information and the system identifier, respectively; the identity authentication platform generating an authorization token if both the first verification rule and the second verification rule pass; and the identity authentication platform issuing the authorization token to the user terminal of the first information system via the identity authentication client.

[0012] According to embodiments of this disclosure, the step of the identity authentication platform executing a first verification rule and a second verification rule on the first authentication information and the system identifier respectively includes: for the first verification rule, the identity authentication platform verifies whether the first authentication information is consistent with source information pre-stored in the identity authentication platform, and verifies whether the user status verified by the first authentication information is valid; and for the second verification rule, the identity authentication platform verifies whether the system identifier is a platform access station.

[0013] According to an embodiment of this disclosure, the step of generating an authorization token by the identity authentication platform when both the first verification rule and the second verification rule pass includes: obtaining second authentication information by the identity authentication platform, the second authentication information including a second timestamp; and encrypting the second authentication information and the system identifier by the identity authentication platform to obtain the authorization token.

[0014] According to an embodiment of this disclosure, the step of verifying the authorization token from the user terminal of the first information system by the identity authentication platform includes: decrypting the authorization token by the identity authentication platform to obtain the second authentication information and the system identifier; executing a first verification rule on the second authentication information by the identity authentication platform; and executing a second verification rule on the system identifier by the identity authentication platform.

[0015] According to an embodiment of this disclosure, generating a digital signature when the authorization token is successfully verified by the identity authentication platform includes: obtaining third authentication information, which includes a third timestamp, by the identity authentication platform when both the first verification rule and the second verification rule pass; and generating a digital signature based on the third authentication information and the system identifier.

[0016] According to embodiments of this disclosure, the step of sending the digital signature by the identity authentication platform includes: sending the digital signature to the first browser when the user terminal of the first information system is a first browser; or sending the digital signature to the first server when the user terminal of the first information system is a first client.

[0017] A third aspect of this disclosure provides a user login device configured in a user terminal. The device includes: an authorization token acquisition module, configured to, when a login is completed by an authentication client, request an authorization token from the authentication platform of a server through the authentication client of a first information system, wherein the user terminal of the first information system includes a first browser or a first client; an authorization token login module, configured to, when the user terminal of the first information system obtains the authorization token, send the authorization token to the authentication platform of the server; and a login success module, configured to, when the authorization token is successfully verified, receive a digital signature or receive a session credential.

[0018] According to embodiments of this disclosure, an authorization token acquisition module includes: a login request data packet generation submodule, a login request data packet transmission submodule, an authorization request generation submodule, an authorization request sending submodule, an authorization token receiving submodule, and an authorization token forwarding submodule. The login request data packet generation submodule is used to generate a login request data packet by a user terminal of the first information system. The login request data packet transmission submodule is used to transmit the login request data packet from the user terminal of the first information system to an identity authentication client, the login request data packet including a system identifier. The authorization request generation submodule is used to generate an authorization request by the identity authentication client based on a pre-stored authentication token and the login request data packet from the user terminal of the first information system. The authorization request sending submodule is used to send the authorization request from the identity authentication client to an identity authentication platform. The authorization token receiving submodule is used to receive an authorization token from the identity authentication platform if the authentication is successful. The authorization token forwarding submodule is used to send the authorization token from the identity authentication client to the user terminal of the first information system.

[0019] According to an embodiment of this disclosure, the login request data packet transmission submodule includes: a secure transmission unit, used for transmitting the login request data packet by a user terminal of the first information system based on a digital envelope.

[0020] According to embodiments of this disclosure, the authorization token login module is used to send the authorization token directly to the identity authentication platform when the user terminal of the first information system is a first browser; or to send the authorization token indirectly to the identity authentication platform via a first server when the user terminal of the first information system is a first client.

[0021] According to embodiments of this disclosure, the login success module is used to allow the user terminal of the first information system to directly receive a digital signature issued by an identity authentication platform when the user terminal of the first information system is a first browser; or to allow the user terminal of the first information system to receive a session credential from a first server when the user terminal of the first information system is a first client, wherein the session credential is formed based on the digital signature.

[0022] A fourth aspect of this disclosure provides a user login device configured in a server. The device includes: an authorization token issuance module, used to issue an authorization token from an identity authentication platform to a user terminal of a first information system through the identity authentication client when the client completes login, the user terminal of the first information system including a first client or a first browser; an authorization token verification module, used to verify the authorization token from the user terminal of the first information system by the identity authentication platform; a digital signature generation module, used to generate a digital signature when the identity authentication platform successfully verifies the authorization token; and a digital signature delivery module, used to deliver the digital signature by the identity authentication platform.

[0023] According to embodiments of this disclosure, the authorization token sending module includes: an authorization request receiving submodule, an authorization request parsing submodule, a parsing content verification submodule, an authorization token generation submodule, and an authorization token issuing submodule. The authorization request receiving submodule is used by the identity authentication platform to receive an authorization request from an identity authentication client. The authorization request parsing submodule is used by the identity authentication platform to parse the authorization request to obtain first authentication information and a system identifier, the first authentication information including a first timestamp. The parsing content verification submodule is used by the identity authentication platform to execute a first verification rule and a second verification rule on the first authentication information and the system identifier, respectively. The authorization token generation submodule is used by the identity authentication platform to generate an authorization token if both the first verification rule and the second verification rule pass. The authorization token issuing submodule is used by the identity authentication platform to issue the authorization token to the user terminal of the first information system via the identity authentication client.

[0024] According to an embodiment of this disclosure, the parsed content verification submodule includes: a first verification unit and a second verification unit. The first verification unit is used to verify, based on the first verification rule, whether the first authentication information is consistent with the source information pre-stored in the identity authentication platform, and to verify, based on the first verification rule, whether the user status verified by the first authentication information is valid. The second verification unit is used to verify, based on the second verification rule, whether the system identifier is a platform access station.

[0025] According to an embodiment of this disclosure, the authorization token generation submodule includes: a second authentication information acquisition unit and an authorization token generation unit. The second authentication information acquisition unit is used to acquire second authentication information from an identity authentication platform, the second authentication information including a second timestamp. The authorization token generation unit is used to encrypt the second authentication information and the system identifier by the identity authentication platform to obtain the authorization token.

[0026] According to an embodiment of this disclosure, the authorization token verification module includes: an authorization token decryption unit and an authorization token verification unit. The authorization token decryption unit is used to decrypt the authorization token by the identity authentication platform to obtain the second authentication information and the system identifier. The authorization token verification unit is used to execute a first verification rule on the second authentication information by the identity authentication platform. The authorization token verification unit is used to execute a second verification rule on the system identifier by the identity authentication platform.

[0027] According to an embodiment of this disclosure, the digital signature generation module includes: a third authentication information acquisition unit and a digital signature generation unit. The third authentication information acquisition unit is used to acquire third authentication information by the identity authentication platform when both the first verification rule and the second verification rule pass. The third authentication information includes a third timestamp. The digital signature generation unit is used to generate a digital signature based on the third authentication information and the system identifier.

[0028] According to embodiments of this disclosure, the digital signature sending module includes: a first digital signature sending unit and a second digital signature sending unit. The first digital signature sending unit is used to send the digital signature to the first browser when the user terminal of the first information system is a first browser; or the second digital signature sending unit is used to send the digital signature to the first server when the user terminal of the first information system is a first client.

[0029] A fifth aspect of this disclosure provides an electronic device comprising: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors perform the user login method described above.

[0030] A sixth aspect of this disclosure also provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, cause the processor to perform the user login method described above.

[0031] The seventh aspect of this disclosure also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described user login method.

[0032] In the embodiments of this disclosure, to address the technical shortcomings of traditional single sign-on (SSO) schemes in cross-browser and cross-platform usage scenarios, the embodiments of this disclosure establish an identity authentication client and an identity authentication platform. When the identity authentication client logs in, it can obtain an authorization token specific to the browser / client through the browser / client's authorized identity via relevant browser / client interfaces. Then, it interacts with the identity authentication platform using this authorization token to complete the browser / client login operation. The embodiments of this disclosure can achieve at least the following beneficial effects:

[0033] 1. It overcomes the shortcomings of traditional single sign-on solutions in cross-browser and cross-platform usage scenarios, enabling single sign-on across all user terminals;

[0034] 2. The implementation difficulty of information systems can be reduced by encapsulating the identity authentication platform and its client;

[0035] 3. A unified authorization process enables single sign-on across browsers and devices, and also facilitates the implementation of security policies such as user behavior monitoring and access control. Attached Figure Description

[0036] The foregoing contents, as well as other objects, features, and advantages of this disclosure, will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0037] Figure 1A This diagram illustrates an application scenario of a user login method according to an embodiment of the present disclosure.

[0038] Figure 1B A flowchart illustrating the overall architecture of a user login method according to an embodiment of this disclosure is shown schematically.

[0039] Figure 2 A flowchart illustrating a user login method according to an embodiment of the present disclosure is shown schematically;

[0040] Figure 3 A flowchart illustrating an authorization token request method according to an embodiment of this disclosure is shown schematically;

[0041] Figure 4 A flowchart illustrating a user login method according to an embodiment of the present disclosure is shown schematically;

[0042] Figure 5 A flowchart illustrating an authorization token issuance method according to an embodiment of the present disclosure is shown schematically;

[0043] Figure 6 A flowchart illustrating an authorization token verification method according to an embodiment of the present disclosure is shown schematically;

[0044] Figure 7 The diagram illustrates the complete flow of a user login method under a B / S architecture according to an embodiment of the present disclosure.

[0045] Figure 8 The diagram illustrates the entire process flow of a user login method under a client / server architecture according to an embodiment of the present disclosure.

[0046] Figure 9 This schematically illustrates a structural block diagram of a user login device according to an embodiment of the present disclosure;

[0047] Figure 10 A schematic block diagram of a user login device according to an embodiment of the present disclosure is shown; and

[0048] Figure 11 A block diagram schematically illustrates an electronic device suitable for implementing a user login method according to an embodiment of the present disclosure. Detailed Implementation

[0049] The embodiments of the present disclosure will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the disclosure. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the present disclosure for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts of the present disclosure.

[0050] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this disclosure. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0051] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0052] When using expressions such as "at least one of A, B, and C", they should generally be interpreted in accordance with the meaning that is commonly understood by a person skilled in the art (e.g., "a system having at least one of A, B, and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B, and C, etc.).

[0053] Before providing a detailed description of the embodiments of this disclosure, the key technical terms involved in the embodiments of this disclosure will be explained one by one, as follows:

[0054] B / S architecture: also known as browser and server architecture, is a network architecture model that emerged after the rise of the web. The web browser is the most important application software on the client side. This model unifies the client side and centralizes the core parts of the system's functionality on the server, simplifying the development, maintenance, and use of the system.

[0055] C / S architecture: also known as client-server architecture, adopts a two-tier structure, where the server is responsible for data management and the client is responsible for completing the interaction tasks with the user.

[0056] Digital envelopes are a practical application of public-key cryptography, using encryption technology to ensure that only a designated recipient can read the contents of a communication. Digital envelopes employ both symmetric and public-key cryptography. This guarantees the authenticity and integrity of data transmission.

[0057] Token: A token is a temporary key in the system. It is random and difficult to decipher, similar to a username and password. It is used to determine whether a request is allowed and to identify which user the request belongs to. It can access network and system resources and can exist in the system permanently.

[0058] Digital signature: A digital string that can only be generated by the sender of the information and cannot be forged by others. This digital string is also a valid proof of the authenticity of the information sent by the sender.

[0059] A session, or session, represents a single interaction between a client and a server. This interaction can be continuous or discontinuous.

[0060] In the existing technology, there are single sign-on methods that are only for browsers or only for clients. These methods are not suitable for implementing identity authentication between C / S architecture business systems and B / S architecture business systems.

[0061] To address the technical problems existing in the prior art, embodiments of this disclosure provide a user login method. The method is applied to a user terminal and includes: when a login is completed on an identity authentication client, a user terminal of a first information system requests an authorization token from the identity authentication platform of a server through the identity authentication client. The user terminal of the first information system includes a first browser or a first client. If the user terminal of the first information system obtains the authorization token, it sends the authorization token to the identity authentication platform of the server. And if the authorization token is successfully verified, it receives a digital signature or a session credential.

[0062] In the embodiments of this disclosure, to address the technical shortcomings of traditional single sign-on (SSO) schemes in cross-browser and cross-platform usage scenarios, the embodiments of this disclosure establish an identity authentication client and an identity authentication platform. When the identity authentication client logs in, it can obtain an authorization token specific to the browser / client through the browser / client's authorized identity via relevant browser / client interfaces. Then, it interacts with the identity authentication platform using this authorization token to complete the browser / client login operation. The embodiments of this disclosure can achieve at least the following beneficial effects:

[0063] 1. It overcomes the shortcomings of traditional single sign-on solutions in cross-browser and cross-platform usage scenarios, enabling single sign-on across all user terminals;

[0064] 2. The implementation difficulty of information systems can be reduced by encapsulating the identity authentication platform and its client;

[0065] 3. A unified authorization process enables single sign-on across browsers and devices, and also facilitates the implementation of security policies such as user behavior monitoring and access control.

[0066] Figure 1A The illustration shows an application scenario diagram of the user login method according to an embodiment of the present disclosure.

[0067] like Figure 1A As shown, application scenario 100 according to this embodiment may include terminal devices 101, 102, and 103, network 104, and server 105. Network 104 is used as a medium to provide a communication link between terminal devices 101, 102, and 103 and server 105. Network 104 may include various connection types, such as wired or wireless communication links or fiber optic cables, etc.

[0068] Users can use terminal devices 101, 102, and 103 to interact with server 105 via network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, and 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0069] Terminal devices 101, 102, and 103 can be various electronic devices with displays and web browsing capabilities, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0070] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using terminal devices 101, 102, and 103 (for example only). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0071] It should be noted that the user login method provided in this embodiment can generally be executed by server 105. Correspondingly, the user login device provided in this embodiment can generally be located in server 105. The user login method provided in this embodiment can also be executed by a server or server cluster that is different from server 105 and capable of communicating with terminal devices 101, 102, 103 and / or server 105. Correspondingly, the user login device provided in this embodiment can also be located in a server or server cluster that is different from server 105 and capable of communicating with terminal devices 101, 102, 103 and / or server 105.

[0072] It should be understood that Figure 1AThe number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0073] Figure 1B A flowchart illustrating the overall architecture of a user login method according to an embodiment of this disclosure is shown schematically.

[0074] like Figure 1B As shown, taking an enterprise internal network as an example, in the embodiments of this disclosure, an identity authentication client is added to the user terminal device. This identity authentication client can serve as a centralized client for user login on the user terminal device. The identity authentication client corresponds to an identity authentication platform on the server side. Authentication and authorization of the identity authentication client can be achieved through interaction between the client and the platform. Furthermore, the identity authentication client provides authorization login interfaces for both B / S and C / S architecture systems, realizing a universal single sign-on mechanism. When the identity authentication client has obtained a valid identity, other user terminal devices logging into the information system, whether in a C / S or B / S architecture, do not need to enter account passwords or other verification information. They can directly obtain a valid identity through the already authorized identity authentication client, thus enabling interaction between the user terminal and the server side of the information system within the C / S or B / S architecture.

[0075] Figure 2 A flowchart illustrating a user login method according to an embodiment of the present disclosure is shown schematically.

[0076] like Figure 2 As shown, the user login method of this embodiment includes operations S210 to S230, and the user login method can be executed by terminal devices 101, 102, and 103.

[0077] In operation S210, when the identity authentication client completes the login, the user terminal of the first information system requests the authorization token of the server's identity authentication platform through the identity authentication client. The user terminal of the first information system includes a first browser or a first client.

[0078] Generally, a user needs to log in to multiple information systems. These information systems can be accessed through a browser or a client. Here, the first information system refers to a specific information system, and the user terminal of the first information system refers to the medium through which the user logs in to the information system on their device, including browsers and clients.

[0079] Users can verify their identity at the identity authentication client to achieve identity authentication and authorization (i.e., login to the identity authentication client). Therefore, combined with... Figure 1BAs shown, users can call the identity authentication client interface from a browser or client application. This interface transmits verification information (not account or password verification information), which is then combined with the relevant information from the identity authentication client to obtain an authorization token for the corresponding information system from the identity authentication platform. Each authorization token corresponds one-to-one with an information system and can only be used to log in to one information system. Subsequent logins to other information systems can be seamlessly achieved using the authorization token.

[0080] Specifically, the authorization token request method is as follows:

[0081] Figure 3 A flowchart illustrating an authorization token request method according to an embodiment of this disclosure is shown.

[0082] like Figure 3 As shown, the authorization token request method of this embodiment includes operations S310 to S360, which can at least partially perform the above-mentioned operation S210.

[0083] In operation S310, the user terminal of the first information system generates a login request data packet.

[0084] In operation S320, the user terminal of the first information system transmits the login request data packet to the identity authentication client, and the login request data packet includes a system identifier.

[0085] The login request data packet contains the verification data of the user terminal of the first information system. In the embodiments of this disclosure, the request data packet includes at least the system identifier of the first information system.

[0086] According to an embodiment of this disclosure, the step of transmitting the login request data packet from the user terminal of the first information system to the identity authentication client includes: the user terminal of the first information system transmitting the login request data packet based on a digital envelope.

[0087] Transmitting login request data via digital envelopes is more secure.

[0088] In operation S330, the identity authentication client generates an authorization request based on the pre-stored authentication token and the login request data packet from the user terminal of the first information system.

[0089] The authentication token is the authentication token corresponding to the "identity authentication client - identity authentication platform". It is generated by the identity authentication platform and sent to the identity authentication client when the identity authentication client completes the login.

[0090] In operation S340, the authentication client sends the authorization request to the authentication platform.

[0091] The identity authentication client sends an authorization request to the identity authentication platform for authentication. If the authentication is successful, the identity authentication platform issues an authorization token.

[0092] In operation S350, if the authentication is successful on the identity authentication platform, the identity authentication client receives an authorization token from the identity authentication platform.

[0093] In operation S360, the authentication client sends the authorization token to the user terminal of the first information system.

[0094] Specifically, the identity authentication client receives the authorization token from the identity authentication platform and forwards the authorization token to the user terminal of the first information system.

[0095] In operation S220, if the authorization token is obtained by the user terminal of the first information system, the user terminal of the first information system sends the authorization token to the identity authentication platform of the server.

[0096] Specifically, the first user's client uses the authorization token to authenticate with the identity authentication platform. The authentication process of the authorization token does not require forwarding by the identity authentication client.

[0097] According to embodiments of this disclosure, the step of sending the authorization token from the user terminal of the first information system to the identity authentication platform of the server after obtaining the authorization token includes: if the user terminal of the first information system is a first browser, the user terminal of the first information system directly sends the authorization token to the identity authentication platform; or if the user terminal of the first information system is a first client, the user terminal of the first information system indirectly sends the authorization token to the identity authentication platform via a first server.

[0098] Specifically, in a B / S architecture, the browser sends the authorization token directly to the identity authentication platform for verification; in a C / S architecture, the client first sends the authorization token to the corresponding server of the system, and then the server forwards the authorization token to the identity authentication platform for authentication.

[0099] In operation S230, if the authorization token is successfully verified, a digital signature is received, or a session credential is received.

[0100] According to embodiments of this disclosure, receiving a digital signature issued by an identity authentication platform or receiving a session credential formed based on the digital signature when the authorization token is successfully verified includes: when the user terminal of the first information system is a first browser, the user terminal of the first information system directly receives the digital signature issued by the identity authentication platform; or when the user terminal of the first information system is a first client, the user terminal of the first information system receives a session credential from a first server, wherein the session credential is formed based on the digital signature.

[0101] Specifically, in a B / S architecture, the browser directly receives the digital signature issued by the identity authentication platform; in a C / S architecture, the server receives the digital signature issued by the identity authentication platform, and then the server forms a session based on the digital signature and hands it over to the client.

[0102] In the embodiments of this disclosure, to address the technical shortcomings of traditional single sign-on (SSO) schemes in cross-browser and cross-platform usage scenarios, the embodiments of this disclosure establish an identity authentication client and an identity authentication platform. When the identity authentication client logs in, it can obtain an authorization token specific to the browser / client through the browser / client's authorized identity via relevant browser / client interfaces. Then, it interacts with the identity authentication platform using this authorization token to complete the browser / client login operation. The embodiments of this disclosure can achieve at least the following beneficial effects:

[0103] 1. It overcomes the shortcomings of traditional single sign-on solutions in cross-browser and cross-platform usage scenarios, enabling single sign-on across all user terminals;

[0104] 2. The implementation difficulty of information systems can be reduced by encapsulating the identity authentication platform and its client;

[0105] 3. A unified authorization process enables single sign-on across browsers and devices, and also facilitates the implementation of security policies such as user behavior monitoring and access control.

[0106] The user login method of the embodiments of this disclosure will be disclosed in detail from the perspective of the server, as follows:

[0107] Figure 4 A flowchart illustrating a user login method according to an embodiment of the present disclosure is shown schematically.

[0108] like Figure 4 As shown, the user login method in this embodiment includes operations S410 to S440, and the user login method can be executed by the server 105.

[0109] In operation S4 1.0, when the identity authentication client completes login, the identity authentication platform issues an authorization token to the user terminal of the first information system through the identity authentication client. The user terminal of the first information system includes the first client or the first browser.

[0110] Specifically, when the identity authentication client completes login and the user of the first information system requests the issuance of an authorization token, the identity authentication platform issues the authorization token.

[0111] Figure 5 A flowchart illustrating an authorization token issuance method according to an embodiment of the present disclosure is shown schematically.

[0112] like Figure 5 As shown, the authorization token issuance method of this embodiment includes operations S510 to S550, which can at least partially perform the above-mentioned operation S410.

[0113] In S510 operation, the identity authentication platform receives authorization requests from the identity authentication client.

[0114] In operation S520, the identity authentication platform parses the authorization request to obtain first authentication information and system identifier, wherein the first authentication information includes a first timestamp.

[0115] Specifically, the parsed authorization request includes: the authentication token (i.e., encrypted information text) obtained by the user after logging in, the authorization system identifier (a unique identifier granted by the platform), the current device fingerprint, and the event number, among other information.

[0116] After decrypting the authentication token (using national cryptographic algorithms such as SM4), the first authentication information is obtained: user account information, the login timestamp generated by the token (i.e., the first timestamp mentioned above), and the login device number, etc.

[0117] In operation S530, the identity authentication platform executes the first verification rule and the second verification rule on the first authentication information and the system identifier, respectively.

[0118] Among them, the first verification rule is the verification rule for the first authentication information, and the second verification rule is the verification rule for the system identifier.

[0119] According to embodiments of this disclosure, the step of the identity authentication platform executing a first verification rule and a second verification rule on the first authentication information and the system identifier respectively includes: for the first verification rule, the identity authentication platform verifies whether the first authentication information is consistent with source information pre-stored in the identity authentication platform, and verifies whether the user status verified by the first authentication information is valid; and for the second verification rule, the identity authentication platform verifies whether the system identifier is a platform access station.

[0120] Specifically, the identity authentication platform verifies whether the first authentication information is consistent with the source information pre-stored in the identity authentication platform. This includes determining whether the user account information, the login timestamp generated by the authentication token (i.e., the first timestamp), and the login device number are consistent with the data pre-stored by the identity authentication platform to ensure the validity of the source.

[0121] Specifically, the above-mentioned verification of the user status by the identity authentication platform includes: determining whether the identity of the authentication client is still valid by using the login timestamp generated by the token; and determining the validity of the token by using data affecting user login, such as the current user status and the user's password modification time stored in the background.

[0122] Specifically, the above-mentioned verification of whether the system identifier is a platform access station by the identity authentication platform includes: determining whether the information system corresponding to the system identifier is an information system that can be logged in in this way; at the same time, it can also verify whether the system identifier meets the business's preset authorization policy.

[0123] In operation S540, the identity authentication platform generates an authorization token if both the first verification rule and the second verification rule pass.

[0124] According to an embodiment of this disclosure, the step of generating an authorization token by the identity authentication platform when both the first verification rule and the second verification rule pass includes: obtaining second authentication information by the identity authentication platform, the second authentication information including a second timestamp; and encrypting the second authentication information and the system identifier by the identity authentication platform to obtain the authorization token.

[0125] The second authentication information is basically the same as the first authentication information except for the second timestamp. The second authentication information includes: user account information, login timestamp generated by the authorization token (i.e., the aforementioned second timestamp), and login device number, etc.

[0126] The encryption process can employ any encryption algorithm; for example, the SM4 national cryptographic algorithm can be used for encryption.

[0127] In operation S550, the identity authentication platform issues the authorization token to the user terminal of the first information system via the identity authentication client.

[0128] Specifically, the authorization token is forwarded from the identity authentication client to the browser or client to complete the issuance of the authorization token to the user end of the first information system.

[0129] In operation S420, the authorization token from the user terminal of the first information system is verified by the identity authentication platform.

[0130] Figure 6 A flowchart illustrating an authorization token verification method according to an embodiment of the present disclosure is shown schematically.

[0131] like Figure 6 As shown, the authorization token verification method of this embodiment includes operations S610 to S630, which can at least partially perform the above-mentioned operation S420.

[0132] In operation S610, the identity authentication platform decrypts the authorization token to obtain the second authentication information and the system identifier.

[0133] In operation S620, the identity authentication platform executes the first verification rule on the second authentication information.

[0134] In operation S630, the identity authentication platform performs a second verification rule on the system identifier.

[0135] Similarly, the verification process for authorization tokens is the same as that for authentication tokens, and will not be described in detail here.

[0136] In operation S430, if the identity authentication platform successfully verifies the authorization token, a digital signature is generated.

[0137] According to an embodiment of this disclosure, generating a digital signature when the authorization token is successfully verified by the identity authentication platform includes: obtaining third authentication information, which includes a third timestamp, by the identity authentication platform when both the first verification rule and the second verification rule pass; and generating a digital signature based on the third authentication information and the system identifier.

[0138] The third authentication information is basically the same as the first and second authentication information, except for the third timestamp. The third authentication information includes: user account information, the current login timestamp (i.e. the aforementioned third timestamp), and login device number, etc.

[0139] In operation S440, the digital signature is sent by the identity authentication platform.

[0140] According to embodiments of this disclosure, the step of sending the digital signature by the identity authentication platform includes: sending the digital signature to the first browser when the user terminal of the first information system is a first browser; or sending the digital signature to the first server when the user terminal of the first information system is a first client.

[0141] Specifically, in a B / S architecture, the identity authentication platform sends a digital signature to the browser to complete the login; in a C / S architecture, the identity authentication platform sends the digital signature to the corresponding server of the system, and the server then generates a session credential and returns it to the first client.

[0142] In the embodiments of this disclosure, to address the technical shortcomings of traditional single sign-on (SSO) schemes in cross-browser and cross-platform usage scenarios, the embodiments of this disclosure establish an identity authentication client and an identity authentication platform. When the identity authentication client logs in, it can obtain an authorization token specific to the browser / client through the browser / client's authorized identity via relevant browser / client interfaces. Then, it interacts with the identity authentication platform using this authorization token to complete the browser / client login operation. The embodiments of this disclosure can achieve at least the following beneficial effects:

[0143] 1. It overcomes the shortcomings of traditional single sign-on solutions in cross-browser and cross-platform usage scenarios, enabling single sign-on across all user terminals;

[0144] 2. The implementation difficulty of information systems can be reduced by encapsulating the identity authentication platform and its client;

[0145] 3. A unified authorization process enables single sign-on across browsers and devices, and also facilitates the implementation of security policies such as user behavior monitoring and access control.

[0146] Figure 7 The diagram illustrates the complete flow of a user login method under a B / S architecture according to an embodiment of the present disclosure.

[0147] like Figure 7 The diagram illustrates the authorization process of a B / S architecture information system. Users, having already logged into their authentication client, access the B / S architecture information system through a browser. The user login method under the B / S architecture involves the following operations:

[0148] In step 1, after logging in through the identity authentication client, the user accesses information system A through a browser.

[0149] In step 2, information system A initiates a user login authorization request through the local interface provided by the identity authentication client. The request data packet is transmitted via a digital envelope to ensure the confidentiality and integrity of the transmission.

[0150] In step 3, the identity authentication client requests authorization from the identity authentication platform (server). The request data includes the authentication token (encrypted information text) obtained after the user logs in, the authorization system identifier (a unique identifier granted by the platform), the current device fingerprint, the event number, and other information.

[0151] In step 4, the identity authentication platform verifies the authentication token. The authentication token is information encrypted using the SM4 algorithm, and the key for the SM4 algorithm is held only by the platform. The token contains user account information, the login timestamp generated by the token, the login device ID, etc. The platform needs to verify the information sent in the authorization request to ensure the consistency between the authentication token and the source of the authorization request.

[0152] In step 5, the identity authentication platform checks the user's status. The platform needs to check key data affecting user login, such as the current user status and the time the user's password was modified, to ensure the validity of the authentication token used to request authorization.

[0153] In step 6, the identity authentication platform generates an authorization token for information system A. The platform needs to verify the system identifier of information system A, checking whether it is a platform access station and whether it meets the authorization policy. The authorization token is information encrypted using the SM4 algorithm, which includes user account information, the token's timestamp, login device number, authorized system identifier, event number, and other information.

[0154] In step 7, the identity authentication platform returns an authorization token to the identity authentication client.

[0155] In step 8, the authentication client returns an authorization token to information system A in response to the browser request.

[0156] In step 9, the information system A server requests authorization token verification through the identity authentication platform service interface.

[0157] In step 10, the identity authentication platform verifies the authorization token issued to information system A. The platform needs to verify the authorization token sent to information system A to confirm its authorization.

[0158] In step 11, the identity authentication platform checks the user's status. The platform needs to check key data affecting user login, such as the current user status and the time the user's password was modified, to ensure the validity of the authentication token used to request authorization.

[0159] In step 12, the identity authentication platform generates a digital signature for information system A. The digital signature is information encrypted using the SM4 algorithm, which includes brief user information, login timestamp, event number, and other information.

[0160] In step 13, the identity authentication platform returns a digital signature to information system A.

[0161] In step 14, after information system A completes the verification of the digital signature, the login verification is completed, and the user is returned to the system homepage.

[0162] Figure 8 The diagram illustrates the complete flow of a user login method under a client / server architecture according to an embodiment of the present disclosure.

[0163] like Figure 8 The diagram illustrates the authorization process of a C / S architecture information system. Users, already logged into the authentication client, log into the C / S architecture information system client. The user login method under the C / S architecture involves the following operations:

[0164] In step 1, after logging in on the identity authentication client, the user logs in to the C / S architecture information system client.

[0165] In step 2, information system A initiates a user login authorization request through the local interface provided by the identity authentication client. The request data packet is transmitted via a digital envelope to ensure the confidentiality and integrity of the transmission.

[0166] In step 3, the identity authentication client requests authorization from the identity authentication platform (server). The request data includes the authentication token (encrypted information text) obtained after the user logs in, the authorization system identifier (a unique identifier granted by the platform), the current device fingerprint, the event number, and other information.

[0167] In step 4, the identity authentication platform verifies the authentication token. The authentication token is information encrypted using the SM4 algorithm, which includes user account information, the login timestamp generated by the token, and the login device ID. The platform needs to verify the information sent in the authorization request to ensure the consistency between the authentication token and the source of the authorization request.

[0168] In step 5, the identity authentication platform checks the user's status. The platform needs to check key data affecting user login, such as the current user status and the time the user's password was modified, to ensure the validity of the authentication token used to request authorization.

[0169] In step 6, the identity authentication platform generates an authorization token for information system A. The platform needs to verify the system identifier of information system A, checking whether it is a platform access station and whether it meets the authorization policy. The authorization token is information encrypted using the SM4 algorithm, which includes user account information, the token's timestamp, login device number, authorized system identifier, event number, and other information.

[0170] In step 7, the identity authentication platform returns an authorization token to the identity authentication client.

[0171] In step 8, the identity authentication client returns an authorization token to information system A in response to the information system client's request.

[0172] In step 9, the information system client sends the authorization token and local device information to the information system A server, requesting verification of the authorization token.

[0173] In step 10, the information system A server requests authorization token verification through the identity authentication platform service interface.

[0174] In step 11, the identity authentication platform verifies the authorization token issued to information system A. The platform needs to verify the authorization token sent to information system A to confirm its authorization.

[0175] In step 12, the identity authentication platform checks the user's status. The platform needs to check key data affecting user login, such as the current user status and the time the user's password was modified, to ensure the validity of the authentication token used to request authorization.

[0176] In step 13, the identity authentication platform generates a digital signature for information system A. The digital signature is information encrypted using the SM4 algorithm, which includes brief user information, login timestamp, event number, and other information.

[0177] In step 14, the identity authentication platform returns a digital signature to information system A.

[0178] In step 15, after information system A completes the verification of the digital signature, the login verification is completed, and session credentials are returned to the information system client.

[0179] In step 16, the information system A client completes the login operation and enters the main function interface.

[0180] Based on the above user login method, this disclosure also provides a user login device, which is respectively installed in terminal devices 101, 102, 103 and server 105. The following will be combined with... Figure 9 and Figure 10 The device is described in detail.

[0181] Figure 9 A schematic block diagram of a user login device according to an embodiment of the present disclosure is shown.

[0182] like Figure 9 As shown, the user login device 900 in this embodiment includes an authorization token acquisition module 910, an authorization token login module 920, and a login success module 930. The user login device 900 is disposed in terminal devices 101, 102, and 103.

[0183] The authorization token acquisition module 910 is used to request an authorization token from the server's identity authentication platform by the user terminal of the first information system through the identity authentication client after the client has completed login. The user terminal of the first information system includes a first browser or a first client. In one embodiment, the authorization token acquisition module 910 can be used to perform the operation S210 described above, which will not be repeated here.

[0184] The authorization token login module 920 is used to send the authorization token from the user terminal of the first information system to the identity authentication platform of the server when the user terminal of the first information system obtains the authorization token. In one embodiment, the authorization token login module 920 can be used to perform the operation S220 described above, which will not be repeated here.

[0185] The login success module 930 is used to receive a digital signature or a session credential if the authorization token is successfully verified. In one embodiment, the login success module 930 can be used to perform the operation S230 described above, which will not be repeated here.

[0186] In the embodiments of this disclosure, to address the technical shortcomings of traditional single sign-on (SSO) schemes in cross-browser and cross-platform usage scenarios, the embodiments of this disclosure establish an identity authentication client and an identity authentication platform. When the identity authentication client logs in, it can obtain an authorization token specific to the browser / client through the browser / client's authorized identity via relevant browser / client interfaces. Then, it interacts with the identity authentication platform using this authorization token to complete the browser / client login operation. The embodiments of this disclosure can achieve at least the following beneficial effects:

[0187] 1. It overcomes the shortcomings of traditional single sign-on solutions in cross-browser and cross-platform usage scenarios, enabling single sign-on across all user terminals;

[0188] 2. The implementation difficulty of information systems can be reduced by encapsulating the identity authentication platform and its client;

[0189] 3. A unified authorization process enables single sign-on across browsers and devices, and also facilitates the implementation of security policies such as user behavior monitoring and access control.

[0190] According to embodiments of this disclosure, an authorization token acquisition module includes: a login request data packet generation submodule, a login request data packet transmission submodule, an authorization request generation submodule, an authorization request sending submodule, an authorization token receiving submodule, and an authorization token forwarding submodule. The login request data packet generation submodule is used to generate a login request data packet by a user terminal of the first information system. The login request data packet transmission submodule is used to transmit the login request data packet from the user terminal of the first information system to an identity authentication client, the login request data packet including a system identifier. The authorization request generation submodule is used to generate an authorization request by the identity authentication client based on a pre-stored authentication token and the login request data packet from the user terminal of the first information system. The authorization request sending submodule is used to send the authorization request from the identity authentication client to an identity authentication platform. The authorization token receiving submodule is used to receive an authorization token from the identity authentication platform if the authentication is successful. The authorization token forwarding submodule is used to send the authorization token from the identity authentication client to the user terminal of the first information system.

[0191] According to an embodiment of this disclosure, the login request data packet transmission submodule includes: a secure transmission unit, used for transmitting the login request data packet by a user terminal of the first information system based on a digital envelope.

[0192] According to embodiments of this disclosure, the authorization token login module is used to send the authorization token directly to the identity authentication platform when the user terminal of the first information system is a first browser; or to send the authorization token indirectly to the identity authentication platform via a first server when the user terminal of the first information system is a first client.

[0193] According to embodiments of this disclosure, the login success module is used to allow the user terminal of the first information system to directly receive a digital signature issued by an identity authentication platform when the user terminal of the first information system is a first browser; or to allow the user terminal of the first information system to receive a session credential from a first server when the user terminal of the first information system is a first client, wherein the session credential is formed based on the digital signature.

[0194] According to embodiments of this disclosure, any plurality of modules among the authorization token acquisition module 910, authorization token login module 920, and login success module 930 can be combined into one module, or any one of these modules can be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules can be combined with at least part of the functionality of other modules and implemented in one module. According to embodiments of this disclosure, at least one of the authorization token acquisition module 910, authorization token login module 920, and login success module 930 can be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or implemented by any other reasonable means of integrating or packaging circuitry, or implemented in software, hardware, or firmware, or in any appropriate combination of any of these three implementation methods. Alternatively, at least one of the authorization token acquisition module 910, authorization token login module 920, and login success module 930 can be at least partially implemented as a computer program module, which, when run, can perform corresponding functions.

[0195] Figure 10 A schematic block diagram of a user login device according to an embodiment of the present disclosure is shown.

[0196] like Figure 10 As shown, the user login device 1000 in this embodiment includes an authorization token issuance module 1010, an authorization token verification module 1020, a digital signature generation module 1030, and a digital signature delivery module 1040. The user login device 1000 is located in the server 105.

[0197] The authorization token issuance module 1010 is used to issue an authorization token from the identity authentication platform to the user terminal of the first information system through the identity authentication client after the client has completed login. The user terminal of the first information system includes a first client or a first browser. In one embodiment, the authorization token issuance module 1010 can be used to perform the operation S410 described above, which will not be repeated here.

[0198] The authorization token verification module 1020 is used by the identity authentication platform to verify the authorization token from the user terminal of the first information system. In one embodiment, the authorization token verification module 1020 can be used to perform the operation S420 described above, which will not be repeated here.

[0199] The digital signature generation module 1030 is used to generate a digital signature when the authorization token is successfully verified by the identity authentication platform. In one embodiment, the digital signature generation module 1030 can be used to perform the operation S430 described above, which will not be repeated here.

[0200] The digital signature delivery module 1040 is used to deliver the digital signature by the identity authentication platform. In one embodiment, the digital signature delivery module 1040 can be used to perform the operation S440 described above, which will not be repeated here.

[0201] In the embodiments of this disclosure, to address the technical shortcomings of traditional single sign-on (SSO) schemes in cross-browser and cross-platform usage scenarios, the embodiments of this disclosure establish an identity authentication client and an identity authentication platform. When the identity authentication client logs in, it can obtain an authorization token specific to the browser / client through the browser / client's authorized identity via relevant browser / client interfaces. Then, it interacts with the identity authentication platform using this authorization token to complete the browser / client login operation. The embodiments of this disclosure can achieve at least the following beneficial effects:

[0202] 1. It overcomes the shortcomings of traditional single sign-on solutions in cross-browser and cross-platform usage scenarios, enabling single sign-on across all user terminals;

[0203] 2. The implementation difficulty of information systems can be reduced by encapsulating the identity authentication platform and its client;

[0204] 3. A unified authorization process enables single sign-on across browsers and devices, and also facilitates the implementation of security policies such as user behavior monitoring and access control.

[0205] According to embodiments of this disclosure, the authorization token sending module includes: an authorization request receiving submodule, an authorization request parsing submodule, a parsing content verification submodule, an authorization token generation submodule, and an authorization token issuing submodule. The authorization request receiving submodule is used by the identity authentication platform to receive an authorization request from an identity authentication client. The authorization request parsing submodule is used by the identity authentication platform to parse the authorization request to obtain first authentication information and a system identifier, the first authentication information including a first timestamp. The parsing content verification submodule is used by the identity authentication platform to execute a first verification rule and a second verification rule on the first authentication information and the system identifier, respectively. The authorization token generation submodule is used by the identity authentication platform to generate an authorization token if both the first verification rule and the second verification rule pass. The authorization token issuing submodule is used by the identity authentication platform to issue the authorization token to the user terminal of the first information system via the identity authentication client.

[0206] According to an embodiment of this disclosure, the parsed content verification submodule includes: a first verification unit and a second verification unit. The first verification unit is used to verify, based on the first verification rule, whether the first authentication information is consistent with the source information pre-stored in the identity authentication platform, and to verify, based on the first verification rule, whether the user status verified by the first authentication information is valid. The second verification unit is used to verify, based on the second verification rule, whether the system identifier is a platform access station.

[0207] According to an embodiment of this disclosure, the authorization token generation submodule includes: a second authentication information acquisition unit and an authorization token generation unit. The second authentication information acquisition unit is used to acquire second authentication information from an identity authentication platform, the second authentication information including a second timestamp. The authorization token generation unit is used to encrypt the second authentication information and the system identifier by the identity authentication platform to obtain the authorization token.

[0208] According to an embodiment of this disclosure, the authorization token verification module includes: an authorization token decryption unit and an authorization token verification unit. The authorization token decryption unit is used to decrypt the authorization token by the identity authentication platform to obtain the second authentication information and the system identifier. The authorization token verification unit is used to execute a first verification rule on the second authentication information by the identity authentication platform. The authorization token verification unit is used to execute a second verification rule on the system identifier by the identity authentication platform.

[0209] According to an embodiment of this disclosure, the digital signature generation module includes: a third authentication information acquisition unit and a digital signature generation unit. The third authentication information acquisition unit is used to acquire third authentication information by the identity authentication platform when both the first verification rule and the second verification rule pass. The third authentication information includes a third timestamp. The digital signature generation unit is used to generate a digital signature based on the third authentication information and the system identifier.

[0210] According to embodiments of this disclosure, the digital signature sending module includes: a first digital signature sending unit and a second digital signature sending unit. The first digital signature sending unit is used to send the digital signature to the first browser when the user terminal of the first information system is a first browser; or the second digital signature sending unit is used to send the digital signature to the first server when the user terminal of the first information system is a first client.

[0211] According to embodiments of this disclosure, any multiple modules among the authorization token issuance module 1010, authorization token verification module 1020, digital signature generation module 1030, and digital signature delivery module 1040 can be combined into one module, or any one of these modules can be split into multiple modules. Alternatively, at least some of the functions of one or more of these modules can be combined with at least some of the functions of other modules and implemented in one module. According to embodiments of this disclosure, at least one of the authorization token issuance module 1010, authorization token verification module 1020, digital signature generation module 1030, and digital signature delivery module 1040 can be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or implemented in hardware or firmware by any other reasonable means of integrating or packaging the circuitry, or implemented in software, hardware, or firmware, or in any suitable combination of any of these three implementation methods. Alternatively, at least one of the authorization token issuance module 1010, authorization token verification module 1020, digital signature generation module 1030, and digital signature delivery module 1040 can be implemented at least partially as a computer program module, which can perform corresponding functions when the computer program module is run.

[0212] Figure 11 A block diagram schematically illustrates an electronic device suitable for implementing a user login method according to an embodiment of the present disclosure.

[0213] like Figure 11 As shown, an electronic device 1100 according to an embodiment of the present disclosure includes a processor 1101, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1102 or a program loaded from a storage portion 1108 into a random access memory (RAM) 1103. The processor 1101 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 1101 may also include onboard memory for caching purposes. The processor 1101 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0214] RAM 1103 stores various programs and data required for the operation of electronic device 1100. Processor 1101, ROM 1102, and RAM 1103 are interconnected via bus 1104. Processor 1101 performs various operations of the method flow according to embodiments of the present disclosure by executing programs in ROM 1102 and / or RAM 1103. It should be noted that the programs may also be stored in one or more memories other than ROM 1102 and RAM 1103. Processor 1101 may also perform various operations of the method flow according to embodiments of the present disclosure by executing programs stored in said one or more memories.

[0215] According to embodiments of this disclosure, the electronic device 1100 may further include an input / output (I / O) interface 1105, which is also connected to a bus 1104. The electronic device 1100 may also include one or more of the following components connected to the I / O interface 1105: an input section 1106 including a keyboard, mouse, etc.; an output section 1107 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 1108 including a hard disk, etc.; and a communication section 1109 including a network interface card such as a LAN card, modem, etc. The communication section 1109 performs communication processing via a network such as the Internet. A drive 1110 is also connected to the I / O interface 1105 as needed. A removable medium 1111, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 1110 as needed so that computer programs read from it can be installed into the storage section 1108 as needed.

[0216] This disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs that, when executed, implement the method according to the embodiments of this disclosure.

[0217] According to embodiments of this disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, such as including, but not limited to: portable computer disks, hard disks, random access memory (RAM), readable memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk readable memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this disclosure, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this disclosure, a computer-readable storage medium may include ROM 1102 and / or RAM 1103 and / or one or more memories other than ROM 1102 and RAM 1103 described above.

[0218] Embodiments of this disclosure also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to cause the computer system to implement the item recommendation method provided in the embodiments of this disclosure.

[0219] When the computer program is executed by the processor 1101, it performs the functions defined in the system / apparatus of this disclosure embodiments. According to embodiments of this disclosure, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0220] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 1109, and / or installed from the removable medium 1111. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0221] In such an embodiment, the computer program can be downloaded and installed from a network via communication section 1109, and / or installed from removable medium 1111. When the computer program is executed by processor 1101, it performs the functions defined in the system of this disclosure embodiment. According to embodiments of this disclosure, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0222] According to embodiments of this disclosure, program code for executing the computer programs provided in embodiments of this disclosure can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can execute entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0223] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0224] Those skilled in the art will understand that the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways, even if such combinations or combinations are not explicitly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or combinations fall within the scope of this disclosure.

[0225] The embodiments of this disclosure have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of this disclosure. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. The scope of this disclosure is defined by the appended claims and their equivalents. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of this disclosure, and all such substitutions and modifications should fall within the scope of this disclosure.

Claims

1. A user login method, characterized by, The method is applied to user terminals. The method includes: When the identity authentication client completes the login, the user terminal of the first information system requests the authorization token of the server's identity authentication platform through the identity authentication client. The user terminal of the first information system includes the first browser or the first client. When the user terminal of the first information system obtains the authorization token, the user terminal of the first information system sends the authorization token to the identity authentication platform of the server; and If the authorization token is successfully verified, a digital signature or a session credential is received. The step of requesting an authorization token from the server's identity authentication platform by the user terminal of the first information system through the identity authentication client after successful login includes: generating a login request data packet by the user terminal of the first information system; transmitting the login request data packet, including a system identifier, to the identity authentication client by the user terminal of the first information system; generating an authorization request based on a pre-stored authentication token and the login request data packet from the user terminal of the first information system; sending the authorization request to the identity authentication platform by the identity authentication client; receiving the authorization token from the identity authentication platform if the authentication is successful; and sending the authorization token to the user terminal of the first information system by the identity authentication client. Wherein, when the user terminal of the first information system obtains the authorization token, the user terminal of the first information system sends the authorization token to the identity authentication platform of the server, including: when the user terminal of the first information system is a first browser, the user terminal of the first information system directly sends the authorization token to the identity authentication platform; or when the user terminal of the first information system is a first client, the user terminal of the first information system indirectly sends the authorization token to the identity authentication platform via the first server. Specifically, if the authorization token is successfully verified, receiving a digital signature issued by the identity authentication platform, or receiving a session credential formed based on the digital signature, includes: if the user terminal of the first information system is a first browser, the user terminal of the first information system directly receives the digital signature issued by the identity authentication platform; or if the user terminal of the first information system is a first client, the user terminal of the first information system receives a session credential from the first server, wherein the session credential is formed based on the digital signature.

2. The method of claim 1, wherein, The process of transmitting the login request data packet from the user terminal of the first information system to the identity authentication client includes: The login request data packet is transmitted by the user terminal of the first information system based on a digital envelope.

3. A user login method characterized by, The method is applied to a server. The method includes: In the case that the identity authentication client completes login, the identity authentication platform issues an authorization token to the user end of the first information system through the identity authentication client, the user end of the first information system including the first client or the first browser; The identity authentication platform verifies the authorization token from the user end of the first information system; In the case that the identity authentication platform verifies the authorization token successfully, a digital signature is generated; and The identity authentication platform sends the digital signature; Wherein, in the case that the identity authentication client completes login, the identity authentication platform issues an authorization token to the user end of the first information system through the identity authentication client, including: the identity authentication platform receives an authorization request from the identity authentication client; the identity authentication platform parses the authorization request to obtain first authentication information and a system identifier, the first authentication information including a first timestamp; the identity authentication platform executes first and second verification rules on the first authentication information and the system identifier, respectively; the identity authentication platform generates an authorization token in the case that the first and second verification rules are passed; and the identity authentication platform issues the authorization token to the user end of the first information system through the identity authentication client; Wherein, the identity authentication platform executes first and second verification rules on the first authentication information and the system identifier, respectively, including: for the first verification rule, the identity authentication platform checks whether the first authentication information is consistent with the source information pre-existing in the identity authentication platform, and the identity authentication platform checks whether the first authentication information checks the user state to be valid; and for the second verification rule, the identity authentication platform checks whether the system identifier is a platform access station Wherein, the identity authentication platform sends the digital signature, including: in the case that the user end of the first information system is the first browser, the digital signature is sent to the first browser; or in the case that the user end of the first information system is the first client, the digital signature is sent to the first service end.

4. The method of claim 3, wherein, The identity authentication platform generates an authorization token in the case that the first and second verification rules are passed, including: The identity authentication platform obtains second authentication information, the second authentication information including a second timestamp; and The identity authentication platform encrypts the second authentication information and the system identifier to obtain the authorization token.

5. The method of claim 4, wherein, The identity authentication platform verifies the authorization token from the user end of the first information system, including: The identity authentication platform decrypts the authorization token to obtain the second authentication information and the system identifier; The identity authentication platform executes a first verification rule on the second authentication information; and The identity authentication platform executes a second verification rule on the system identifier.

6. The method of claim 5, wherein, In the case that the identity authentication platform verifies the authorization token successfully, a digital signature is generated, including: obtaining third authentication information by the identity authentication platform in the case that the first check rule and the second check rule are both passed, the third authentication information comprising a third timestamp; generating a digital signature based on the third authentication information and the system identifier.

7. A user login apparatus characterized by comprising: The device is configured in a user terminal, The device comprises: an authorization token obtaining module configured to, in the case that the identity authentication client completes login, request, by the user terminal of the first information system through the identity authentication client, an authorization token of the identity authentication platform of the server, the user terminal of the first information system comprising a first browser or a first client; an authorization token login module configured to, in the case that the user terminal of the first information system obtains the authorization token, send the authorization token to the identity authentication platform of the server by the user terminal of the first information system; and a login success module configured to, in the case that the authorization token is verified successfully, receive a digital signature or a session credential; wherein the case that the identity authentication client completes login, the authorization token of the identity authentication platform of the server is requested by the user terminal of the first information system through the identity authentication client, comprises: generating, by the user terminal of the first information system, a login request data packet; transmitting, by the user terminal of the first information system, the login request data packet to the identity authentication client, the login request data packet comprising a system identifier; generating, by the identity authentication client, an authorization request based on a pre-stored authentication token and the login request data packet from the user terminal of the first information system; sending, by the identity authentication client, the authorization request to the identity authentication platform; in the case that the identity authentication platform is authenticated successfully, receiving, by the identity authentication client, an authorization token from the identity authentication platform; and sending, by the identity authentication client, the authorization token to the user terminal of the first information system; wherein, in the case that the user terminal of the first information system obtains the authorization token, the authorization token is sent to the identity authentication platform of the server by the user terminal of the first information system, comprising: in the case that the user terminal of the first information system is a first browser, the authorization token is directly sent to the identity authentication platform by the user terminal of the first information system; or in the case that the user terminal of the first information system is a first client, the authorization token is indirectly sent to the identity authentication platform by the user terminal of the first information system via a first service terminal; wherein, in the case that the authorization token is verified successfully, a digital signature issued by the identity authentication platform is received or a session credential formed based on the digital signature is received, comprising: in the case that the user terminal of the first information system is a first browser, a digital signature issued by the identity authentication platform is directly received by the user terminal of the first information system; or in the case that the user terminal of the first information system is a first client, a session credential from a first service terminal is received by the user terminal of the first information system, the session credential being formed based on the digital signature.

8. A user login apparatus characterized by comprising: The device is configured in a server, The device comprises: The authorization token issuing module is configured to issue, by the identity authentication platform, an authorization token to the user end of the first information system via the identity authentication client in a case where the identity authentication client completes login, the user end of the first information system including the first client or the first browser. The authorization token verification module is configured to verify, by the identity authentication platform, the authorization token from the user end of the first information system. The digital signature generation module is configured to generate a digital signature in a case where the identity authentication platform verifies the authorization token successfully. The digital signature sending module is configured to send, by the identity authentication platform, the digital signature. The authorization token issuing module is configured to issue, by the identity authentication platform, an authorization token to the user end of the first information system via the identity authentication client in a case where the identity authentication client completes login, the user end of the first information system including the first client or the first browser. The authorization token issuing module is configured to issue, by the identity authentication platform, an authorization token to the user end of the first information system via the identity authentication client in a case where the identity authentication client completes login, the user end of the first information system including the first client or the first browser. The authorization token issuing module is configured to issue, by the identity authentication platform, an authorization token to the user end of the first information system via the identity authentication client in a case where the identity authentication client completes login, the user end of the first information system including the first client or the first browser. The authorization token issuing module is configured to issue, by the identity authentication platform, an authorization token to the user end of the first information system via the identity authentication client in a case where the identity authentication client completes login, the user end of the first information system including the first client or the first browser.

9. An electronic device comprising: one or more processors; storage means configured to store one or more computer programs, 10. A computer-readable storage medium having stored thereon a computer program, characterized in that, characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1-6.

11. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method according to any one of claims 1-6. The computer program is executed by the processor to implement the steps of the method according to any one of claims 1-6. The computer program is executed by the processor to implement the steps of the method according to any one of claims 1-6.

Images